CVE-2026-47011

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Application Interface. Supported versions that are affected are 17.0-26.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment...

CVE-2026-63947

A flaw was found in the Linux kernel's Bluetooth Human Interface Device Protocol HIDP. A remote attacker, by sending specially crafted truncated packets from a paired Bluetooth device, could trigger an out-of-bounds read in the hidpinputreport function. This vulnerability may lead to unintended...

Critical: Red Hat Security Advisory: Migration Toolkit for Applications

A new version of Migration Toolkit for Applications MTA is now available. Migration Toolkit for Applications MTA accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. This solution provides insight throughout the adoption process, at both...

CVE-2026-16423

Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-16423

Google Chrome versions prior to 150.0.7871.182 are vulnerable to a use after free flaw in the UI components. A remote attacker can exploit this by tricking a user into performing specific UI gestures on a crafted HTML page, leading to potential heap corruption . Impact includes arbitrary code exe...

EUVD-2026-41603

Gitea: Notification API leaks private issue metadata after access revocation...

EUVD-2026-46416

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

EUVD-2026-46356

Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system...

EUVD-2026-46357

An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution...

EUVD-2026-46359

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...

CVE-2026-65317

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-10678

The CVE-2026-10678 issue affects Zephyr’s MCTP over I2C+GPIO target binding (mctp_i2c_gpio_target.c). It processes I2C bus master writes byte-by-byte without validating the receive buffer, dereferencing b->rx_pkt to write data for data registers (MCTP_I2C_GPIO_RX_MSG_ADDR) before the receive b...

CVE-2026-10678 NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctpi2cgpiotarget.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctpi2cgpiotargetwritereceived without validating the order or the receive buffer. In the affected versions the MCTPI2CGPIORXMSGADDR data...

CVE-2026-10679 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-10679

The CVE-2026-10679 issue affects Zephyr’s DesignWare SPI driver (drivers/spi/spi_dw.c). The root cause is that the BAUDR clock divider was computed as info->clock_frequency / config->frequency without validating frequency, allowing a userspace thread with SPI access to pass frequency = 0, t...

CVE-2026-63921

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface VTI module. When a VTI tunnel device is moved to a different network environment, an unprivileged user in a separate user space can manipulate tunnel parameters. This manipulation could allow the user to intercept or redirect...

CVE-2026-8988 Access to Bootloader

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file system to obtain operating system access...

CVE-2026-8988 Access to Bootloader

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file system to obtain operating system access...

CVE-2026-8988

CVE-2026-8988 affects Autel Maxi Charger Single firmware up to V1.03.51. A UART interface exposed on the device allows interruption of the boot process and access to the U-Boot bootloader. With physical access, an attacker can modify boot configuration or file system to obtain operating system ac...

CVE-2026-47237

Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the...