CVE-2026-13018

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. Chromium security severity: Low...

CVE-2026-98003

A flaw was found in the Linux kernel's AMD Input-Output Memory Management Unit IOMMU driver. When the system resumes from sleep, the driver reallocates internal logging buffers without releasing previously allocated memory and performs memory requests in an invalid context. A local user with powe...

CVE-2026-101132

A path traversal vulnerability exists in DeepSeek deepseek-harness (versions up to 0.1.7-rc.2 ). The flaw is located within the loadProfile function of the packages/boot/app-boot/src/profile.ts file in the Bundle Patch Handler component. Manipulation of the dsh.bundle.patch argument allows for pa...

EUVD-2026-88438

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation of the argument dsh.bundle.patch results in path traversal...

CVE-2026-101132 DeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversal

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation of the argument dsh.bundle.patch results in path traversal...

CVE-2026-98002

A flaw was found in the Linux kernel's AMD IOMMU Input-Output Memory Management Unit driver. This flaw allows a local user to cause a Denial of Service DoS or system instability during nested domain allocation. When domain identifiers or memory resources are exhausted, an allocation error value i...

CVE-2026-84894

In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carrie...

EUVD-2026-88433

In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carrie...

CVE-2026-101913

A flaw was found in ip-address. The library fails to validate the complete range of IPv6 link-local addresses during address classification checks. A remote attacker can provide a specially crafted IPv6 address to bypass security controls that rely on this verification. Successful exploitation ca...

CVE-2026-98001

A flaw was found in the Linux kernel's LTC4282 hardware monitoring driver. This vulnerability can lead to a Denial of Service DoS due to the use of uninitialized stack memory. The driver fails to initialize its clock data structure during setup, leaving member fields uninitialized. A local attack...

CVE-2026-101131 deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the file packages/e2b/e2b/src/index.ts of the component dsh. The manipulation of the argument E2BAPIKEY leads to reliance on untrusted inputs in a security decision. Local access is...

CVE-2026-54708

FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or writ...

CVE-2026-49994

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-101102

A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function runcode of the component Code Mode Sandbox. The manipulation results in sandbox issue. The attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes all explicitly state...

CVE-2026-101100

A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. Executing a manipulation can lead to incomplete cleanup. T...

CVE-2026-101099

A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. This affects an unknown part of the file SseParser.kt of the component Kotlin Community SDK. Performing a manipulation results in handling of exceptional conditions. The attack may be initiated remotely. The pull request to fi...

Time-of-check Time-of-use (TOCTOU) Race Condition

Apache Tomcat is vulnerable to Time-of-check Time-of-use TOCTOU Race Condition. The vulnerability is due to a race condition during the creation of Unix domain sockets, which allows an unauthorized local attacker to exploit the timing window and gain access to the Unix domain socket...

CVE-2026-101105 code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...

CVE-2026-101105

The Matrimonial System 1.0 (code-projects) is vulnerable to a remote SQL injection in the Profile Creation Endpoint . The flaw exists in the processprofile_form function within the /create_profile file, specifically caused by the improper handling of the fname argument. An attacker can exploit th...

EUVD-2026-88403

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofileform of the file /createprofile of the component Profile Creation Endpoint. This manipulation of the argument fname causes sql injection. The attack is possible to be carried...