398207 matches found
EUVD-2026-98924
The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...
CVE-2026-19939
The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...
Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities
Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2024-53161 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM...
SUSE CVE-2026-105274
Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...
CVE-2026-54454 OpenCATS: Authenticated RCE in the Import module
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessib...
CVE-2026-54454
The OpenCATS applicant tracking system is vulnerable to Authenticated Remote Code Execution (RCE) in the Import module (specifically modules/import/ImportUI.php) prior to version 0.10.0 . The root cause is that the module can preserve an uploaded file's original name and place it in a web-accessi...
CVE-2026-54454 OpenCATS: Authenticated RCE in the Import module
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessib...
cohort4-security-review
Cohort 4 — Báo cáo rà soát bảo mật bản công khai, đã redact...
DEBIAN-CVE-2026-79607
During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data...
UBUNTU-CVE-2026-103965
An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return...
CVE-2026-79607
During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data...
CVE-2026-96297
Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory ca...
Hyyan WooCommerce Polylang Integration SQL Injection Vulnerability
Hyyan WooCommerce Polylang Integration 1.5.0 and earlier versions have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the variationid parameter in the woocommerceremovevariations AJAX operation, as well as inadequate preparation of existing SQL queries. This...
LatePoint – Calendar Booking Plugin for Appointments and Events: Authorization Issues Vulnerability
LatePoint – a calendar booking plugin for appointments and events. Versions 5.7.2 and earlier have an authorization issue vulnerability. This vulnerability arises from calling the OsCustomerHelper::createwpuserforcustomer helper function from the publicly exposed processstepcustomer step. When th...
WordPress Post Export Import with Media: Deserialization Injection Vulnerability
WordPress Post Export Import with Media has a deserialization injection vulnerability in versions 1.17.1 and earlier. This vulnerability stems from the deserialization processing of untrusted inputs, leading to PHP object injection. Certified attackers with administrator or higher privileges may ...
Red Hat Enterprise Linux information leakage vulnerability
Red Hat Enterprise Linux has a vulnerability related to information leakage. This vulnerability stems from the fact that the file:// URI in the calendar events of evolution-data-server evolution-data-server automatically reads target local files. The content of these files is encoded in base64 an...
CVE-2026-79607
In Xen 4.22 , a vulnerability exists in Xenstore during a live update where the state record for a watch with a specified depth is written with two missing bytes. This oversight creates an inconsistent state upon reading the data in the new Xenstore, which can lead to wrong Xenstore data or a cra...
CVE-2026-79607 Xenstore: Guests can crash xenstored during Live Update
During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data...
EUVD-2026-98823
During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data...
CVE-2026-79607
During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an inconsistent state when reading the state back in the new Xenstore, causing a crash of Xenstore or wrong Xenstore data...