CVE-2025-59172

Ericsson Packet Core Controller PCC versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root...

CVE-2026-12991

CVE-2026-12991 affects Ghost Robotics Vision 60 with APK v5.5.0. Root cause: lack of cryptographic integrity/authentication for communications. An attacker on the local network can use ARP spoofing and selective traffic blocking to intercept and modify packets between the operator and the robot, ...

CVE-2026-64331

A flaw was found in the Linux kernel's usbip virtual USB device controller vudc. This vulnerability, a NULL pointer dereference, occurs when vepallocrequest fails to initialize a vrequest's udc field, causing asynchronous input/output AIO cancellations on the FunctionFS path to arrive without a...

CVE-2026-51565

Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2025-39721)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505738; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

PT-2026-64897

The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot APK v5.5.0 exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and selective traffic blocking techniques to...

CVE-2026-51565

Summary (CVE-2026-51565): Cross-site scripting (XSS) in Milk admin

PT-2026-65313

Name of the Vulnerable Software and Affected Versions Milk admin versions prior to 0.9.9 Description Cross-site scripting XSS occurs in the Modules/Docs/DocsController.php file. This issue allows remote attackers to inject arbitrary HTML or web scripts through the action parameter in a specially...

Siemens SIMATIC S7-1500 CPU 1518 MFP Integer Overflow or Wraparound (CVE-2026-31417)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505595; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2025-71162)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505785; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

usb: gadget: udc: Fix use-after-free in gadget_match_driver

...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: kwok, cluster-api-aws-controller, vcluster, crossplane, tekton-chains, flux-helm-controller, apisix-ingress-controller, kubernetes-csi-external-resizer, cass-operator, cloud-provider-vsphere, spicedb, datadog-operator, rancher-system-agent, azure-service-operator,...

SUSE CVE-2026-64346

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

SUSE CVE-2026-64349

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3readl and dwc3writel calls in dwc3ulpisetup The dwc3ulpisetup calls the register read and write calls with dwc3-regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the...

SUSE CVE-2026-64420

In the Linux kernel, the following vulnerability has been resolved: mfd: crosec: Delay devsetdrvdata until probe success If ecdeviceprobe fails, crosecclassrelease releases memory for the crosecdev structure. However, because the drvdata was already set, sub-drivers like crosectypec can still...

SUSE CVE-2026-64428

In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use rawspinlockt in the irq startup path schirqunmask enables the GPIO IRQ and then updates the controller state through schirqmaskunmask, which takes sch-lock with spinlockirqsave. The callback can be reached from...

CVE-2026-64465

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhcifreestreams When a USB device with active stream endpoints is disconnected, xhcifreestreams is called from the hubevent workqueue to free the stream resources. It calls...

CVE-2026-64408

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its HCI device to registernetdev. Controller teardown can clear and relea...

CVE-2026-64272

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

CVE-2026-64471

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This...