CVE-2026-67217

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67217

cJSON up to 1.7.19 has a non-atomic JSON Patch handler in cJSON_Utils.c (apply_patch) that detaches/deletes the target member for a replace without a value or an unresolved move before full validation. This allows an attacker-supplied patch to mutate the target document even when the patch report...

CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

CVE-2026-67217 cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

EUVD-2026-50329

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operatio...

EUVD-2026-50310

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

CVE-2026-33385

Quick.CMS 6.8 is affected by a Blind SQL injection in the administration panel, resulting from improper neutralization of input fields accessed by a high-privileged user. The vulnerability can bypass front-end validation controls and potentially lead to database destruction. The CVSS-derived metr...

CVE-2026-64423

A flaw was found in the Linux kernel's Internet Group Management Protocol IGMP multicast group handling. When a network device is destroyed, its associated multicast groups are not properly removed from the device's hash table before their memory is reclaimed. This creates a race condition where ...

Linux Distros Unpatched Vulnerability : CVE-2026-62429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration informati...

Linux Distros Unpatched Vulnerability : CVE-2026-67217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in applypatch in cJSONUtils.c. For a replace operation that is missing its value...

CVE-2026-62429

A flaw was found in Xen. A race condition exists where a guest's virtual Non-Uniform Memory Access vNUMA configuration data can be accessed by a device model even after the guest's domain destruction has started. This occurs because the cleanup of the vNUMA configuration is not synchronized with...

CVE-2026-62429

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest...

ALPINE-CVE-2026-62429

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest...

CVE-2026-62429

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest...

CVE-2026-62429 vNUMA domain cleanup may race other operations

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest...

EUVD-2026-49782

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest...

CVE-2026-62429

The CVE-2026-62429 vulnerability concerns Xen hypervisor: vNUMA domain cleanup can race with other operations, exposing a race between destroying a guest domain and retrieving its vNUMA configuration.What’s affected: Xen versions 4.5+ (4.4 and earlier not affected) for guests using vNUMA with dev...

CVE-2026-62429 vNUMA domain cleanup may race other operations

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest...

CVE-2026-62429

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest...