CVE-2026-80562

CVE-2026-80562 affects the Linux kernel 's gpio: ml-ioh driver. The driver's ioh_irq_type(), ioh_irq_enable(), and ioh_irq_disable() callbacks acquire chip->spinlock via spin_lock_irqsave(), but they are invoked while the caller already holds desc->lock (a raw_spinlock_t) with hardirqs disa...

CVE-2026-74750 ovpn: defer key slot crypto freeing to workqueue

In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto freeing to workqueue Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all crypto implementations: cryptofreeaead...

CVE-2026-18252 Inclusion of Functionality from Untrusted Control Sphere in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude...

CVE-2026-18252

GitLab EE (versions 18.9 through 19.3) is affected by a vulnerability where the Claude agent processes configuration from a user-controlled source, allowing an authenticated user with developer-role permissions to execute arbitrary commands in a CI context. The root cause is the inclusion of func...

CVE-2026-18252 Inclusion of Functionality from Untrusted Control Sphere in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude...

CVE-2026-18252 Inclusion of Functionality from Untrusted Control Sphere in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude...

CVE-2026-54467

Trusted Firmware-M (TF-M) versions 2 through 2.3.0 (before commit 00d1b3e) contain a vulnerability in the mailbox initialization routine on PSOC64 and RP2350 platforms. The root cause is acceptance of a non-secure, unvalidated pointer supplied during initialization, which could allow compromise o...

CVE-2026-18252: Inclusion of Functionality from Untrusted Control Sphere

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude...

PT-2026-82098

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.9 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An authenticated user with developer-role permissions can execute arbitrary commands within a CI context. This...

PT-2026-82178

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ml-ioh GPIO driver where the register lock uses spinlock t instead of raw spinlock t. The ioh irq type function, acting as the irq chip .irq set type callback, is...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: thrift (UTSA-2026-032285)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032285 advisory. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 excluding 2.12.3 and 2.3.1 did not protect from uncontrolled recursion from self-referential lookups. This allows an...

CVE-2026-43670

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy...

EUVD-2026-42720

@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key...

EUVD-2026-65617

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

vulnseeker

🔍 VulnSeeker Smart CVE search with exploitability context a...

CVE-2026-79785

X-AnyLabeling's model downloader disabled TLS certificate verification. downloadwithretry in anylabeling/services/autolabeling/model.py built a context with ssl.createunverifiedcontext and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any...

CVE-2026-79785 X-AnyLabeling before 4.0.0-beta.9 Improper Certificate Validation in Model Downloads

X-AnyLabeling's model downloader disabled TLS certificate verification. downloadwithretry in anylabeling/services/autolabeling/model.py built a context with ssl.createunverifiedcontext and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any...

CVE-2025-71406

...

Grok fooled into stealing user chat, location data, and more

A new type of prompt injection attack shows why giving AI assistants access to browsers, code tools, and private data deserves extra caution. AI researchers describe "Cryptographic Context Injection"—an attack that hides malicious instructions inside encrypted data. The AI is then persuaded to...

K000163073: curl vulnerability CVE-2026-8925

Security Advisory Description The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free the same pointer twice. CVE-2026-8925 Impact There is no impact; F5 products are not affected by this...