35915 matches found
Secure Kernel Mode Privilege Escalation
The vulnerability of the Secure Kernel Mode feature in Windows operating systems is related to improper checking of consistency in input data. Exploiting this vulnerability can allow attackers to enhance their privileges...
EUVD-2026-66677
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Sprin...
bubblewrap: bubblewrap: Privilege escalation via ptrace when installed in setuid mode
A flaw was found in bubblewrap when operating in setuid mode. A local user may use ptrace to interfere with the sandbox setup process and gain access to privileged operations that are normally restricted. This could allow an attacker to bypass intended sandboxing restrictions and potentially...
cakephp/debug_kit: MailPreview contains unsafe reflection
Impact The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true: 1. debug mode must be enabled. 2. The hostname must match a 'local' domain or be in an allowlist. Patches 5.2.4 and 4.10.3 contai...
CVE-2026-80579
In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fbinfo-mode before deleting a videomode fbsetvar can delete a mode from info-modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current...
UBUNTU-CVE-2026-80579
In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fbinfo-mode before deleting a videomode fbsetvar can delete a mode from info-modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current...
CVE-2026-74741
In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode such as legacy INTx or single MSI, wx-msixentry is not allocated or initialized. Calling NGBEINTRMISCwx dereferences wx-msixentry-entry,...
UBUNTU-CVE-2026-74741
In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode such as legacy INTx or single MSI, wx-msixentry is not allocated or initialized. Calling NGBEINTRMISCwx dereferences wx-msixentry-entry,...
GO-2026-6291 mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias in github.com/sonirico/mcp-shell
mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias in github.com/sonirico/mcp-shell...
GO-2026-6290 mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable in github.com/sonirico/mcp-shell
mcp-shell has a Secure Mode Allowlist Bypass via Default /bin/bash Executable in github.com/sonirico/mcp-shell...
GO-2026-6292 mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist in github.com/sonirico/mcp-shell
mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist in github.com/sonirico/mcp-shell...
CVE-2026-74741
CVE-2026-74741 is a NULL pointer dereference in the Linux kernel's ngbe network driver, occurring in the non-MSI-X interrupt enabling path. When the driver operates in legacy INTx or single MSI mode, the wx->msix_entry pointer is not allocated or initialized, so calling NGBE_INTR_MISC(wx) dere...
SUSE-SU-2026:23289-1 Security update for rsync
This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent...
CVE-2026-15366
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...
CVE-2026-15365
A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app...
CVE-2026-15366
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...
CVE-2026-15366
A control logic defect in a specific built-in webpage of Kids Mode on vivo devices allows users to view local gallery photos directly within that page. The vulnerability is scored CVSS 4.0 base 2.4 (LOW) with a physical attack vector , indicating proximity access is required and no privileges or ...
CVE-2026-15366
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...