EUVD-2026-46357

An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution...

CVE-2026-59142

CVE-2026-59142 affects Data::HashMap::Shared for Perl versions before 0.14. The issue is an out-of-bounds read caused by unvalidated arena offsets/lengths in shm_str_copy, where memcpy(dst, arena + off, len) uses values sourced from the mmap’d segment. Although the attach-time validator shm_valid...

CVE-2026-63454 Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in AOS-CX

An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution...

CVE-2026-63454

CVE-2026-63454 describes an authenticated path traversal in the AOS-CX platform. The vulnerability enables copying arbitrary files to a user-readable location via the device’s command line interface, with the potential for remote code execution. Affected component: AOS-CX OS; root cause: path tra...

CVE-2026-46681 @nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty

@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys proto,...

CVE-2026-16378

Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

SUSE CVE-2026-63892

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject dirlen length u16 widened to sizet. Two distinct OOB conditions follow when entry-length uuid, ... which always reads 4 dwords from diroffset. tbpropertyentryvalid only enforces diroffset +...

SUSE CVE-2026-63895

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: copy only received bytes on short ep0 read ffsep0read allocates its control-OUT data buffer with kmalloc not kzalloc at the Length value from the Setup packet, then copies that full len to userspace regardless o...

SUSE CVE-2026-64015

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assocarrayfind in findkeytoupdate without holding the RCU read lock, while the assocarraygc code really is designed around...

SUSE CVE-2026-64026

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice by getting rid ...

SUSE CVE-2026-64075

In the Linux kernel, the following vulnerability has been resolved: fprobe: Fix unregisterfprobe to wait for RCU grace period Commit 4346ba1604093 "fprobe: Rewrite fprobe on function-graph tracer" changed fprobe to register struct fprobe to an rcu-hlist, but it forgot to wait for RCU GP. Thus the...

SUSE CVE-2026-64102

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen, 16 bit big-endian, peer-controlled is smaller than the fixed DDP/RDMA...

CVE-2026-16378

Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16378

CVE-2026-16378 concerns a DOM-related issue in Firefox’s Copy & Paste and Drag & Drop component. The vulnerability is fixed in Firefox 153. CVSSv3.1 metrics indicate high impact with network attack vector, low complexity, no privileges, and no user interaction required, but the document does not ...

CVE-2026-16378

Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

EUVD-2026-46214

Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153...

CVE-2026-16378 Other issue in the DOM: Copy & Paste and Drag & Drop component

Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16378 Other issue in the DOM: Copy & Paste and Drag & Drop component

Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16378

Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-55874

A flaw was found in SeaweedFS, a distributed storage system. The S3 API gateway in SeaweedFS does not properly validate X-Amz-Copy-Source headers, specifically failing to reject "dot-dot" path segments. This allows an authenticated user, even if scoped to a single bucket, to read objects from oth...