25981 matches found
CVE-2026-72396
In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to reading uninitialized stack memory. Quotin...
UBUNTU-CVE-2026-74415
In the Linux kernel, the following vulnerability has been resolved: spi: atcspi200: fix use-after-free when driver unbind DMA resource is initialized after SPI controller registration. So when driver unbind, this can trigger a use-after-free when DMA is torn down while the controller is still ali...
EUVD-2026-59447
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes...
CVE-2026-72121 can: bcm: add locking when updating filter and timer values
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when updating timer and filter content while bcmrxhandler, bcmrxtimeouthandler...
GHSA-XC2P-8GGW-6CR5 vulnerabilities
Vulnerabilities for packages: langfuse-fips, crossplane-provider-azure-spring, spiffe-helper, go-fips, whereabouts-fips, tflint-fips, azure-metrics-exporter, falcosidekick-fips, apache-beam-python-3.14-sdk, crossplane-provider-aws-sesv2-fips, grafana-pyroscope,...
PT-2026-72736
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth HCI subsystem where the hci read codec capabilities function fails to properly validate the length of codec capability elements. When processing a sequen...
CVE-2026-19871
CVE-2026-19871 affects Roskus Prospero Flow CRM prior to version 5.15.9. The root cause is use of hard-coded credentials where the employee save controller falls back to the literal password “changeme” and the onboarding form lacks a password field, enabling unauthenticated remote attackers who k...
CVE-2026-72828
Grav Plugin API getgrav/grav-plugin-api before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin check rather than a scope-aware permission check, so a least-privilege API key scoped to api.users.write...
CVE-2026-72828
Grav Plugin API before 1.0.13 (grav-plugin-api) is affected by CVE-2026-72828: InvitationsController fails to enforce API-key scope caps. strip-super and accept-groups checks rely on isSuperAdmin() instead of scope-aware permissions, allowing a least-privilege API key scoped to api.users.write (i...
EUVD-2026-58638
The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...
CVE-2026-72823
The Grav API plugin (getgrav/grav-plugin-api) prior to 1.0.13 is impacted. Its DemoController contains a private requireSuper() check for isSuperAdmin() that returns early and skips requirePermission(), bypassing the api_key_scopes enforcement. Consequently, a scoped API key minted on a super acc...
CVE-2026-72823 Grav before 1.0.13 API-key scope cap bypass via DemoController
The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...
Incorrect Authorization
org.springframework.graphql:spring-graphql is vulnerable to Improper Authorization. The vulnerability is due to incorrect resolution of security annotations on @Controller data fetcher methods within type hierarchies, which allows an attacker to bypass authorization checks when security annotatio...
GO-2023-1839 vulnerabilities
Vulnerabilities for packages: policy-controller, kind, kubeflow-katib...
GO-2023-1840 vulnerabilities
Vulnerabilities for packages: policy-controller, kind, kubeflow-katib...
GO-2023-1841 vulnerabilities
Vulnerabilities for packages: policy-controller, kind, kubeflow-katib...
GO-2023-1842 vulnerabilities
Vulnerabilities for packages: policy-controller, kind, kubeflow-katib...
GO-2024-2428 vulnerabilities
Vulnerabilities for packages: ingress-nginx-controller, ingress-nginx-controller-fips...