CVE-2026-47497

NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor GSP tracing component where a guest VM user may cause improper access by sending crafted data through a shared buffer. A successful exploit of this vulnerability might lead to code execution, escalation of privileges,...

CVE-2026-47498

NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor GSP plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC message. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering,...

CVE-2026-47497

NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor GSP tracing component where a guest VM user may cause improper access by sending crafted data through a shared buffer. A successful exploit of this vulnerability might lead to code execution, escalation of privileges,...

CVE-2026-47497

The NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor (GSP) tracing component . A guest VM user can cause improper access by sending crafted data through a shared buffer . Successful exploitation could lead to code execution , escalation of privileges , data tamperin...

EUVD-2026-90059

NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor GSP tracing component where a guest VM user may cause improper access by sending crafted data through a shared buffer. A successful exploit of this vulnerability might lead to code execution, escalation of privileges,...

CVE-2026-88920

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0...

CVE-2026-88920 Apache WSS4J: SAML Sender-Vouches Authentication Bypass

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0...

CVE-2026-97982

A flaw was found in the Cortina Ethernet driver in the Linux kernel. The driver incorrectly returns the remaining packet budget instead of the number of packets processed during receive polling. This miscalculation causes idle network polling routines to remain continuously scheduled, which can...

Security Bulletin: This Power System update is being released to address CVE-2026-96263

Summary Power Systems Firmware is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful...

Security Bulletin: This Power System update is being released to address CVE-2026-96264

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...

Security Bulletin: This Power System update is being released to address CVE-2026-96262

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...

Security Bulletin: This Power System update is being released to address CVE-2026-96265

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host...

AlmaLinux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1784135237)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784135237 advisory. - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8...

CVE-2026-88920: Improper Authentication

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0...

CVE-2023-34468-POC

CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Ejecución remota de código mediante RUNSCRIPT de la base de datos H2 en Apache NiFi = 1.21.0 Vulnerabilidad Apache NiFi incluye un JAR de la base de datos H2 de forma predeterminada. El servicio controlador DBCPConnectionPool puede configurarse para usa...

CLEANSTART-2026-QW68592 Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit

Security vulnerability affects the apache-hive package. A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit...

CVE-2026-98029

A flaw was found in the Linux kernel's Netronome Flow Processor NFP network driver. The driver fails to validate the user-provided buffer size when retrieving network flow steering rules. An unprivileged local user can exploit this vulnerability to trigger an out-of-bounds memory write or a null...

CVE-2026-98028

A flaw was found in the Linux kernel's Netronome Flow Processor NFP network driver. When replacing an existing flow steering rule fails during hardware reprogramming, the driver fails to remove the old rule from its internal list, creating an inconsistency with the active rule counter. A local us...

CVE-2026-93275

A flaw was found in the Linux kernel's Intel Processor Trace PT subsystem. A local user could trigger a Denial of Service DoS condition by executing performance monitoring operations that cause group event throttling. Due to improper state tracking during event start and stop operations, the...

WP2Shell-Scanner

WP2Shell Scanner A command line tool that checks whether a WordPress site is exposed to WP2Shell CVE-2026-63030 and CVE-2026-60137. It reads the WordPress version and REST API surface over read-only requests and reports a verdict. It does not exploit anything. !WARNING For authorised testing only...