ROS-20260317-73-0031

A vulnerability in the cloneprivatemnt function of the Linux kernel is related to insecure privilege management. Exploitation of the vulnerability allows an intruder to affect the integrity and availability of protected information...

amdgpu_atom_execute_table_locked Heap Buffer Overflow DoS

The vulnerability of the amdgpuatomexecutetablelocked function in the drivers/gpu/drm/amd/amdgpu/atom.c driver of the Direct Rendering Infrastructure DRI AMD GPU kernel for the Linux operating system is related to state management errors. Exploiting this vulnerability could allow a remote attacke...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials due to insufficient policy enforcement in the Trusted Platform Module TPM during the disk decryption process. An attacker can gain unauthorized access to encrypted data by physically replacing the ro...

EUVD-2016-10813

ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrieve local resources. Attackers can manipulate path parameters to bypass access controls and retrieve sensitive information including...

Linux kernel __kernfs_remove() Heap Buffer Overflow DoS

The vulnerability of the kernfsremove function in the fs/kernfs/dir.c file of the Linux kernel file system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Grafana-cubism-panel Visualization Disclosure Modification

The vulnerability of the visualization plugin for the Grafana Panel platform, which is used for monitoring and observation, relates to the lack of protective measures for the website structure. Exploiting this vulnerability can allow a malicious actor to disclose and modify protected information...

PT-2026-25775

Name of the Vulnerable Software and Affected Versions FastMCP versions prior to 2.14.2 Description FastMCP, a framework for building MCP applications, does not properly validate the resource parameter submitted by the client during authorization and token requests. Instead of issuing tokens...

Linux kernel device driver Heap Buffer Overflow DoS

The vulnerability of the driverattach function in the drivers/base/dd.c file of the Linux kernel’s device driver framework is related to the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

PT-2026-25727

Name of the Vulnerable Software and Affected Versions ZKTeco ZKBioSecurity version 3.0 Description The software contains a file path manipulation issue that allows attackers to access arbitrary files by modifying file paths used to retrieve local resources. Attackers can manipulate path parameter...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization through the configWrites authorization. An attacker can modify protected configuration data of sibling accounts by issuing channel commands that target accounts with...

BIT-PARSE-2026-32098 Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0 and 8.6.35, an attacker can exploit LiveQuery subscriptions to infer the values of protected fields without directly receiving them. By subscribing with a WHERE clause that...

BIT-PARSE-2026-31872 Parse Server has a protected fields bypass via dot-notation in query and sort

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0 and 8.6.32, the protectedFields class-level permission CLP can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to quer...

BIT-GITLAB-2025-14513 Improper Validation of Specified Quantity in Input in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service condition due to improper input validation when processing specially crafted JSON...

PT-2026-29232

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11 Description A flaw exists in OpenClaw that allows authorized users on one account to bypass authorization restrictions and modify configuration settings on other accounts, even when those accounts have...

rtl8723bs OnBeacon() Unauthorized Access

The vulnerability of the OnBeacon function in the drivers/staging/rtl8723bs/core/rtwmlmeext.c module, which supports additional devices in the Linux operating system, is related to reading beyond the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to gain unauthoriz...

Azure IoT Explorer Plaintext Disclosure

The vulnerability of the Azure IoT Explorer software is related to the transmission of critical information in open text format. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

Windows GDI+ Disclosure

The vulnerability of the Windows GDI+ interface on Windows operating systems is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

Direct Rendering Infrastructure GPU Function Compromise

The vulnerability of the xevmbindiocl function in the drivers/gpu/drm/xe/xevm.c module of the Direct Rendering Infrastructure DRI driver for the Linux operating system is related to the reallocation of previously released memory. Exploiting this vulnerability could allow an attacker to compromise...

CVE-2026-32319 Ella Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

Ella Core is a 5G core designed for private networks. Prior to 1.5.1, Ella Core panics when processing a malformed integrity protected NGAP/NAS message with a length under 7 bytes. An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all...

BIT-PARSE-2026-30962 Parse Server has a protected fields bypass via logical query operators

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2 and 8.6.19, the validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical operator, the check is...