GHSA-4R2P-27MH-5M22 Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat Summary Open WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Pytho...

DEBIAN-CVE-2026-64233

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...

EUVD-2026-48642

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...

CVE-2026-10610

Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user...

CVE-2026-10610 Local privilege escalation in ESET security applications for macOS

Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user...

EUVD-2026-48558

Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user...

CVE-2026-10610

CVE-2026-10610 affects ESET security applications for macOS. It is a Local Privilege Escalation that could allow a low-privileged user to execute arbitrary code with elevated privileges. Exploitation would be LOCAL with LOW complexity and no user interaction required; the impact targets confident...

CVE-2026-10610

Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user...

CVE-2026-7483

Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...

CVE-2026-7483 Local privilege escalation in ESET security applications for macOS

Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...

EUVD-2026-48551

Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...

CVE-2026-7483

CVE-2026-7483 describes a local privilege escalation in ESET security applications for macOS that potentially allows a low-privilege attacker to write an arbitrary file with content under a privileged user. The initial and connected documents state the impact as high on confidentiality, integrity...

CVE-2026-7483

Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...

EUVD-2026-48532

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlyin...

CVE-2026-49743 GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlyin...

PT-2026-64425

Name of the Vulnerable Software and Affected Versions Weintek cMT3092X affected versions not specified Description An incorrect permission assignment for critical resources in the Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges. Recommendations At the...

PT-2026-64264

Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlyin...

PT-2026-64274

Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...

PT-2026-64422

Name of the Vulnerable Software and Affected Versions Weintek cMT3092X affected versions not specified Description The Weintek cMT3092X HMI contains a flaw where it relies on cookies without proper validation and integrity checking during security decisions. This allows a non-privileged user to...

CVE-2026-47755

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal wit...