CVE-2026-82677

CVE-2026-82677 affects valkey-io valkey 9.1.0 , specifically the function moduleTimerHandler in the Module Timer Subsystem (src/module.c). The root cause is a double free that can be triggered remotely, though exploitation requires high privileges and user interaction . The impact is limited to l...

CVE-2026-82677

A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-82677 valkey-io valkey Module Timer module.c moduleTimerHandler double free

A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-82677 valkey-io valkey Module Timer module.c moduleTimerHandler double free

A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-82677 valkey-io valkey Module Timer module.c moduleTimerHandler double free

A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-80592

A flaw was found in the Linux kernel. A local user could trigger a kernel warning by enabling the mtier sample module before its address range parameters are properly initialized. This issue, caused by invalid address range parameters, could lead to system instability or a denial of service...

EUVD-2026-68455

Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously, they can obtain root privileges to steal configuration passwords such as SNMP, thereby tampering with critical system parameter...

CVE-2026-82662

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitt...

CVE-2026-80610

A flaw was found in the Linux kernel's net: enetc module. When the numvsi value is zero, a divide-by-zero error occurs during the allocation of network rings. While this issue may not cause an immediate system crash on some architectures, it represents undefined behavior that could lead to system...

CVE-2026-80600

A flaw was found in the batman-adv module of the Linux kernel. This vulnerability occurs because the pskbmaypull function, when called by batadvgetvid, can reallocate a buffer. This causes variables to point to the previously freed memory, leading to a use-after-free condition. A local attacker...

UBUNTU-CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

CVE-2026-80599

A flaw was found in the Linux kernel's batman-adv Better Approach To Mobile Ad-hoc Networking - Advanced module. An attacker, by sending specially crafted network packets, could trigger an out-of-bounds memory access in the batadvgetvid function. This occurs because the function fails to verify t...

CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

CVE-2026-58301 Apache Shiro: Server-side POST request may be steered to an alternate host

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

CVE-2026-80718

A flaw was found in the Linux kernel. Specifically, within the mm/percpu-km module, the pcpucreatechunk function incorrectly calculates the size of a bitmap used for tracking memory pages. This miscalculation can lead to a bitmap overflow, where data is written beyond the intended memory boundary...

pipewire: RAOP RTSP NULL Deref

RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return...

CVE-2026-80661

A flaw was found in the Linux kernel's Universal Flash Storage UFS core tracing module. The system attempts to access a memory location that has already been freed when processing trace events, specifically within the TPprintk function. This use-after-free vulnerability can be triggered when...

CVE-2026-14671

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server. Mitigation To mitigate this vulnerability,...

cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy

A flaw was found in the Go command cmd/go. A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the go command may then download and execute without proper verification...