4478 matches found
EUVD-2026-57427
When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connection. An on-path actor can intercept the dataplane...
EUVD-2026-57425
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...
Malicious code in @years20/n8n-nodes-utils-helper-j (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae821bd0afd5bdf483830eddac1c875d1ec3d229ca2078aa4fe7d88e9573eefb @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script index.js/callback.js that executes id and hostname on the installer host,...
CVE-2026-67287
Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input...
CVE-2026-68434
The CVE affects Linux kernel 8250_mid serial driver on Denverton (DNV), Ice Lake Xeon D (ICX-D) and Snowridge (SNR) platforms. Root cause: NULL function pointer dereference after changing setup/exit callbacks to PTR_IF(false, ...) without NULL checks in mid8250_probe() and mid8250_remove(), leadi...
PT-2026-71209
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection. An attacker on the network path between the operator and the control plane can intercept user or admin API...
CVE-2026-18703
Technical details about CVE-2026-18703 are not publicly available in the provided documents. Monitor for updates.
CVE-2026-68336
A flaw was found in the Linux kernel's bonding module. When a system is booted with IPv6 disabled, the bonding module incorrectly attempts to send IPv6 Network Service NS packets. This leads to a null pointer dereference, which is an attempt to access uninitialized memory. The consequence of this...
CVE-2026-48161
react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...
CVE-2026-72727
Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default...
CVE-2026-72727 Discourse: Stored XSS in the moderation review queue
Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default...
CVE-2026-68336
In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconfall NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the devconfall is never initialized because inet6init exits before addrconfinit is called which initializes it...
CVE-2026-68322
In the Linux kernel, the following vulnerability has been resolved: rds: Fix inet6addrlst NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, inet6addrlst is never initialized because inet6init exits before addrconfinit is called to initialize it. An attempt t...
AZL-95117 CVE-2026-68322 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: rds: Fix inet6addrlst NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, inet6addrlst is never initialized because inet6init exits before addrconfinit is called to initialize it. An attempt t...
CVE-2026-68286
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: perform u64stats updates under IRQ-disabled section In netdmpackettracekfreeskbhit and netdmhwtrappacketprobe, u64statsupdatebegin / u64statsinc / u64statsupdateend were called after...
DEBIAN-CVE-2026-68286
In the Linux kernel, the following vulnerability has been resolved: dropmonitor: perform u64stats updates under IRQ-disabled section In netdmpackettracekfreeskbhit and netdmhwtrappacketprobe, u64statsupdatebegin / u64statsinc / u64statsupdateend were called after...
CVE-2026-68322
In the Linux kernel, the following vulnerability has been resolved: rds: Fix inet6addrlst NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, inet6addrlst is never initialized because inet6init exits before addrconfinit is called to initialize it. An attempt t...
UBUNTU-CVE-2026-68322
In the Linux kernel, the following vulnerability has been resolved: rds: Fix inet6addrlst NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, inet6addrlst is never initialized because inet6init exits before addrconfinit is called to initialize it. An attempt t...
UBUNTU-CVE-2026-68336
In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconfall NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the devconfall is never initialized because inet6init exits before addrconfinit is called which initializes it...
CVE-2026-68336
In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconfall NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the devconfall is never initialized because inet6init exits before addrconfinit is called which initializes it...