CVE-2026-23252

In the Linux kernel, the following vulnerability has been resolved: xfs: get rid of the xchkxfiledescr calls The xchkxfiledescr macros call kasprintf, which can fail to allocate memory if the formatted string is larger than 16 bytes or whatever the nofail guarantees are nowadays. Some of them cou...

CVE-2026-27448

A flaw was found in pyOpenSSL. The settlsextservernamecallback callback function can be used to implement Server Name Indication SNI during the TLS handshake. When the callback raises an unhandled exception, the handshake incorrectly proceeds instead of terminating. This fail-open behavior can...

The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

Description The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at...

GHSA-2PM6-9FHX-VVG3 The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

Description The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at...

EUVD-2026-12548

The mailqueue TYPO3 extension has Insecure Deserialization in TransportFailure class...

CVE-2026-23248

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perfmmap Syzkaller reported a refcountt: addition on 0; use-after-free warning in perfmmap. The issue is caused by a race condition between a failing mmap setup and a concurrent mm...

CVE-2026-23248 perf/core: Fix refcount bug and potential UAF in perf_mmap

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perfmmap Syzkaller reported a refcountt: addition on 0; use-after-free warning in perfmmap. The issue is caused by a race condition between a failing mmap setup and a concurrent mm...

CVE-2026-23248

CVE-2026-23248 affects the Linux kernel perf/core component, specifically the perf_mmap path that initializes a ring_buffer. The issue is a race between a failing mmap() setup and a concurrent mmap() on a dependent event (e.g., due to output redirection). The ring_buffer pointer (event->rb) is...

CVE-2026-32596

CVE-2026-32596 describes an information-disclosure in Glances prior to 4.5.2, where starting the web server with the default command (glances -w) runs without authentication and exposes a REST API over the network. This allows remote attackers to access sensitive system information, including ful...

CVE-2026-30884 mdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Key

mdjnelson/moodle-modcustomcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to versions 4.4.9 and 5.0.3, a teacher who holds mod/customcert:manage in any single course can read and silently overwrite certificate elements...

PT-2026-26105

CVE-2026-29858 A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion LFI, leadingot sensitive information exposure. https://t.co/WowAOqIOTR...

Linux kernel 安全漏洞

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the possibility that the xchkxfiledescr macro call for kasprintf may fail, potentially leading to memor...

Linux Distros Unpatched Vulnerability : CVE-2026-23259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/rw: free potentially allocated iovec on cache put failure If a read/write request goes through ioreqrwcleanup and has an allocated iovec attached and...

Linux Distros Unpatched Vulnerability : CVE-2026-23260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - regmap: maple: free entry on masstoregfp failure regcachemaplewrite allocates a new block 'entry' to merge adjacent ranges and then stores it with masstoregfp...

The vulnerability of the dc_state_free() function in the drivers/gpu/drm/amd/display/dc/core/dc_state.c driver code allows a malicious actor to cause a service failure in AMD Linux-based graphics cards with Direct Rendering Infrastructure (DRI) support.

The vulnerability of the dcstatefree function in the drivers/gpu/drm/amd/display/dc/core/dcstate.c driver, which is part of the Direct Rendering Infrastructure DRI support for AMD graphics cards in Linux operating systems, involves pointer manipulation. Exploiting this vulnerability could allow a...

The vulnerability of the mlx5_revoke_mr() function in the drivers/infiniband/hw/mlx5/mr.c file of the Linux kernel’s InfiniBand support driver allows a attacker to cause a service failure.

The vulnerability of the mlx5revokemr function in the drivers/infiniband/hw/mlx5/mr.c file of the Linux kernel’s InfiniBand support module is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerabilities in the functions imx_dsp_rproc_stop() and imx_dsp_rproc_vq_work() of the driver module remoteproc/imx_dsp_rproc.c, which is part of the Linux operating system’s embedded processor subsystem, allow a malicious actor to cause service failures.

The vulnerabilities of the functions imxdsprprocstop and imxdsprprocvqwork in the driver module remoteproc/imxdsprproc.c of the Linux operating system’s embedded processor subsystem are related to the lack of synchronization. Exploiting these vulnerabilities could allow an attacker to cause a...

PT-2026-26095

Detection Method: Kolega.dev Deep Code Scan | Attribute | Value | |---|---| | Location | src/backend/base/langflow/api/v1/api key.py:44-53 | | Practical Exploitability | High | | Developer Approver | [email protected] | Description The delete api key route endpoint accepts an api key id path...

Keycloak 安全漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability, which stems from the SAML endpoint not verifying the status of external identity Providers. This could lead to bypassing security controls and performing unauthorized...

Keycloak 安全漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability, which stems from the SAML proxy endpoint failing to properly verify encrypted assertions. This vulnerability may lead to unauthorized access and information leakage...