Lucene search
+L

11972 matches found

CVE
CVE
added 2026/08/10 12:00 p.m.74 views

CVE-2026-68205

The CVE-2026-68205 details a Linux kernel issue in media: v4l2-fwnode where v4l2_async_register_subdev_sensor() could overwrite the sensor driver’s owner with NULL due to THIS_MODULE resolving to the v4l2-fwnode module (or NULL when built-in). This prevented the sensor module’s reference count fr...

5.3AI score0.00215EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/08/10 12:00 p.m.11 views

EUVD-2026-55304

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

5.4AI score0.00209EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/10 11:59 a.m.34 views

CVE-2026-68166 userfaultfd: prevent registration of special VMAs

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with...

5.4AI score
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/10 11:59 a.m.37 views

CVE-2026-68162 sctp: avoid auth_enable sysctl UAF during netns teardown

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

7.8CVSS0.00184EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/08/10 11:58 a.m.12 views

EUVD-2026-55515

In the Linux kernel, the following vulnerability has been resolved: ptp: ptps390: Add missing facility check Only register the physical clock when facility 28 is installed and PTFF QAF returns that PTFF QPT is available...

5.1AI score0.00129EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/10 11:58 a.m.12 views

EUVD-2026-55476

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

5.3AI score0.00166EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/10 11:58 a.m.70 views

CVE-2026-68095

The CVE-2026-68095 entry affects Linux kernel fuse-uring, describing a race between registration and connection abortion that could leak the ring, queue, and ent if not properly synchronized. The concrete fix is to check fch->connected under fch->lock after the created ent has grabbed a ref...

5.3AI score0.00166EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/08/10 12:00 a.m.13 views

Linux Distros Unpatched Vulnerability : CVE-2026-68166

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can...

5.9AI score0.002EPSS
SaveExploits0References2
SUSE CVE
SUSE CVE
added 2026/08/06 11:55 p.m.11 views

SUSE CVE-2026-64589

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix NULL-deref on adapter registration failure If adapter registration ever fails the release callback would trigger a NULL-pointer dereference as the completion struct has not been initialised. Note that before the...

4.4CVSS5.4AI score0.00156EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/06 10:17 p.m.13 views

CVE-2026-48087

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

9.8CVSS0.00457EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/06 10:16 p.m.12 views

CVE-2026-15208

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore...

5.3CVSS0.00125EPSS
SaveExploits0References1
Github Security Blog
Github Security Blog
added 2026/08/06 9:42 p.m.20 views

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

ChartsController::actionGetNewUsersData at /actions/charts/get-new-users-data is missing a requirePermission'viewUsers' authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts f...

5.3CVSS5.5AI score0.00385EPSS
SaveExploits0References9Affected Software1
OSV
OSV
added 2026/08/06 9:42 p.m.10 views

GHSA-RVMM-V933-JGXQ Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

ChartsController::actionGetNewUsersData at /actions/charts/get-new-users-data is missing a requirePermission'viewUsers' authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts f...

5.3CVSS5.5AI score0.00385EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/08/06 9:32 p.m.36 views

CVE-2026-48087 OpenReception: WebAuthn passkey injection allows account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

9.8CVSS0.00457EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/06 9:32 p.m.75 views

CVE-2026-48087

OpenReception’s appointment booking software (before v1.0.2) is vulnerable in the /api/auth/register/{userId} flow. The handler validates the WebAuthn challenge against the registration cookie’s email but does not verify that the URL’s userId belongs to that email. An unauthenticated attacker can...

9.8CVSS5.5AI score0.00457EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/06 9:32 p.m.33 views

CVE-2026-48087 OpenReception: WebAuthn passkey injection allows account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

9.8CVSS5.5AI score
SaveExploits0References4
NVD
NVD
added 2026/08/06 12:16 p.m.21 views

CVE-2026-61466

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...

9.1CVSS0.00424EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/08/06 12:10 p.m.15 views

CVE-2026-70556 Hubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration

Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a...

5.1CVSS5.3AI score0.00128EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/06 12:10 p.m.60 views

CVE-2026-70556

Hubzilla 11.2.1 contains a CSRF vulnerability in the OAuth2 /authorize endpoint (Zotlabs\Module\Authorize::post()) that lets unauthenticated attackers silently register arbitrary OAuth2 applications under a victim’s authenticated account by submitting a cross-origin POST without CSRF token or Ori...

5.1CVSS5.3AI score0.00128EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/06 11:24 a.m.130 views

CVE-2026-61466

CVE-2026-61466 affects Apache CXF’s OAuth2 Dynamic Client Registration endpoint. The authorization server stores the scope provided in a client registration request verbatim without validating it against an allowlist, enabling a client to self-assign privileged scopes at registration time. This c...

9.1CVSS5.4AI score0.00424EPSS
SaveExploits0References2Affected Software1
Rows per page
Query Builder