CVE-2026-102916 Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vieemulatemovs and vieemulatestos in usr/src/uts/intel/io/vmm/vmminstructionemul.c do not clear the VIESREPEAT status...

EUVD-2026-95783

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, an...

CVE-2026-98212

A flaw was found in the Linux kernel's MultiMediaCard MMC host software queue. A local user could exploit a use-after-free vulnerability when pending retry operations are not cancelled before device removal, allowing tasks to access memory after it has been released. This issue can lead to a Deni...

CVE-2026-98211

A flaw was found in the Linux kernel's MultiMediaCard MMC host controller interface driver. When the device is removed, the driver fails to cancel pending delayed timeout tasks, allowing scheduled work to access memory that has already been released. A local user capable of triggering device...

CVE-2026-98210

A flaw was found in the Linux kernel's mxcmmc host driver. A local user with administrative privileges could trigger this vulnerability by unbinding or removing the device, leading to a Denial of Service DoS or potential arbitrary code execution. The driver fails to cancel active background tasks...

CVE-2026-107935 Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...

CVE-2026-19571

The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...

CVE-2026-19571 Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer

The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...

EUVD-2026-95527

The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...

CVE-2026-19571

A race condition exists in the ITE IT8xxx2 SHI host-command backend (specifically in ec_host_cmd_backend_shi_ite.c) within the Zephyr RTOS. The vulnerability occurs because the driver copies the 8-byte host-command request header from the SPI Rx FIFO into the shared receive buffer (data->in_ms...

CVE-2026-19571 Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer

The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...

CVE-2026-87108

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration...

EUVD-2026-95491

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration...

CVE-2026-87108 Ops Manager Improper Authorization in Daily Host Monitoring Retrieval

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration...

CVE-2026-87108

The MongoDB Ops Manager is vulnerable to an improper authorization flaw where an authenticated user with a read-only project role can retrieve daily host monitoring records from different projects. By providing a specific record identifier, the attacker can bypass ownership validation to access s...

Ops Manager Improper Authorization in Daily Host Monitoring Retrieval

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration...

Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling External Authentication Server and are addressed in SEAS 6115 fixpack Vulnerability Details CVEID:CVE-2026-77310 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...

MAL-2026-17711 Malicious code in wix-reg-poc-bypass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b0b4a2bb63a48ca7c9f712068de893526ec0e3515ffd367f37b5c251034965a The package shadows internal Wix registry module names thunderboltRegistry, corvidRegistry, editorRegistry, siteAssetsRegistry, and others and ships ...

CVE-2026-19571: Concurrent Execution using Shared Resource with Improper Synchronization

The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...

PT-2026-108985

Name of the Vulnerable Software and Affected Versions Argo CD versions 2.11.0 through 3.3.14 Argo CD versions 3.4.0 through 3.4.9 Argo CD versions 3.5.0 through 3.5.3 Argo CD versions 3.6.0-rc1 and earlier Description The Argo CD repo-server is subject to command injection when cloning, testing, ...