274244 matches found
CVE-2026-68360
A flaw was found in the Linux kernel's hwmon: corsair-cpro driver. A race condition can occur during the driver's initialization process if device input/output IO is started but then fails. This timing issue can lead to a use-after-free UAF vulnerability, where the system attempts to access memor...
CVE-2026-68413
A flaw was found in the ipw2100 wireless driver in the Linux kernel. Insufficient error handling in the ipw2100pciinitone function can lead to a memory leak. This occurs because memory allocated by ipw2100allocdevice is not properly released in specific error scenarios, potentially allowing a loc...
CVE-2026-68393
A flaw was found in the Bluetooth hcisync component of the Linux kernel. This vulnerability arises from the incorrect handling of Read-Copy-Update RCU protected pointers outside their designated critical sections without proper reference counting. An attacker could exploit this by triggering a ra...
CVE-2026-73216
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdownclientconnection in src/server/nsturnserver.c prematurely calls decquota and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation,...
CVE-2026-73215
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnportsallocateeven in src/apps/relay/turnports.c marks the unused odd sibling port as TPSTAKENODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowin...
CVE-2026-73212
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 T...
CVE-2026-20901
Improper input validation for some IntelR XeonR processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack...
EUVD-2026-56788
Improper input validation for some IntelR XeonR processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack...
CVE-2026-20901
Improper input validation for some IntelR XeonR processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack...
CVE-2026-20901
CVE-2026-20901 concerns firmware input validation issues in some Intel Xeon processors. The root cause is improper input validation in startup code and SMM pathways, creating a pathway for a local attacker with privileged access and a high-complexity attack to alter data. The exploit requires loc...
CVE-2026-48790
CVE-2026-48790 (turso-cli) : Versions prior to 1.0.26 store the Turso platform JWT in settings.json with world-readable permissions (0o644) due to Viper’s default configPermissions, enabling any local user on the host to read the file and exfiltrate the JWT, which grants full Turso platform acces...
CVE-2026-48790 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions
Turso CLI is the command line interface CLI to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any othe...
CVE-2026-73083
Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...
CVE-2026-70346
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-70355
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-70347
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-70348
Improper link resolution before file access 'link following' in Windows Management Services allows an authorized attacker to deny service locally...
CVE-2026-70340
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...