CVE-2026-72371

A flaw was found in the Linux kernel's AFS Andrew File System component. The afsinsertvolumeintocell function incorrectly sets the AFSVOLUMERMTREE flag on the new volume instead of the replaced volume. This error causes the old volume to be removed twice and the new volume to remain in the cell's...

CVE-2026-72158

A flaw was found in the Linux kernel's FPGA Dynamic Function Link DFL subsystem. A malicious FPGA device can provide specially crafted parameter headers, causing the system to miscalculate the size of a feature region. This incorrect size can lead to a memory corruption vulnerability when data is...

CVE-2026-72156

A flaw was found in the Linux kernel's microchip-spi Field-Programmable Gate Array FPGA module. This vulnerability occurs in the mpfopsparseheader function when processing a bitstream. If a crafted bitstream sets the headersize to zero, the function attempts to read data from memory before the...

CVE-2026-72153

A flaw was found in the Linux kernel's irqchip/crossbar component. The crossbardomainfree function incorrectly uses a nulled-out hardware interrupt hwirq member as an index when attempting to free domain data. This can lead to an out-of-bounds write when resetting an interrupt mapping entry or...

CVE-2026-72151

A flaw was found in the Linux kernel's Trusted Platform Module TPM2 session handling. Specifically, the tpmbufappendsalt function does not properly manage asynchronous cryptographic key operations. This oversight can lead to a use-after-free vulnerability, where the system attempts to access memo...

CVE-2026-72147

A flaw was found in the dw-edma-pcie component of the Linux kernel's Direct Memory Access DMA engine. This vulnerability occurs because the dwedmapcieprobe function attempts to use PCI device ID driver data as a template without verifying its presence. A local attacker, by binding a device...

CVE-2026-75778

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-56109

A flaw was found in the ALSA Advanced Linux Sound Architecture library. This double-free vulnerability, located in the parsedef function, allows a local attacker to corrupt memory by providing specially crafted ALSA configuration text. When processing nested configuration blocks, the library...

CVE-2026-72439

A flaw was found in the Linux kernel's md/raid10 component. When write requests fail, the raid10writerequest function may not properly release a writespending reference. This resource leak can accumulate over time, potentially leading to a denial of service DoS condition where the system becomes...

CVE-2026-72145

A flaw was found in the Linux kernel's platform/x86/intel/tpmi component. This vulnerability occurs due to improper memory deallocation within the memwrite function, where a temporary array was not consistently released on all exit paths. This could lead to a memory leak, potentially impacting...

CVE-2026-72137

A flaw was found in the xfrm subsystem of the Linux kernel, specifically within the natkeepalive component. This vulnerability occurs when the natkeepalivesend function attempts to free a network packet buffer skb that may have already been freed by the networking stack. This double free can lead...

CVE-2026-75846

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

CVE-2026-75841

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or...

CVE-2026-75834

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u UTF-8 modifier, so a single invalid UTF-8 byte anywhere in page content causes pregmatch to return false for...

CVE-2026-75835

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-75833

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

CVE-2026-75828

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers...

CVE-2026-75827

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

CVE-2026-75774

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of...

CVE-2026-74905

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...