CVE-2026-91798: Incorrect Permission Assignment for Critical Resource

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges...

CVE-2026-96545: Out-of-bounds Read

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents in...

CVE-2026-96548: Use of Hard-coded Credentials

A flaw has been found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssmpro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity ...

CVE-2026-95627: Incorrect Permission Assignment for Critical Resource

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

CVE-2026-77285: Insertion of Sensitive Information into Log File

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

ROS-20260923-73-0061

The vulnerability of the gadgetBind function in the drivers/usb/gadget/legacy/rawgadget.c file of the Linux USB device driver module is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260923-73-0001

The vulnerability of the services/repository/files/patch.go file in the Git repository management system Gitea is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain unauthorized access to protected information...

ROS-20260923-73-0046

The vulnerability of the nfsd4ffprocgetdeviceinfo function in the fs/nfsd/flexfilelayout.c module, which is part of the NFS network file system support in Linux kernels, stems from the improper disabling or release of resources. Exploiting this vulnerability could allow an attacker to cause servi...

ROS-20260923-73-0051

The vulnerability of the rndisbind function in the drivers/usb/gadget/function/frndis.c file of the Linux kernel’s USB device driver is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260923-73-0028

The vulnerability of the dallocparallel function in the fs/dcache.c module of the Linux kernel file system is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260923-73-0082

The vulnerability of the arcserialprobe function in the drivers/tty/serial/arcuart.c file of the console TTY driver in the Linux kernel’s serial port module is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260923-73-0080

The vulnerability of the sdmav40hwfini function in the driver/gpu/drm/amd/amdgpu/sdmav40.c file of the Direct Rendering Infrastructure DRI AMD GPU kernel for the Linux operating system is related to the improper shutdown or release of resources. Exploiting this vulnerability can allow an attacker...

ROS-20260923-73-0052

The vulnerability of the drmschedjobaddresvdependencies function in the drivers/gpu/drm/scheduler/schedmain.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to the reallocation of previously released memory. Exploiting this vulnerability could allo...

ROS-20260923-73-0062

The vulnerability of the ext4clumapped function in the fs/ext4/extents.c module of the Ext4 file system in the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Wireshark 4.4.x < 4.4.17 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.4.17. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.17 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 -...

CVE-2026-42801: NULL Pointer Dereference

NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux asrrc module allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c...

Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Foxit PDF Reader JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsi...

Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Wireshark RF4CE Packet Parsing Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Wireshark. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RF4CE key...