18840 matches found
CVE-2026-64104
A flaw was found in the Linux kernel's SEV-ES Secure Encrypted Virtualization-Encrypted State guest module. When memory encryption or decryption operations fail, the affected memory pages can be left in an unknown or unencrypted state. This could lead to information disclosure, as these pages are...
CVE-2026-64152
A flaw was found in the Linux kernel's Input/Output Memory Management Unit IOMMU subsystem when iommudebug is enabled. This issue occurs because an error handling path attempts to unmap memory without a proper initial mapping, leading to an inconsistent state within the IOMMU's debugging and...
CVE-2026-64205
A flaw was found in the Linux kernel's i2c-i801 driver. This vulnerability allows a local attacker to trigger a hardware state machine corruption during error handling. This can lead to a denial of service DoS, where the system becomes unresponsive due to a continuous stream of error messages and...
CVE-2026-50759
An issue in exo-explore exo version 1.0.69 allows a remote attacker to escalate privileges without authentication. The vulnerability is triggered via the GET /state and DELETE /instance/{instance_id} endpoints, where the lack of authentication allows for unauthorized access. While the impact is s...
CVE-2026-50759
An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...
CVE-2026-52470
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file...
PT-2026-61983
Name of the Vulnerable Software and Affected Versions BuildKit affected versions not specified Description A custom client with valid permissions to access the BuildKit control API can send a specially crafted upload request to the BuildKit daemon. This allows files to escape from the...
PT-2026-62085
Name of the Vulnerable Software and Affected Versions exo-explore exo version 1.0.69 Description An issue allows a remote attacker to escalate privileges without authentication. This is possible through the 'GET /state' and 'DELETE /instance/instance id' endpoints, where instance id is a variable...
CVE-2026-50759
An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...
ALSA-2026:42919 Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: Linux kernel: Denial of Service due to memory leak in tpm2loadcmd CVE-2025-71147 kernel:...
The vulnerability of the pci_endpoint_test_msi_irq() function in the drivers/misc/pci_endpoint_test.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the pciendpointtestmsiirq function in the drivers/misc/pciendpointtest.c module of the Linux kernel is related to state management errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...
CVE-2026-50759
An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...
PT-2026-62087
Name of the Vulnerable Software and Affected Versions Crocus version 1.3.44 Description A SQL injection flaw allows a remote attacker to escalate privileges. This issue occurs through the RecordStateMapper.xml file. SQL injection is a technique where malicious SQL statements are inserted into ent...
CVE-2026-63768
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...
webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data
A flaw was found in WebKitGTK. A malicious website can silently hijack clipboard data due to improper state management...
CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...
CVE-2026-63768
CVE-2026-63768 affects cal.diy up to version 6.2.0. The issue is an open redirect in the conferencing OAuth callback endpoint triggered by crafting malicious state parameters, exploiting an unsigned state parameter and the onErrorReturnTo field to silently redirect users from the trusted domain t...
CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...
EUVD-2026-46073
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...
CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...