CVE-2026-47522

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure,...

CVE-2026-47522

The NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer caused by improper input validation . A successful exploit could lead to code execution , denial of service , escalation of privileges , information disclosure , and data tampering . No specific ...

CVE-2026-47522

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure,...

CVE-2026-47601

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module DMA-BUF import path where an unprivileged local user could cause improper preservation of memory access permissions when importing a read-only buffer from another device's DMA-BUF exporter. A...

EUVD-2026-90139

NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module where an unprivileged local user could cause improper preservation of memory access permissions during DMA mapping. A successful exploit of this vulnerability might lead to code execution, escalation of...

EUVD-2026-88476

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized...

@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Impact When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the...

GHSA-M9GG-HP2V-232J @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

Impact When server credentials are created with the requireClientCertificate option set to false, getAuthContext does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for @grpc/grpc-js users who use the...

Improper Isolation or Compartmentalization

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in lib/helpers/shouldBypassProxy.js, which matches NOPROXY entries by exact host or IP and has no parsing for CIDR notation, so...

Improper Isolation or Compartmentalization

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in lib/helpers/shouldBypassProxy.js, which matches NOPROXY entries by exact host or IP and has no parsing for...

CVE-2026-100259

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...

CVE-2026-100259

In JetBrains YouTrack versions before 2026.2.18991 , an improper access control vulnerability exists within the Gantt chart functionality. This flaw allows users with view-only access to perform unauthorized edits . No specific exploit details or in-the-wild exploitation reports are provided in t...

EUVD-2026-90003

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...

Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Overview On September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding CWE-177. An...

SUSE CVE-2026-93995

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD...

CVE-2026-94545 Satori-generated SVG has improper escaping

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...

CVE-2026-94545

The Satori library (used by Next.js to convert HTML/CSS to SVG) fails to properly escape certain values, such as the ; character, before including them in generated SVG output. This improper output encoding (CWE-116) allows crafted values to be interpreted as SVG markup. When Next.js (versions 16...

CVE-2026-94545 Satori-generated SVG has improper escaping

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...

Improper Encoding or Escaping of Output

Overview satori is an Enlightened library to convert HTML and CSS to SVG. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the generation of its SVG output, which places certain input values into the document without neutralizing characters that are...

Improper Certificate Validation

Snowflake drivers are vulnerable to Improper Certificate Validation. The vulnerability is due to improper validation of OCSP responses and treating definitive verification failures as transient, which allows a man-in-the-middle attacker with a revoked certificate and its private key to establish ...