CVE-2026-49430

The ZFSIOCRECVNEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption...

CVE-2026-49422

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

EUVD-2026-62255

Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...

CVE-2026-49428 posixshm: system calls can incorrectly free memory of largepage objects

Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...

CVE-2026-49428

In FreeBSD's posixshm module, open(2) with O_TRUNC and fspacectl(2) failed to verify whether operations are permitted on largepage objects, incorrectly freeing kernel memory. An unprivileged local user can read freed kernel memory and escalate privileges. Affected: all supported versions prior to...

CVE-2026-49428 posixshm: system calls can incorrectly free memory of largepage objects

Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...

CVE-2026-49427

CVE-2026-49427 is a use-after-free vulnerability in FreeBSD's POSIX largepage shared memory objects (posixshm module). Pages in largepage objects were not explicitly wired, so when sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed underlying pages while existing mappings s...

CVE-2026-49422

The FreeBSD advisory (FreeBSD-SA-26:43.tcp) confirms the bug affects all supported FreeBSD versions and provides specific correction commit hashes for stable/15, releng/15.1, releng/15.0, stable/14, releng/14.4, and releng/14.3 branches, all dated 2026-06-30. Workarounds include not loading tcp_r...

EUVD-2026-62244

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

CVE-2026-49422 Use-after-free in TCP RACK stack option handler

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

CVE-2026-49419

When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a...

CVE-2026-19942

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

CVE-2026-72276

A flaw was found in the metronomefb framebuffer driver within the Linux kernel. This vulnerability occurs because memory allocated for page references is not properly released when an error occurs during initialization. A local attacker could potentially exploit this to cause a denial of service...

CVE-2026-49419

FreeBSD 15.0+ kernel contains a double-free bug in kern_jail_set() and kern_jail_get(): when the JAIL_AT_DESC flag is used, the caller's current prison reference is released before descriptor lookup, then released again on error paths. An unprivileged local user can trigger a prison reference cou...

EUVD-2026-62231

When the JAILATDESC flag is specified, kernjailset and kernjailget released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a...

Exploit for Deserialization of Untrusted Data in Citrix Session_Recording

cve-id Donate Support the maintenance of this project wit...

CVE-2026-76050

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=deletemenu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-76049

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-76050 SourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injection

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=deletemenu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-76050

SQL injection exists in the ID argument of /admin/ajax.php?action=delete_menu in SourceCodester Simple Online Food Ordering System 1.0, exploitable remotely without authentication; a public proof-of-concept exists, so patching or replacing the vulnerable input handling is critical. No remediation...