ROS-20260923-73-0020

The vulnerability of the matchpolicyin function in the net/netfilter/xtpolicy.c module of the netfilter component of the Linux operating system is related to an incorrect order of authentication checks before syntactic analysis and canonization. Exploiting this vulnerability could allow a remote...

ROS-20260923-73-0011

The vulnerabilities of the functions nvmettcpbuildpduiovec and nvmettcphandlereqfailure in the driver/nvme/target/tcp.c module of the Linux kernel are related to error handling flaws. Exploiting these vulnerabilities allows a remote attacker to compromise the confidentiality, integrity, and...

PyPart Set Deep Slice Data Unauthorized Access

The vulnerability of the PyPart::setDeepSliceData function in software for storing OpenEXR images with a wide dynamic range of brightness levels is related to the use of uninitialized variables. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access t...

Linux Distros Unpatched Vulnerability : CVE-2026-91735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execu...

CVE-2026-96551: Cross-Site Request Forgery (CSRF)

A vulnerability was determined in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/CommonUserController.java. Executing a manipulation can lead to cross-site request forgery. The attack can be...

CVE-2026-96550: Cleartext Transmission of Sensitive Information

A vulnerability was found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssmpro/src/main/java/cn/sfturing/utils/MailUtil.java. Performing a manipulation results in cleartext transmission of sensitive information. The...

CVE-2026-96548: Use of Hard-coded Credentials

A flaw has been found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssmpro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity ...

CVE-2026-94183: User Interface (UI) Misrepresentation of Critical Information

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar,...

CVE-2026-84486: Active Debug Code

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user including unauthenticated clients and are routed in production builds because their URL include i...

CVE-2026-95843: Improper Input Validation

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/shareName/topicFilter structure. A remote client can send a filter such as $share/grp withou...

CVE-2026-19179: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression...

CVE-2026-18181: Use of Hard-coded Cryptographic Key

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key...

CVE-2026-96513: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

CVE-2026-3626: Generation of Error Message Containing Sensitive Information

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2026-18185: Missing Authentication for Critical Function

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

CVE-2026-92164: External Control of File Name or Path

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

CVE-2026-96258: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is...

CVE-2026-96257: Stack-based Buffer Overflow

A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copymsgelement of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and...

CVE-2026-95957: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file studentsignup.php of the component Self-Registration. Performing a manipulation of the argument fullname results in cross site scripting. Remote...

CVE-2026-95930: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...