222542 matches found
HPESBHF05108 rev.1 - HPE StoreEasy Server Using Certain Intel Processors, INTEL-SA-01436, Intel Trust Domain Extensions (Intel TDX) module Advisory, Multiple Vulnerabilities
Potential Security Impact: Local: Denial of Service DoS, Disclosure of Information, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE StoreEasy 1470 Performance - Prior to BIOS v3.0008-20-2026 HPE StoreEasy 1470 Storage - Prior to BIOS v3.0008-20-2026 HPE...
HPESBHF05120 rev.1 - HPE StoreEasy Servers Using Certain Intel Processors, INTEL-SA-01442, Intel Xeon Processor Firmware Advisory, Local Escalation of Privilege
Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE StoreEasy 1470 Performance - Prior to BIOS v3.0008-20-2026 HPE StoreEasy 1470 Storage - Prior to BIOS v3.0008-20-2026 HPE StoreEasy 1570 Performance - Prior to BIOS...
EUVD-2026-58507
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints...
[SECURITY] [DSA 6481-1] firefox-esr security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6481-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 02, 2026 https://www.debian.org/security/faq -...
CVE-2023-20576
Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation...
EUVD-2023-60616
Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation...
CVE-2023-20576
CVE-2023-20576 is a HIGH severity (CVSS 3.1: 7.7) vulnerability in AMD processor firmware caused by insufficient verification of data authenticity in AGESA (AMD Generic Encapsulated Software Architecture). A local unauthenticated attacker can update SPI ROM data , potentially leading to denial of...
CVE-2023-20576
Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation...
EUVD-2026-70263
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attacker...
CVE-2026-75134
The SEOWriting WordPress plugin (through version 1.12.5 ) contains a stored XSS vulnerability caused by an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Authenticated contributors can inject malicious JavaScript into post content, which exec...
CVE-2026-75134 SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attacker...
CVE-2026-77125
Sonatype Nexus Repository 3 contains an incorrect authorization flaw in two blobstore group management REST API endpoints . A user holding only the nexus:blobstores:create permission (which must be explicitly granted and is not default) could invoke these endpoints to convert an existing blobstor...
CVE-2026-84672
Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...
CVE-2026-78410
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...
AZL-99390 CVE-2026-78410 affecting package util-linux 2.40.2-5
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...
ALPINE-CVE-2026-78408
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...
CVE-2026-78408
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...
DEBIAN-CVE-2026-78410
A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...
CVE-2026-78409
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to opentree with ATSYMLINKNOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with...
DEBIAN-CVE-2026-78408
The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...