65973 matches found
PT-2026-72241
In the Linux kernel, the following vulnerability has been resolved: net: ip6 gre: require CAP NET ADMIN in the device netns for changelink ip6gre changelink and ip6erspan changelink operate on at most two netns, dev netdev and the tunnel link netns t-net. They differ once the device is created in...
PT-2026-72450
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytes ext put/get The ipc control data buffer is allocated as kzallocmax size, where max size covers the entire struct sof ipc ctrl data including its flexible array payload. However,...
PT-2026-72845
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: add bounds check on firmware mac id in link lookup The mac id field in RX descriptors is 8 bits wide 0-255, but assoc link on macid has only RTW89 MAX MAC ID NUM 128 entries. While the driver currently assigns mac id...
PT-2026-72489
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes put and bytes get In sof ipc3 bytes put, the size used for the memcpy is derived from the old data-size already in the buffer, not the incoming new data's size field. If the new data h...
PT-2026-72844
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath tx edma tasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9K NUM TX QUEUES 10 entries. A qid = 10 causes a...
PT-2026-72777
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal buf without validating the response length. A response exceeding...
PT-2026-72692
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf msg pop data bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l ||...
PT-2026-72540
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hid bpf get data range check hid bpf get data returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx-allocated size. The current check adds rdwr buf size and offset...
Linux Distros Unpatched Vulnerability : CVE-2026-72210
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress,...
EUVD-2026-58755
A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to t...
CVE-2026-19188
CVE-2026-19188 affects the Haiwell IoT Cloud HMI Gateway. The vulnerability is an OS command injection in the Net Check feature accessed via the /setting endpoint, where the cmdPing Socket.io event does not properly sanitize user input, allowing an attacker to inject and execute arbitrary OS comm...
CVE-2026-49282
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...
UBUNTU-CVE-2026-49282
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...
CVE-2026-12364
The CVE-2026-12364 issue affects the Zephyr kernel’s user-space syscall verifier z_vrfy_z_log_msg_static_create(). The verifier failed to enforce K_SYSCALL_* checks when forwarding source, desc, package, and data to z_impl_z_log_msg_static_create(), allowing an attacker-controlled user-space thre...
CVE-2026-49282
Capstone (disassembly framework) vulnerability CVE-2026-49282 affects builds prior to 6.0.0-Alpha9: the cs_insn_name() API forwards caller-provided instruction IDs to architecture backends, with M68K and RISCV backends lacking sufficient bounds checks. A caller-controlled invalid instruction ID o...
CVE-2026-49282
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...
CVE-2026-53970 ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb
ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...
EUVD-2026-58684
ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...
CVE-2026-72825
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint ReportsController. The endpoint enforces requirePermission'api.config.write' followed by a bare isSuperAdmin check instead of requireSuper. Because isSuperAdm...
