GHSA-57HQ-95W6-V4FC Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

Impact A race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the reconfirmable option the default when using Confirmable with email changes. By sending two concurrent email change requests, an...

grub2: Missing unregister call for gettext command may lead to use-after-free

A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the applicati...

EUVD-2026-12683

Next.js: null origin can bypass dev HMR websocket CSRF checks...

Next.js: null origin can bypass dev HMR websocket CSRF checks

Summary In next dev, cross-site protections for internal development endpoints could treat Origin: null as a bypass case even when allowedDevOrigins is configured. This could allow privacy-sensitive or opaque browser contexts, such as sandboxed documents, to access privileged internal dev-server...

CVE-2025-13406

NULL Pointer Dereference vulnerability in Softing Industrial Automation GmbH smartLink SW-HT Webserver modules allows HTTP DoS.This issue affects smartLink SW-HT: 1.43...

cpython: email header injection due to unquoted newlines

A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules,...

cpython: email header injection due to unquoted newlines

A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules,...

EUVD-2026-12538

A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handlepdfdocument of the file python/helpers/documentquery.py. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available ...

EUVD-2026-12527

A vulnerability was identified in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. Impacted is the function recognizeMarkdown of the file yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/util/Pdf2MdUtil.java. Such...

CVE-2026-4285

A vulnerability was identified in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. Impacted is the function recognizeMarkdown of the file yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/util/Pdf2MdUtil.java. Such...

EulerOS Virtualization 2.12.0 : grub2 (EulerOS-SA-2026-1486)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the...

The vulnerability of the init_amd_zen2() function in the arch/x86/kernel/cpu/amd.c module, which is part of the Linux operating system’s x86 kernel support, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the initamdzen2 function in the arch/x86/kernel/cpu/amd.c module, which is part of the Linux kernel support for x86 processors, is related to incorrect support for AMD Zen2 processors. Exploiting this vulnerability could allow a remote attacker to compromise the...

ROS-20260317-73-0001

A vulnerability in the kmemcachedestroy function of the dswstate.c module of the Linux operating systems kernel is related to the lack of memory release after an effective lifetime. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

PT-2026-36461

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A DMA corruption issue exists in the caam crypto component when using long hmac keys. When a key exceeds the block size, it is copied and hashed into the real key. The memory allocated f...

EulerOS Virtualization 2.12.0 : rsync (EulerOS-SA-2026-1517)

According to the versions of the rsync package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a...

grub2 security update

2.12-29.0.1.el101.2 - efinet: Close and reopen card on failure Orabug: 37808688 - Update grub2 dependencies to match new Secure Boot certificate chain of trust Orabug: 37766761 - Fix typo in SBAT metadata Orabug: 37693946 - Allow installation of grub2 only with shim-aa64 that allows booting it...

Huawei HarmonyOS Resource Scheduling Module Privilege Control Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege control vulnerability exists in the Huawei HarmonyOS resource scheduling module, which can be exploited by an attacker to compromise integrity...

ROS-20260317-73-0018

A vulnerability in the doinsnioctl function of the comedi component of the Linux kernel is related to incorrect resource initialization. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

The vulnerabilities of the functions __msc_buffer_win_free() and msc_buffer_get_page() in the driver/hwtracing/intel_th/msu.c module of the Linux kernel’s hardware tracing driver allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the functions mscbufferwinfree and mscbuffergetpage in the drivers/hwtracing/intelth/msu.c module of the Linux kernel’s hardware tracing driver is related to insufficient data validation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

EulerOS Virtualization 2.12.1 : grub2 (EulerOS-SA-2026-1429)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the...