28729 matches found
CVE-2026-82918: Improper Restriction of XML External Entity Reference
XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where XG VisionTerminal or XG-X VisionTerminal is installed may be disclos...
PT-2026-85120
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
AI-Assisted Design of a Post-Quantum Cryptographic Accelerator: A Deployed-Silicon Case Study
Post-quantum migration is mandated on published timelines, and silicon that ships with a defect cannot be patched remotely. The standard acceptance gate cannot detect an entire class of ML-DSA defects. Signing resamples until a candidate meets its norm bounds, so the executed path varies with the...
The vulnerability of the p2pmem_alloc_mmap() function in the drivers/pci/p2pdma.c module of the Linux operating system’s PCI device driver allows a hacker to cause a service failure.
The vulnerability of the p2pmemallocmmap function in the drivers/pci/p2pdma.c module of the Linux operating system’s PCI device driver is related to errors during the update of the reference counter. Exploiting this vulnerability could allow an attacker to cause a service failure...
Unity Linux 20.1070a Security Update: kernel (UTSA-2026-105460)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105460 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: route: Prevent rtbindexception from rebinding stale fnhe The sit driver's packet transmissi...
MINI-HFRV-MCMW-96XX
Bulletin has no description...
EUVD-2026-69222
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization...
EUVD-2026-62659
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref...
kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs
A flaw was found in the Linux kernel's Generic Receive Offload GRO networking subsystem. This vulnerability occurs when skbgroreceive attempts to merge zerocopy socket buffers skbs without properly managing page reference counts, specifically when the SKBFLMANAGEDFRAGREFS flag is set. An attacker...
kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs
A flaw was found in the Linux kernel's Generic Receive Offload GRO networking subsystem. This vulnerability occurs when skbgroreceive attempts to merge zerocopy socket buffers skbs without properly managing page reference counts, specifically when the SKBFLMANAGEDFRAGREFS flag is set. An attacker...
CVE-2026-84771
Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...
CVE-2026-84771
This unauthenticated IDOR vulnerability affects the WordPress PublishPress Permissions plugin in versions 4.8.3 and earlier . Discovered by Brobicho and assigned by Patchstack , it allows a remote attacker with no privileges to access resources they should not, resulting in a low confidentiality ...
EUVD-2026-69939
Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...
WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Brobicho in WordPress Plugin PublishPress Permissions versions = 4.8.3...
EUVD-2026-69851
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...
EUVD-2026-69847
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...
CVE-2026-77787 Rank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...
MINI-RPW8-MR54-6J4X
Bulletin has no description...
SUSE CVE-2026-83610
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...
