openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following

A flaw was found in openCryptoki, a PKCS11 library and tooling for Linux and AIX. A token-group user can exploit a symlink-following vulnerability by planting symbolic links in group-writable token directories. When an administrator runs a PKCS11 application or administrative tool as root, it may...

CVE-2026-1206 Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the isallowedtoreadtemplate function permission check that treats non-published templates as...

CVE-2026-1206

The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the isallowedtoreadtemplate function permission check that treats non-published templates as...

PT-2026-28299

Name of the Vulnerable Software and Affected Versions HCL Aftermarket DPC affected versions not specified Description The software is subject to a Cross-Origin Resource Sharing issue. Improper CORS configurations can lead to the exposure of sensitive user information to attackers, unauthorized...

Ech0 安全漏洞

Ech0 is a self-hosted personal microblogging platform developed by L1nSn0w. Versions of Ech0 prior to 4.2.0 contained security vulnerabilities. These vulnerabilities stemmed from the GET /api/allusers endpoint, which returned user records without verification, potentially allowing unauthorized...

The vulnerability of the __openmetadata() function in the drivers/md/dm-thin-metadata.c file of the multi-device driver for Linux operating systems, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the openmetadata function in the drivers/md/dm-thin-metadata.c file of the multi-device driver for Linux operating systems is related to the execution of a loop with an unreachable exit condition “Infinite loop”. Exploiting this vulnerability could allow an attacker to...

RHEL 10 : opencryptoki (RHSA-2026:5917)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:5917 advisory. The opencryptoki packages contain version 2.11 of the PKCS11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These...

RHEL 9 : opencryptoki (RHSA-2026:5919)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:5919 advisory. The opencryptoki packages contain version 2.11 of the PKCS11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These...

The vulnerabilities of the functions __mptcp_close_ssk() and mptcp_worker() in the net/mptcp/protocol.c module of the Linux kernel allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the mptcpclosessk and mptcpworker functions in the net/mptcp/protocol.c module of the Linux kernel is related to improper initialization. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

AlmaLinux 8 : opencryptoki (ALSA-2026:5587)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:5587 advisory. openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following CVE-2026-23893 Tenable has extracted the preceding description block direct...

The vulnerability of the m_can_read_fifo() function in the drivers/net/can/m_can/m_can.c file of the Linux kernel’s CAN device support driver allows a hacker to cause a service failure.

The vulnerability of the mcanreadfifo function in the drivers/net/can/mcan/mcan.c file of the Linux kernel’s CAN device support driver exposes confidential information. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the igc_setup_rx_resources() function in the drivers/net/ethernet/intel/igc/igc_main.c file of the Linux kernel’s Ethernet adapter support driver allows a hacker to cause a service failure.

The vulnerability of the igcsetuprxresources function in the drivers/net/ethernet/intel/igc/igcmain.c file of the Intel Ethernet network adapter support driver in the Linux operating system exposes confidential information. Exploiting this vulnerability could allow an attacker to cause a service...

The vulnerability of the `nvme_tcp_get_address()` function in the `drivers/nvme/host/tcp.c` file of the Linux operating system’s NVME driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nvmetcpgetaddress function in the drivers/nvme/host/tcp.c file of the Linux operating system’s NVME driver relates to the assignment of pointers. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

The vulnerability of the `register_synth_event()` function in the kernel/trace/trace_events_synth.c module, which supports Linux kernel tracing, allows a malicious actor to access protected information or cause system failures.

The vulnerability of the registersynthevent function in the kernel/trace/traceeventssynth.c module, which supports kernel tracing in Linux operating systems, relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to access...

InvenTree 安全漏洞

InvenTree is an open-source inventory management system developed by InvenTree. It provides robust low-level inventory control and parts tracking capabilities. Versions of InvenTree prior to 1.2.6 contained security vulnerabilities. These vulnerabilities stemmed from the batch operation API...

The vulnerability of the readreply() function in the drivers/infiniband/sw/rxe/rxe_resp.c file of the InfiniBand driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the readreply function in the drivers/infiniband/sw/rxe/rxeresp.c file of the InfiniBand driver for the Linux operating system exposes confidential information. Exploiting this vulnerability could allow a perpetrator to cause a service failure...

AlmaLinux 9 : opencryptoki (ALSA-2026:5603)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:5603 advisory. openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following CVE-2026-23893 Tenable has extracted the preceding description block direct...

The vulnerabilities of the functions rsm_load_state_32() and rsm_load_state_64() in the arch/x86/kvm/emulate.c module of the virtualization subsystem on the x86 kernel of the Linux operating system allow an attacker to gain access to protected information or cause service failures.

The vulnerability of the rsmloadstate32 and rsmloadstate64 functions in the arch/x86/kvm/emulate.c module of the virtualization subsystem on the Linux x86 kernel platform is related to access to memory beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to gain acce...

The vulnerability of the queue_oob() function in the net/unix/af_unix.c module of the Linux operating system allows a hacker to gain access to protected information or cause service failures.

The vulnerability of the queueoob function in the net/unix/afunix.c module of the Linux operating system’s kernel is related to improper memory release. Exploiting this vulnerability may allow an attacker to access protected information or cause service failures...

The vulnerability of the tcindex_set_parms() function in the net/sched/cls_tcindex.c module of the network/sched subsystem of the Linux operating system allows a attacker to access protected information or cause service failures.

The vulnerability of the tcindexsetparms function in the net/sched/clstcindex.c module of the network scheduling subsystem in the Linux operating system relates to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability could allow an attacker to access...