72285 matches found
CVE-2026-15449
A time-of-check to time-of-use TOCTOU flaw in the illumos data-link pseudo-driver dld affects handling of the DLDIOCGETMACPROP and DLDIOCSETMACPROP ioctls on /dev/dld. drviocpropcommon in usr/src/uts/common/io/dld/dlddrv.c copies the dldiocmacpropt ioctl header in once to read its prvalsize field...
CVE-2026-15449 TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption
A time-of-check to time-of-use TOCTOU flaw in the illumos data-link pseudo-driver dld affects handling of the DLDIOCGETMACPROP and DLDIOCSETMACPROP ioctls on /dev/dld. drviocpropcommon in usr/src/uts/common/io/dld/dlddrv.c copies the dldiocmacpropt ioctl header in once to read its prvalsize field...
CVE-2026-15449 TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption
A time-of-check to time-of-use TOCTOU flaw in the illumos data-link pseudo-driver dld affects handling of the DLDIOCGETMACPROP and DLDIOCSETMACPROP ioctls on /dev/dld. drviocpropcommon in usr/src/uts/common/io/dld/dlddrv.c copies the dldiocmacpropt ioctl header in once to read its prvalsize field...
CVE-2026-15449
CVE-2026-15449 describes a TOCTOU vulnerability in the illumos data-link pseudo-driver (dld) regarding handling of DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. In drv_ioc_prop_common(), the header is read once to obtain pr_valsize, a kernel heap buffer is allocated, and then the fu...
CVE-2026-46404
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23...
UBUNTU-CVE-2026-47087
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...
CVE-2026-63086
creationtimestamp| type| source ---|---|--- 2026-07-16 19:04:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrwhp7yyy22...
CVE-2026-14371
creationtimestamp| type| source ---|---|--- 2026-07-16 18:54:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrvvrteqy22...
CVE-2026-63085
creationtimestamp| type| source ---|---|--- 2026-07-16 18:49:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrvo47kg32s...
CVE-2026-45576
creationtimestamp| type| source ---|---|--- 2026-07-16 18:46:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrvhepsbd2n 2026-07-21 17:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr6car56u322...
CVE-2026-13401
creationtimestamp| type| source ---|---|--- 2026-07-16 18:09:25+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqrtfkoup52p...
EUVD-2026-44998
BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...
CVE-2026-46353 BigBlueButton API checksum bypass via presentationUploadExternalUrl
BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...
CVE-2026-46404 BigBlueButton: Presentation URL Security Hardening
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23...
CVE-2026-45695
creationtimestamp| type| source ---|---|--- 2026-07-16 16:42:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrojgm4yj2p 2026-09-11 11:00:42+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7ae70118-bb20-4e14-a01c-cfb2d14d7491...
CVE-2026-59861
creationtimestamp| type| source ---|---|--- 2026-07-16 16:35:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqro4qey2p2h...
CVE-2026-14254
creationtimestamp| type| source ---|---|--- 2026-07-16 16:29:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrntrqz3a2w...
CVE-2026-59859
creationtimestamp| type| source ---|---|--- 2026-07-16 16:24:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrnktbz6e22...
CVE-2026-12379
An Open Redirect vulnerability CWE-601 exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the post-authentication redirect to the application's own origin, so a user who follows a crafted login link can be sent to an untrusted...