CVE-2026-62940

Incus (a system container and virtual machine manager) prior to version 7.3.0 is vulnerable to a project restriction bypass during instance migration. When migrating an instance to another cluster member, user-supplied configuration overrides—including security-critical keys such as security.priv...

CVE-2026-62940 Incus has a project restriction bypass via instance migration config override

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides including security-critical keys like security.privileged and raw.lxc are applied without any project restriction enforcemen...

CVE-2026-75946

A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls...

EUVD-2026-63971

A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls...

CVE-2026-75946

A local privilege escalation vulnerability exists in HP OMEN Gaming Hub versions prior to 1101.2608.0.0 , caused by insufficient access controls . A local attacker with low privileges could exploit this to gain elevated access and potentially access confidential information. The CVSS 4.0 base sco...

CVE-2026-75946 OMEN Gaming Hub – Potential Escalation of Privilege & Information Disclosure

A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls...

CVE-2026-59318

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...

kbd security update

An update is available for kbd. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kbd packages provide tools for managing console behavior on a Linux system,...

mrtg security update

An update is available for mrtg. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Multi Router Traffic Grapher MRTG monitors the traffic load on network...

EUVD-2026-63933

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...

CVE-2026-59318 DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege...

CVE-2026-59318

Spring AI's tool calling support contains a boundary enforcement flaw: the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked,...

CVE-2026-14208

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...

CVE-2026-14208 Local Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...

EUVD-2026-63896

Remote Utilities Host =7.7.3.0 sets insecure ACLs on all DLL files in the installation directory C:\Program Files x86\Remote Utilities - Host, granting FULL CONTROL F to the built-in Everyone group BUILTIN\Everyone, S-1-1-0. A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this...

CVE-2026-14208

Remote Utilities Host versions up to 7.7.3.0 contain a local privilege escalation vulnerability caused by insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities - Host\). The BUILTIN\Everyone group is granted FULL CONTROL , allowing any local unprivi...

CVE-2026-74443

A flaw was found in the Linux kernel's drm/vmwgfx component. A local attacker could exploit a vulnerability in the vmwcmddma function, where an undersized header in a Direct Memory Access DMA command body causes a pointer to underflow. This allows the attacker to overwrite authenticated fields of...

CVE-2026-59799

Apache CloudStack contains an Improper Privilege Management vulnerability in its Two-factor authentication plugin . The root cause is a missing privilege check in the two-factor authentication disable flow, which allows an attacker to bypass the 2FA disable flow . Affected versions: 4.18.0.0 thro...

CVE-2026-61400

Apache CloudStack is affected by a command injection vulnerability in the getDiagnosticsData and runDiagnostics APIs used for system VM and Virtual Router diagnostics. An authenticated user with Admin role permissions can achieve arbitrary command execution as root on the affected instances, resu...

CVE-2026-74533

A flaw was found in the Bluetooth ISO subsystem of the Linux kernel. This vulnerability is caused by a race condition where certain data is accessed and modified without proper synchronization, leading to a use-after-free UAF error. An attacker could potentially exploit this to execute arbitrary...