UBUNTU-CVE-2026-93275

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix stop/start with no update If pteventstop is called without PERFEFUPDATE flag, then perfauxoutputend is not called. A subsequent call to pteventstart will call perfauxoutputbegin again which violates the rul...

Linux Distros Unpatched Vulnerability : CVE-2026-93275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf/x86/intel/pt: Fix stop/start with no update If pteventstop is called without PERFEFUPDATE flag, then perfauxoutputend is not called. A subsequent call to...

CVE-2026-93275

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix stop/start with no update If pteventstop is called without PERFEFUPDATE flag, then perfauxoutputend is not called. A subsequent call to pteventstart will call perfauxoutputbegin again which violates the rul...

UBUNTU-CVE-2026-97422

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfdsmievenabled skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT events are emitted with pid=0 while carrying another process's PID and...

SUSE CVE-2026-78253

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

CVE-2026-96604

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...

automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching an instance group to a schedule or a workflow job template node through the dedicated API relationship endpoint, the controller verifies only that the requesting user can read view the instance group,...

CVE-2026-96604 SoftNews Media Group DataLife Engine Search search.php strip_data sql injection

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...

automation-controller: automation-controller-container: automation-controller: instance group attachment to schedules and workflow job template nodes checks only read permission, allowing use of restricted (controlplane / other-tenant) instance groups and privilege escalation to control-plane code execution

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching an instance group to a schedule or a workflow job template node through the dedicated API relationship endpoint, the controller verifies only that the requesting user can read view the instance group,...

automation-controller: automation-controller-container: automation-controller: container group pod_spec_override mints the automation-controller ServiceAccount token and mounts control-plane namespace secrets into job pods, bypassing automountServiceAccountToken:false (control-plane secret and identity compromise)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. A user with the delegated Instance Group Admin role on a container group can set a free-form pod specification override that is deep-merged, without filtering, into every job pod launched on that group. The only...

CVE-2026-82407

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...

DEBIAN-CVE-2026-88839

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

CVE-2026-88839

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

CVE-2026-88839

The BusyBox passwd/group utility contains a vulnerability in the tokenize() function where it references a stale endpoint pointer after trimming. This flaw leads to an out-of-bounds write of heap pointers. To mitigate this risk, ensure that /etc/group and /etc/passwd are writable only by root and...

CVE-2026-88839 Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

CVE-2026-88839 Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

CVE-2026-88839

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. Mitigation Ensure /etc/group and /etc/passwd are writable only by root and protected by mandatory access controls. Monitor these files for unauthorized modifications...

CVE-2024-48652

CVE-2024-48652 在 camaleon-cms v.2.7.5 中存在跨站脚本漏洞，允许远程攻击者通过内容组名称字段执行任意代码。 复现步骤： 1. 打开 URL：http://127.0.0.1/admin/dashboard 2. 使用管理员凭据登录。 3. 导航到“设置”部分。 4. 点击“内容组”。 5. 选择一个内容组的“编辑”选项。 6. 在“名称”字段中输入以下 XSS 载荷： " 7. 保存更改。 8. 刷新页面或导航到其他部分。 9. XSS 载荷将触发，弹出一个包含“1”的警告框。 漏洞类型：跨站脚本 XSS 产品供应商：Camaleon-Cms...

CVE-2026-78253

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

DEBIAN-CVE-2026-78253

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...