9056 matches found
SUSE CVE-2026-63649
The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...
Important: haproxy security update
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 For more details about the security issues, including the impact, a CVSS score...
UBUNTU-CVE-2026-74317
In the Linux kernel, the following vulnerability has been resolved: ixgbe: do not configure xps for XDP queues netifsetxpsqueue should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs =64, on E610 adapter, netdev is configured with maximu...
CVE-2026-68456
In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous requestfirmwarenowait in .probe, but does not wait for its completion, not even in .disconnect; so, if the device is unplugged...
CVE-2026-74338
CVE-2026-74338 concerns the Linux kernel: a BPF_LSM_CGROUP sleepable program could be loaded in a context where sleeping is disallowed, triggering a BUG from sleeping in an invalid context during file_open. The fix adds verifier support to reject loading sleepable BPF_LSM_CGROUP programs destined...
CVE-2026-68456: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous requestfirmwarenowait in .probe, but does not wait for its completion, not even in .disconnect; so, if the device is unplugged...
CVE-2026-50029
Affects js-toml prior to 1.1.2. The parser uses if (object[key]) to decide duplicates, causing falsy primitives (false, 0, 0n, 0.0, -0, "") to be overwritten by later keys; this yields structural type confusion in load() output (e.g., isAdmin becomes truthy object). MITRE/ATT&CK not specified in ...
SUSE CVE-2026-68363
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...
GO-2024-3212 vulnerabilities
Vulnerabilities for packages: aws-load-balancer-controller, aws-load-balancer-controller-fips...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: grafana-operator-fips, podinfo, omnictl-multiarch, polaris, victoriametrics-fips, aws-ebs-csi-driver-fips, flux-source-watcher, temporal-fips, terragrunt, flux-operator, grafana-rollout-operator, flux-helm-controller, aws-ebs-csi-driver, flux-fips,...
GO-2024-3212 vulnerabilities
Vulnerabilities for packages: aws-load-balancer-controller...
GO-2026-4440 vulnerabilities
Vulnerabilities for packages: gitness, k3s, k8s-device-plugin, wuzz, runc, aws-load-balancer-controller, fuse-overlayfs-snapshotter...
GO-2026-4441 vulnerabilities
Vulnerabilities for packages: gitness, k3s, k8s-device-plugin, wuzz, runc, aws-load-balancer-controller, fuse-overlayfs-snapshotter...
CVE-2026-18109
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2026-18109 W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2026-18109
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.10.3 . The root cause is insufficient input sanitization and output escaping of the Comment Author Name . An unauthenticated attacker can inject arbitrary web scripts t...
CVE-2026-18109
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2026-18109 W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
EUVD-2026-58570
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
PT-2026-71950
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...