CVE-2026-64595

HID: hid-lenovo-go suffered a race where a 2 ms delayed work (cfg_setup) could run after hid_destroy_device() releases hdev. The fix mirrors hid-lenovo-go-s.c by calling cancel_delayed_work_sync() and draining go_cfg_setup at hid_go_cfg_remove(), with cancellation occurring before acquiring cfg_m...

CVE-2026-64595

In the Linux kernel, the following vulnerability has been resolved: H...

EUVD-2026-53358

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the webadminpasswordenabled parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. A one-click...

CVE-2024-51314

Summary: CVE-2024-51314 affects the Tenda TX9 firmware (V22.03.02.20) due to a stack overflow in the function setMacFilterCfg (sub_424CE0). What is affected: Tenda TX9 router firmware, specific to /goform/setMacFilterCfg, sub_424CE0. Root cause: Stack overflow in the cited function; details point...

CVE-2026-63908 Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

In the Linux kernel, the following vulnerability has been resolved: Input: atmelmxtts - fix boundary check in mxtpreparecfgmem When a configuration file provides an object size that is larger than the driver's known mxtobjsizeobject, the driver intends to discard the extra bytes. The loop iterate...

UBUNTU-CVE-2026-53278

In the Linux kernel, the following vulnerability has been resolved: armmpam: Check whether the config array is allocated before destroying it destroycomponentcfg is called to free the configuration array. It uses the embedded 'garbage' structure, which means the array has to be allocated. If...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix VF illegal register access The register WXCFGPORTST is a PF restricted register. When initializing a VF, attempting to read this register triggers an illegal register access, which can cause the system to hang. Wh...

GPAC MP4Box 代码问题漏洞

GPAC MP4Box is a open-source multimedia packager from GPAC. It is primarily used for processing ISOBMF files such as MP4 and 3GP, but it can also be used for importing/exporting media from container files like AVI, MPG, MKV, and MPEG-2 TS. Version 2.4 of GPAC MP4Box has a code vulnerability cause...

CVE-2026-7125

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge leads to os command injection. The attack may be initiated remotely. T...

CVE-2026-9476

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be...

CVE-2026-46144

The CVE-2026-46144 entry concerns the Linux kernel RDMA mana driver. A resource leak occurs during error unwind in mana_ib_create_qp_rss(), where mana_ib_cfg_vport_steering() is not properly cleaned up; this could cause resource exhaustion (DoS). The issue has been fixed in the kernel (patched), ...

GHSA-XQ3R-2QV5-VQQM XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash

Impact It's possible to get access and read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false. This can apparently be reproduced on Tomcat instances. Patches This has been patched in 18.0.0-rc-1, 17.10.3, 17.4.9,...

EUVD-2026-31678

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument enabled leads to os command injection. The attack may be performed fr...

CVE-2026-9404

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. This affects the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument provider leads to os command injection. The attack may be launched remotely. Th...

CVE-2026-23734

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg=false, leading to Path Traversal. The vulnerability i...

CVE-2026-23734

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The...

CVE-2026-23734 XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The...

EUVD-2026-31152

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: aoe: fixed the potential use-after-free issue in aoecmdcfgpkts. This patch addresses CVE-2023-6270. The description of the vulnerability is as follows: A flaw was discovered in the ATA over Ethernet AoE driver within the Linux...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move the cfglogverbose check before calling lpfcdmpdbg In an attempt to log message 0126 using LOGTRACEEVENT, the following hard lockup occurred, causing the system to hang. Call Trace: rawspinlockirqsave+0x32/0x40...