CVE-2026-76724 Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a...

EUVD-2026-89343

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a...

CVE-2026-76722 Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code...

EUVD-2026-89340

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the...

CVE-2026-12345

A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link a reference pointing to another location. This can lead to unauthorized deletion or alteration of files outside the...

CVE-2026-97918

A flaw was found in the Linux kernel's tracing subsystem. When enabling a histogram event trigger fails, improper registration cleanup can leave an already freed trigger referenced on an internal tracking list. A local attacker with permission to configure event tracing could exploit this flaw to...

CVE-2026-76835

A flaw was found in oauth2-proxy. When configured in reverse-proxy mode without explicit trusted proxy settings, the application defaults to treating all incoming network traffic as originating from trusted proxies. A remote, unauthenticated attacker can exploit this issue by sending a request wi...

CVE-2026-95275

An incorrect reference resolution flaw was found in the MediaStream component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/542926849...

CVE-2026-97915

A flaw was found in the Linux kernel's Intel Versatile Processing Unit accel/ivpu driver. The driver fails to verify that firmware-supplied log names are null-terminated before printing them. This issue causes an out-of-bounds memory read that can leak adjacent data from shared memory buffers int...

CVE-2026-97913

A flaw was found in the Linux kernel's Arm Ethos-U accelerator driver. This vulnerability can lead to a Denial of Service DoS through device timeouts or potential out-of-bounds memory access. A local user could exploit this issue by submitting a crafted command stream that lacks a required...

CVE-2026-95375

An incorrect authorization flaw was found in the BrowserTag component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/502179319...

CVE-2026-95361

A confused deputy flaw was found in the DevTools component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/533095855...

CVE-2026-95312

An information leak flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/547832510...

CVE-2026-102616

A SQL injection vulnerability exists in risesoft-y9 WorkFlow-Engine up to version 9.6.10 . The flaw is located within the getByIdAndYear function of the CustomHistoricProcessServiceImpl.java file in the OAuth2 Resource Filter component. By manipulating the year/processInstanceId arguments, an att...

CVE-2026-102825

The Russh Rust SSH client and server library versions prior to 0.62.6 are vulnerable to a logic error in the USERAUTH_REQUEST runtime path (specifically within russh/src/server/encrypted.rs). The library increments the authentication attempt counter but fails to compare it against the server::Con...

CVE-2026-102823

Russh is a Rust SSH client and server library. Prior to 0.63.1, clientreadauthenticated in russh/src/client/encrypted.rs forwards CHANNELDATA, CHANNELEXTENDEDDATA, CHANNELEOF, CHANNELCLOSE, CHANNELOPENFAILURE, CHANNELSUCCESS, CHANNELFAILURE, and CHANNELREQUEST subtypes exit-status, exit-signal, a...

USN-8847-1 openssl vulnerabilities

It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point names. An attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial of service. CVE-2026-35189 It was discovered that OpenSSL incorrectly...

USN-8847-1: OpenSSL vulnerabilities

It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point names. An attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial of service. CVE-2026-35189 It was discovered that OpenSSL incorrectly...

CVE-2026-95360

Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-95360

Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...