33624 matches found
CVE-2026-64241 gpio: rockchip: teardown bugs and resource leaks
In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock bank-dbclk is obtained using...
CVE-2026-64241 gpio: rockchip: teardown bugs and resource leaks
In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock bank-dbclk is obtained using...
CVE-2026-64230
In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irqdata.rdev not being assigned Commit 64a6b577490c "regulator: tps65219: Remove debugging helper function" removed the tps65219getrdevbyname helper along with the irqdata.rdev assignment that depended on...
CVE-2026-64230 regulator: tps65219: fix irq_data.rdev not being assigned
In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irqdata.rdev not being assigned Commit 64a6b577490c "regulator: tps65219: Remove debugging helper function" removed the tps65219getrdevbyname helper along with the irqdata.rdev assignment that depended on...
kernel: scsi: core: Wake up the error handler when final completions race against each other
Race condition vulnerabilities were found in the Linux kernel's SCSI error handler wake-up logic. Memory ordering issues in scsidechostbusy and ordering problems in scsiehinchostfailed can cause the SCSI error handler to never wake up when command completions race against each other. This leaves...
CVE-2026-16733
A flaw was found in bahmutov find-cypress-specs. A local attacker can exploit a vulnerability in the Branch Handler component by manipulating the '--branch' argument. This manipulation leads to an operating system OS command injection, allowing the attacker to execute arbitrary commands on the...
CVE-2026-12497
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin (versions before 4.16.18 ) is vulnerable to unauthenticated privilege escalation . The flaw occurs because the plugin uses different parsers for the roles offered in the fro...
EUVD-2026-48434
A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...
ALSA-2026:45114 Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fs/notify: call exportfsencodefid with sumount CVE-2025-40237 kernel: scsi: core: Wake up the error handler when final completions race against each other CVE-2026-23110 kernel: rtnetlink...
CVE-2026-16763
A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...
CVE-2026-16767 Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal
A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...
CVE-2026-16767
A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...
CVE-2026-16767 Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal
A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...
CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection
A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the RSCErrorHandler when redirect targets from untrusted sources are not properly validated. An attacker can execute arbitrary scripts in the context of the application by supplying a crafted redirect target...
CVE-2026-48537
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected...
JLSEC-2026-784
A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftpextensionsgetname/sftpextensionsgetdata of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may ...
CVE-2026-65898
DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements,...
CVE-2026-16735
A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...
EUVD-2026-48283
A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...