EUVD-2026-63896

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...

CVE-2026-74443

A flaw was found in the Linux kernel's drm/vmwgfx component. A local attacker could exploit a vulnerability in the vmwcmddma function, where an undersized header in a Direct Memory Access DMA command body causes a pointer to underflow. This allows the attacker to overwrite authenticated fields of...

CVE-2026-74567

A flaw was found in the Linux kernel's key management subsystem. An unprivileged local attacker could exploit an out-of-bounds read vulnerability in the keyringgetkeychunk function. By providing specially crafted keys, the attacker can cause the system to read beyond its intended memory boundarie...

CVE-2026-47827

CVE-2026-47827 is a command injection vulnerability in the BOSH CLI tool (Cloud Foundry) on Windows , allowing a remote attacker to execute arbitrary shell commands via PowerShell injection. All versions prior to v2.840.0 are affected. The vulnerability requires an adjacent network position and h...

CVE-2026-74465

A flaw was found in the Linux kernel's Open vSwitch OVS component. When a new meter is attached, the attachmeter function makes it visible to other central processing units CPUs before all checks are complete. If the attachment fails, the meter is freed without waiting for other CPUs to stop usin...

CVE-2026-74447

A flaw was found in the Linux kernel's drm/amdkfd component. An integer overflow vulnerability exists when aligning the End-of-Pipe EOP ring buffer size. A local attacker could exploit this by providing a specially crafted size that, due to a 32-bit integer overflow, causes the system to bypass...

CVE-2026-74484

A flaw was found in the Linux kernel's binfmtmisc component. A local attacker can exploit this vulnerability by registering an 'F' entry that points to its own instance or uses it as an overlayfs lower layer. This self-pinning prevents the associated file from being closed, leading to a resource...

CVE-2026-74479

A flaw was found in the Linux kernel's pktgen module. This vulnerability, a use-after-free, occurs due to a race condition when handling proc entries, which are kernel interfaces. A local attacker could exploit this timing issue to trigger a system crash, leading to a Denial of Service DoS...

CVE-2026-53791

A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources. Mitigation Restrict rsync daemon TCP/873 to the trusted proxy only CME-202...

CVE-2026-74566

A flaw was found in the Linux kernel's keys subsystem. An inconsistency in how key descriptions are processed by the keyringgetkeychunk and keyringdiffobjects functions could allow a local attacker to create specially crafted key descriptions. These crafted descriptions might collide, potentially...

EUVD-2026-63812

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-76158

Datiphy Data Management Center (v8.3.0 through v8.5.1) contains a path traversal vulnerability in its upload API endpoint. An unauthenticated remote attacker can supply relative or absolute path sequences to write files to arbitrary locations outside the intended upload directory, enabling arbitr...

CVE-2026-76158 Datiphy Data Management Center - External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

CVE-2026-76157

Datiphy Data Management Center v8.3.0 through v8.5.1 has an unauthenticated upload API endpoint allowing remote attackers to upload arbitrary files, scoring CVSS 8.8 (HIGH) for integrity and availability impact. No exploitation evidence or patch details are provided; monitor the advisory at https...

SUSE CVE-2026-76033

Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-76037

Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

SUSE CVE-2026-76038

Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-76041

Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-76043

Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-76045

Use after free in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...