10313 matches found
PT-2026-87071
An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential value...
PT-2026-86957
SAP S/4HANA Manage Bank Chains app does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not be accessible to them. This results in a low impact on...
Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0
Summary An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. Impact A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual...
UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot
Overview The UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections. When the UEFI Shell is included in SPI flash, an attacker with the ability to...
EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2026-3376)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...
PT-2026-87052
x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...
CVE-2026-86504
creationtimestamp| type| source ---|---|--- 2026-09-07 17:35:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dui3apemglix2 2026-09-07 18:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mux3mtjx4a2m 2026-09-08 11:06:12+00:00| seen|...
CVE-2026-86429
creationtimestamp| type| source ---|---|--- 2026-09-07 14:04:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muwogkzu462e 2026-09-12 19:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvdro5dz722r...
CVE-2026-86452
creationtimestamp| type| source ---|---|--- 2026-09-07 13:47:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ji3cndbjq65jp 2026-09-12 18:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvdoctjdhs24...
CVE-2026-86451
creationtimestamp| type| source ---|---|--- 2026-09-07 13:35:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ccxurbhumciz6...
K000163225: Node.js vulnerability CVE-2026-59874
Security Advisory Description node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This...
Improper Check for Certificate Revocation
Overview Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the knownhosts parser, where HostKey.name2type lacks OpenSSH certificate-type entries such as [email protected] in its static table, so a @revoked line authored with a...
Linux Distros Unpatched Vulnerability : CVE-2026-80903
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe/oa: Fix sync entry leak on OA config emit failure xeoaemitoaconfig releases the sync entries and the syncs array only on its success path. When it fails...
PT-2026-86922
Improper Handling of Alternate Encoding vulnerability in ash-project ash double entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, ...
MINI-66J5-JFC4-3C73
Bulletin has no description...
CVE-2026-86179
creationtimestamp| type| source ---|---|--- 2026-09-06 09:42:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3yxjys4sqd66e...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073356)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073356 advisory. In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore ...
MINI-8RCW-6W73-42WR
Bulletin has no description...