SUSE CVE-2026-69153

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

CVE-2026-74729

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoopfileread putfifowithdiscard acts as both producer and consumer on the kfifo: it calls kfifoskip advances out and kfifoput advances in from the IRQ handler without synchronizin...

CVE-2026-74641

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

Security Bulletin: MaaS360 mobile apps (iOS and Android) are able to bypass authentication by using deep link from the browser.

Summary MaaS360 mobile apps iOS and Android are able to bypass authentication by using deep link from the browser. Vulnerability Details CVEID:CVE-2023-42021 DESCRIPTION: The MaaS360 iOS application could allow an attacker to bypass authentication mechanisms by exploiting the password reset...

CVE-2026-74729 soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoopfileread putfifowithdiscard acts as both producer and consumer on the kfifo: it calls kfifoskip advances out and kfifoput advances in from the IRQ handler without synchronizin...

CVE-2026-74729

CVE-2026-74729 is a usercopy overflow in the Linux kernel's soc: aspeed: lpc-snoop driver. The root cause is a race condition on SMP systems: put_fifo_with_discard() in the IRQ handler and snoop_file_read() concurrently access the same kfifo without synchronization, which can leave the internal (...

CVE-2026-74729 soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoopfileread putfifowithdiscard acts as both producer and consumer on the kfifo: it calls kfifoskip advances out and kfifoput advances in from the IRQ handler without synchronizin...

EUVD-2026-64416

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoopfileread putfifowithdiscard acts as both producer and consumer on the kfifo: it calls kfifoskip advances out and kfifoput advances in from the IRQ handler without synchronizin...

CVE-2026-74584 RDMA/bnxt_re: zero shared page before exposing to userspace

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: zero shared page before exposing to userspace bnxtreallocucontext allocates uctx-shpg via getfreepageGFPKERNEL. The buddy allocator does not zero pages without GFPZERO, so the page contains stale kernel data from...

CVE-2026-56380

AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through...

CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...

CVE-2026-56380

AVideo (through commit 9c39d8c8) contains an information exposure vulnerability in feed/index.php . The endpoint returns channel owner email addresses embedded in itunes:email and itunes:author RSS elements when a public channel name parameter is supplied. Because no authentication is required, a...

EUVD-2026-64259

AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through...

CVE-2026-56380 AVideo feed/index.php Exposure of Channel Owner Email Address

AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through...

CVE-2026-12710

A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration versions from 2025-04-28 to 2026-04-04 allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no customer action is required...

CVE-2026-12710 Missing Authorization in Application Integration QueryEngineTask

A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration versions from 2025-04-28 to 2026-04-04 allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no customer action is required...

CVE-2026-12710

CVE-2026-12710 is a Missing Authorization vulnerability in the QueryEngineTask component of Google Cloud Application Integration , affecting versions from 2025-04-28 to 2026-04-04. An external attacker with no privileges or user interaction can access sensitive internal data over the network. The...

EUVD-2026-64241

A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration versions from 2025-04-28 to 2026-04-04 allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no customer action is required...

CVE-2026-19093 Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...

CVE-2026-75027

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored...