CVE-2026-64231

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for...

DEBIAN-CVE-2026-64223

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...

kernel: ipv6: fix possible UAF in icmpv6_rcv()

A flaw was found in the Linux kernel's IPv6 Internet Protocol version 6 implementation. This vulnerability, a Use-After-Free UAF error, occurs due to incorrect caching of network packet addresses before a memory operation. An attacker could potentially exploit this flaw to cause memory corruption...

CVE-2026-64229

The CVE-2026-64229 entry concerns the Linux kernel issue in x86 memory management: when PCID is disabled, broadcast TLB flush can remain enabled if INVLPGB is present, leading to a mismatch between global ASID handling and PCID state. The vulnerable flow toggles about three CPUs, with mm_global_a...

CVE-2026-45812

creationtimestamp| type| source ---|---|--- 2026-07-24 13:12:55+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrfgkps3ci24...

EUVD-2026-48435

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

PT-2026-64414

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.2 Description An information disclosure issue exists in the LCL/ZLIB video decoder. An attacker can expose uninitialized heap memory by providing a valid zlib stream that inflates to fewer bytes than the expected...

CVE-2026-15212

creationtimestamp| type| source ---|---|--- 2026-07-23 22:15:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrdufhx6ju23...

CVE-2026-49035

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution RCE has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled...

CVE-2026-49035 Stack-based Buffer Overflow in MZ Automation libIEC61850

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution RCE has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled...

CVE-2026-48536

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload ...

EUVD-2026-48295

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload ...

CVE-2026-48535 GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

CVE-2026-48535 GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

CVE-2026-48535

GFI Archiver Additional Settings page. Exploitation requires authenticated access; CVSS 4.0/3.1 base scores are 5.1 (medium) and 5.4 (medium) respectively. Remediation: upgrade to version 15.13 or later. If upgrading is not possible, apply the documented workaround as per vendor guidance.

EUVD-2026-48294

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

UBUNTU-CVE-2026-65912

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...

CVE-2026-60150

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j 2026-07-23 16:46:54+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-64875

Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass...

CVE-2026-64875 Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension

Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass...