The vulnerability of the blkcg_css_online() function in the block/blk-cgroup.c module, which supports the block-level kernel in the Linux operating system, allows a hacker to trigger a service failure.

The vulnerability of the blkcgcssonline function in the block/blk-cgroup.c module, which supports the block-level kernel in Linux, is related to improper initialization. Exploiting this vulnerability could allow an attacker to cause service failures...

SUSE-SU-2026:20962-1 Security update for gnutls

This update for gnutls fixes the following issues: - CVE-2025-14831: Fixed DoS via excessive resource consumption during certificate verification. bsc1257960 - CVE-2025-9820: Fixed a buffer overflow in gnutlspkcs11tokeninit. bsc1254132 - Add the functionality to allow to specify the hash algorith...

OPENSUSE-SU-2026:20446-1 Security update for gnutls

This update for gnutls fixes the following issues: - CVE-2025-14831: Fixed DoS via excessive resource consumption during certificate verification. bsc1257960 - CVE-2025-9820: Fixed a buffer overflow in gnutlspkcs11tokeninit. bsc1254132 - Add the functionality to allow to specify the hash algorith...

The vulnerability of the `udp4_gro_complete()` function in the `net/core/gro.c` module of the Linux kernel allows a malicious actor to gain unauthorized access to protected information or cause service failures.

The vulnerability of the udp4grocomplete function in the net/core/gro.c module of the Linux kernel is related to an erroneous initialization of the encapsulation flag. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information or cause service...

Linux Distros Unpatched Vulnerability : CVE-2026-23305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix unwinding in error path in rocketprobe When rocketcoreinit fails as could ...

CVE-2026-27828

EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118chargerImpl::handlesessionsetup uses v2gctx after it has been freed when ISO15118 initialization fails e.g., no IPv6 link-local address. The EVSE process can be crashed remotely by an attacker with MQTT access who issue...

CVE-2026-33725 Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import

Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution RCE and Arbitrary File Read via the...

ROS-20260327-73-0014

Vulnerability in opentelemetry-collector-contrib related to incorrect resource initialization. Exploitation of the vulnerability may allow an attacker to cause a denial of service...

The vulnerability of the blkcg_init_disk() function in the block/blk-cgroup.c module, which supports the Linux kernel’s block-level support, allows a attacker to cause a service failure.

The vulnerability of the blkcginitdisk function in the block/blk-cgroup.c module, which supports the Linux kernel’s block-level support, involves the failure to release resources after their useful life has expired. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the vmbus_device_register() function in the drivers/hv/vmbus_drv.c module of the support driver for Microsoft HyperV Linux kernel allows a malicious actor to cause a service failure.

The vulnerability of the vmbusdeviceregister function in the drivers/hv/vmbusdrv.c module of the Microsoft HyperV Linux kernel support driver is related to improper initialization. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the io_ring_exit_work() function in the io_uring/io_uring.c module of the Linux kernel’s asynchronous input/output interface allows a hacker to cause a service failure.

The vulnerability of the ioringexitwork function in the iouring/iouring.c module, a component of the Linux kernel’s asynchronous input/output interface, is related to initialization errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

GHSA-HF2R-9GF9-RWCH Convict has prototype pollution via load(), loadFile(), and schema initialization

Impact Two unguarded prototype pollution paths exist, not covered by previous fixes: 1. config.load / config.loadFile — overlay recursively merges config data without checking for forbidden keys. Input containing proto or constructor.prototype e.g. from a JSON file causes the recursion to reach...

Convict has prototype pollution via load(), loadFile(), and schema initialization

Impact Two unguarded prototype pollution paths exist, not covered by previous fixes: 1. config.load / config.loadFile — overlay recursively merges config data without checking for forbidden keys. Input containing proto or constructor.prototype e.g. from a JSON file causes the recursion to reach...

Prototype Pollution

Overview convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration...

CVE-2026-27828

EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118chargerImpl::handlesessionsetup uses v2gctx after it has been freed when ISO15118 initialization fails e.g., no IPv6 link-local address. The EVSE process can be crashed remotely by an attacker with MQTT access who issue...

EUVD-2026-16228

EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118chargerImpl::handlesessionsetup uses v2gctx after it has been freed when ISO15118 initialization fails e.g., no IPv6 link-local address. The EVSE process can be crashed remotely by an attacker with MQTT access who issue...

CVE-2026-27828

EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118chargerImpl::handlesessionsetup uses v2gctx after it has been freed when ISO15118 initialization fails e.g., no IPv6 link-local address. The EVSE process can be crashed remotely by an attacker with MQTT access who issue...

CVE-2026-23995

EVerest is an EV charging software stack. Prior to version 2026.02.0, stack-based buffer overflow in CAN interface initialization: passing an interface name longer than IFNAMSIZ 16 to CAN open routines overflows ifreq.ifrname, corrupting adjacent stack data and enabling potential code execution. ...

CVE-2026-27646

OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize host-side ACP runtime. Attackers can bypass sandbox restrictions by invoking the /acp spawn slash-command to cross from sandboxed chat conte...

CVE-2026-33038

WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfiguration.php endpoint. install/checkConfiguration.php performs full application initialization: database setup, admin account creation, and...