41696 matches found
CVE-2026-68344 usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect ueaprobe distinguishes a pre-firmware device from a post-firmware one using the USB id UEAISPREFIRM, and stores a different object as the interface data i...
CVE-2026-68344
The CVE concerns the Linux kernel USB ATM driver (ueagle-atm). A pre-/post-firmware descriptor mismatch in uea_probe() vs uea_disconnect() allows a crafted device to cause an out-of-bounds access when tracing interface data, due to incorrect handling of interface data (struct completion vs struct...
CVE-2026-68179 misc: nsm: only unlock nsm_dev on post-lock error paths
In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsmdev on post-lock error paths nsmdevioctl jumps to the common out label even when the initial copyfromuser fails before nsm-lock has been taken. The error path then blindly unlocks a mutex that was never...
CVE-2026-68179
CVE-2026-68179 affects the Linux kernel NSM: nsm_dev_ioctl() may unlock a mutex that was never acquired when pre-lock copy_from_user() fails, risking a local DoS. A patch changes control flow to return immediately on pre-lock failures and to keep the unlock path for post-lock errors only. The vul...
CVE-2026-68091 HID: wacom: stop hardware after post-start probe failures
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacomparseandregister starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release...
EUVD-2026-55272
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacomparseandregister starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release...
CVE-2026-68091
CVE-2026-68091 concerns the Linux kernel HID Wacom driver. In wacom_parse_and_register(), HID hardware is started before inputs and LED/remotes are initialized. If subsequent steps fail, the error path currently releases Wacom resources without stopping the HID hardware, potentially causing syste...
CVE-2026-72569
creationtimestamp| type| source ---|---|--- 2026-08-10 11:38:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mspz6tkx5p2r...
CVE-2026-72567
creationtimestamp| type| source ---|---|--- 2026-08-10 11:38:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mspz6senqd26...
CVE-2026-65545
creationtimestamp| type| source ---|---|--- 2026-08-10 11:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mspxxl6kic2o 2026-08-11 03:21:54+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3msrnwhptkf2b 2026-08-11 07:16:09+00:00| seen|...
CVE-2026-28672
creationtimestamp| type| source ---|---|--- 2026-08-10 10:59:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5if5ljlxwuhwj 2026-08-12 16:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvkyosmvz26...
CVE-2026-32227
creationtimestamp| type| source ---|---|--- 2026-08-10 10:57:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5f7k6npj4o7m5 2026-08-12 16:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvkyne5242g...
CVE-2026-40920
creationtimestamp| type| source ---|---|--- 2026-08-10 10:51:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/75pdqosvnbj3w 2026-08-12 16:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msvlkkidh72v...
CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...
CVE-2026-66485
creationtimestamp| type| source ---|---|--- 2026-08-10 10:33:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/chv67ckc43jib 2026-08-10 12:45:32+00:00| seen| https://cert.pl/en/posts/2026/08/CVE-2026-66484 2026-08-15 00:10:28+00:00| seen|...
CVE-2026-19075
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...
CVE-2026-19077
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...
CVE-2026-17018
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...
CVE-2026-16257
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowi...