CVE-2026-21015

CVE-2026-21015 : The issue concerns incorrect default permissions in the FactoryCamera prior to the SMR May-2026 Release 1, enabling a local attacker to access the device’s unique identifier. The CVSS v4.0 metrics indicate a LOCAL attack vector, LOW attack complexity, and LOW privilegesRequired, ...

SUSE CVE-2026-43295

In the Linux kernel, the following vulnerability has been resolved: rapidio: replace riofreenet with kfree in rioscanallocnet When idtab allocation fails, net is not registered with rioaddnet yet, so kfreenet is sufficient to release the memory. Set mport-net to NULL to avoid dangling pointer...

SUSE CVE-2026-43317

In the Linux kernel, the following vulnerability has been resolved: most: core: fix leak on early registration failure A recent commit fixed a resource leak on early registration failures but for some reason left out the first error path which still leaks the resources associated with the...

SUSE CVE-2026-43458

In the Linux kernel, the following vulnerability has been resolved: serial: caif: hold tty-link reference in ldiscopen and serrelease A reproducer triggers a KASAN slab-use-after-free in ptywriteroom when caifserial's TX path calls ttywriteroom. The faulting access is on tty-link-port. Hold an...

Zeek 8.0.8

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek ha...

Vulnerabilities in web browsers Firefox and Firefox ESR, as well as the Thunderbird email client, allow attackers to gain access to confidential data and compromise its integrity.

The vulnerabilities in web browsers Firefox and Firefox ESR, as well as the email client Thunderbird, are related to insufficient input data validation. Exploiting these vulnerabilities can allow an attacker to gain access to confidential data and compromise its integrity...

PT-2026-40573

Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity...

PT-2026-40568

Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier...

SAMSUNG Mobile devices 安全漏洞

Samsung Mobile devices are a series of mobile devices produced by South Korea’s Samsung Corporation, including smartphones and tablets. Versions of Samsung Mobile Devices prior to SMR May-2026 Release 1 contain security vulnerabilities. These vulnerabilities stem from improper input validation in...

SAMSUNG SMR 安全漏洞

SAMSUNG SMR is a system patch package developed by Samsung Electronics of South Korea. It provides patches for Samsung mobile applications. Versions prior to SAMSUNG SMR May-2026 Release 1 contained security vulnerabilities, which were caused by improper handling of insufficient permissions. Thes...

PT-2026-40569

Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information...

SAMSUNG SMR 安全漏洞

SAMSUNG SMR is a system patch package developed by Samsung Electronics of South Korea. It provides patches for Samsung mobile applications. Versions prior to SAMSUNG SMR May-2026 Release 1 contained security vulnerabilities. These vulnerabilities stemmed from improper export of Android applicatio...

SAMSUNG Mobile devices 安全漏洞

Samsung Mobile devices are a series of mobile devices produced by South Korea’s Samsung Corporation, including smartphones and tablets. Versions before Samsung Mobile Devices SMR May-2026 Release 1 contained security vulnerabilities. These vulnerabilities were due to improper permission allocatio...

PT-2026-40570

Name of the Vulnerable Software and Affected Versions SveService versions prior to SMR May-2026 Release 1 Description An out-of-bounds write exists in SveService, which occurs when a program writes data past the end of the intended buffer. This allows local privileged attackers to execute arbitra...

Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft

Our research examines the April 22 Checkmarx KICS and April 24 elementary-data incidents as part of a broader TeamPCP supply chain campaign. Across both cases, the actor abused trusted CI/CD and release workflows to steal credentials at scale...

yggdrasil security update

0.4.8-5 - Bump release for rebuild...

The vulnerability in the Firefox web browser, specifically the Firefox ESR web browser, allows a perpetrator to gain access to confidential data.

The vulnerability in the Firefox web browser, as well as in the Firefox ESR browser, is related to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...

PT-2026-40572

Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions...

DCVD: Dual-Channel Cross-Modal Fusion for Joint Vulnerability Detection and Localization

Software vulnerability detection plays a critical role in ensuring system security, where real-world auditing requires not only determining whether a function is vulnerable but also pinpointing the specific lines responsible. However, existing approaches either rely on a single information source...

CVE-2026-44547 ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2

ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release...