CVE-2022-22063

CVE-2022-22063 CVE-2022-22063 是某些较旧的高通芯片组中 hypervisor 固件的一个安全问题。未受保护的硬件组件（"启动重映射器"）可被滥用，从修改后的操作系统获得对 hypervisor 的完全读/写访问权限（权限提升）。在受影响的平台上利用该问题非常简单，因为不需要知道特定固件版本（例如地址或变量）的知识。 注意： 尽管高通已向客户提供了修复（有足够时间发布更新），但许多受影响的设备已经相当老旧，可能无法收到供应商的修复。该问题只能从修改过或已受损的操作系统（利用另一个安全问题）中利用。即使固件存在漏洞，保持操作系统更新和安全也可能足够。 概述 CV...

CVE-2021-25741

Acerca de Es un exploit para la vulnerabilidad CVE-2021-25741. Esta vulnerabilidad permite montar el sistema de archivos de Node dentro de un nuevo POD con privilegios de lectura y escritura. Puedes leer más sobre la vulnerabilidad aquí:...

CVE-2026-50181

CVE-2026-50181 Langroid 文件工具中的路径遍历漏洞允许在配置的当前目录之外进行读/写操作。 主要公告： GHSA-fg23-3346-88f5 GitHub 漏洞数据库： github.com/advisories/GHSA-fg23-3346-88f5 研究人员致谢： @chaitanyagarware 概览 字段| 值 ---|--- CVE| CVE-2026-50181 GHSA| GHSA-fg23-3346-88f5 项目| langroid/langroid 包| langroid 生态系统| pip 严重性| 高 CVSS|...

CVE-2026-58848

CVE-2026-58848 affects multiple functions in alloc.c within the Android kernel , where a race condition permits unauthorized read/write access. An attacker with local, low privileges can exploit this to achieve local escalation of privilege without user interaction. The vulnerability is rated CVS...

EUVD-2026-70530

ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of...

CVE-2026-19485

CVE-2026-19485 is a Predictable Resource Name (bucket squatting) vulnerability in BigQuery Import Staging within Google Cloud Vertex AI Search for Commerce on Google Cloud Platform, affecting versions prior to 2026-04-27 . An attacker knowing the victim's project number could derive the predictab...

EUVD-2026-66653

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

CVE-2026-15203

Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 suffer from improper access control in debug and engineering interfaces that are accessible by default. An unauthenticated, network-based attacker can read and write internal values , upload and execute unsigned applications , and upload u...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in qemu. A host privilege escalation issue was identified in the virtio-fs shared file system daemon, where a privileged guest user is able to create a device-specific special file in the shared directory and use it to gain read/write access to host devices...

CVE-2026-74641

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

UBUNTU-CVE-2026-74641

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

CVE-2026-74641

CVE-2026-74641 is a local privilege escalation / DoS flaw in the Linux kernel ALSA usx2y driver . The function snd_us428ctls_vm_fault() converts a page-fault offset into a kernel address without bounds-checking it against the single-page us428ctls_sharedmem region. Because file_mmap_size_max() re...

EUVD-2026-64578

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

PT-2026-71631

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A path confinement bypass allows remote clients to escape the intended inner-module root confinement. This occurs when the module root contains a /./ boundary marker, enabling the construction of paths...

CVE-2026-67568

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

CVE-2026-67568 Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

EUVD-2026-56847

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

CVE-2026-21279

is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction...

CVE-2026-25652 ColdFusion | Incorrect Authorization (CWE-863)

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction...

CVE-2026-25652

CVE-2026-25652 is an Incorrect Authorization vulnerability affecting Adobe ColdFusion (per APSB26-90). The issue allows a low-privileged attacker with local access to escalate privileges and perform unauthorized read and write actions. Exploitation does not require user interaction. The CVSS-like...