CVE-2026-68117

A flaw was found in the Linux kernel's TIPC Transparent Inter-Process Communication protocol. A local attacker could exploit this vulnerability by repeatedly creating and failing to insert new sockets, causing the tipcskcreate function to leave a dangling pointer to a freed socket object. This...

CVE-2026-68187

A flaw was found in the Linux kernel's exec subsystem, specifically within the transferargstostack function. A local user could provide a specially crafted argument or environment string during process creation, causing an unsigned loop counter to wrap. This leads to an out-of-bounds read and...

CVE-2026-68418

A flaw was found in the RDMA/irdma component of the Linux kernel. A local user could exploit this vulnerability by providing a zero value for userwqebufs during the creation of a Queue Pair QP. This action leads to a null pointer dereference, which can cause the system to crash, resulting in a...

CVE-2026-68244

A flaw was found in the Linux kernel. Specifically, within the drm/i915/gem module, a memory leak occurs during context creation. This happens when an error occurs while processing user extensions after a successful BALANCE/PARALLELSUBMIT extension. An attacker could potentially exploit this to...

CVE-2026-48495

CVE-2026-48495 affects TypeBot prior to v3.17.0: the Google Sheets OAuth callback decodes a base64-encoded JSON state and trusts embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity or authorization checks. Although the callback route is authenticated, it does...

CVE-2026-72605

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605 Swing Music Swing Music - Missing Authentication

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605 Swing Music Swing Music - Missing Authentication

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

EUVD-2026-56044

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605

The CVE-2026-72605 entry concerns Swing Music 3.0.0 with a missing authentication flaw: the POST /auth/profile/create endpoint is allowlisted from JWT verification, enabling unauthenticated remote attackers to create arbitrary user accounts. This can lead to attackers registering accounts and gai...

CVE-2026-71217

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-71217

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

EUVD-2025-210674

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings...

CVE-2026-72907 ERPNext: Broken Access Control on certain endpoint

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...

CVE-2026-68294

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtrlocalnid is a single global node id...

CVE-2026-68244

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Do not leak siblings on proto context error After a successful BALANCE/PARALLELSUBMIT extension on context creation, error during processing of next user extension leaks the siblings array. Fix that. Discovered usin...

CVE-2026-68417 RDMA/siw: publish QP after initialization

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siwcreateqp currently calls siwqpadd before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being...

CVE-2026-68298

CVE-2026-68298 affects the Linux kernel DRM XE VM subsystem. The description documents a leak in drm/xe/vm where an error path in xe_vm_create() could leave vm->svm.gpusvm partially initialized, leaking resources from drm_gpusvm_init() for non-fault-mode VMs, and leaking pagemap owner/pagemaps...

CVE-2026-68294 net: qrtr: restrict socket creation to the initial network namespace

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtrlocalnid is a single global node id...