CVE-2026-64284 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...

EUVD-2026-48749

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges...

EUVD-2026-48750

Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges...

EUVD-2026-48747

An attacker can modify data that should be restricted to read‑only access...

Linux Distros Unpatched Vulnerability : CVE-2026-46968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3,...

Linux Distros Unpatched Vulnerability : CVE-2026-59847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an...

PT-2026-64505

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM x86 module where fastpath userspace exits may occur before the vendor's exit handler runs. This prevents KVM from executing vendor-specific operations required...

PT-2026-64526

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the crypto: qat component, the service table list is not consistently protected by service lock during iterations. While the lock is used when entries are added or removed via adf...

Linux Distros Unpatched Vulnerability : CVE-2026-60158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Difficult to explo...

CVE-2026-60135

An attacker can modify data that should be restricted to read‑only access...

CVE-2026-61892

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges...

CVE-2026-61892

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges...

CVE-2026-61892 Weintek cMT3092X Incorrect Permission Assignment for Critical Resource

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges...

CVE-2026-61892

The CVE-2026-61892 entry applies to Weintek cMT3092X HMI. The vulnerability concerns insufficient permission handling that lets a non-privileged user modify tokens to escalate privileges, yielding a high-severity impact on confidentiality, integrity, and availability per the ICS CVSS metrics (sco...

CVE-2026-61892 Weintek cMT3092X Incorrect Permission Assignment for Critical Resource

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges...

CVE-2026-60135 Weintek cMT3092X Incorrect User Management

An attacker can modify data that should be restricted to read‑only access...

CVE-2026-60135

An attacker can modify data that should be restricted to read‑only access...

Improper Neutralization of Special Elements in Data Query Logic

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the enrichContext process. An attacker can gain unauthorized access to sensitive data, modify or delete arbitrary documents, an...

CVE-2026-48021

CVE-2026-48021 affects epa4all prior to 2026-05-20. An attacker who can intercept TLS between epa4all and the ePA backend could complete the VAU handshake with attacker-controlled keys, deriving session encryption keys. This allows reading and modifying inner HTTP traffic (including patient conse...

CVE-2026-48021

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic patient consent decisions, medication data,...