CVE-2025-33254: Concurrent Execution using Shared Resource with Improper Synchronization

NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this vulnerability may lead to a denial of service...

PT-2026-27597

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.4 iPadOS versions prior to 26.4 macOS Sequoia versions prior to 15.7.5 macOS Tahoe versions prior to 26.4 visionOS versions prior to 26.4 watchOS versions prior to 26.4 Description An authorization issue existed due to...

PT-2026-27503

NVIDIA B300 MCU contains a vulnerability in the CX8 MCU that could allow a malicious actor to modify unsupported registries, causing a bad state. A successful exploit of this vulnerability might lead to denial of service and data tampering...

The vulnerability of the skb_frag_ref() function in the include/linux/skbuff.h module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the skbfragref function in the include/linux/skbuff.h header of the Linux kernel is related to state management errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the __restore_v_state() function in the arch/riscv/kernel/signal.c module of the Linux operating system’s RISC-V architecture-based kernel subsystem allows a attacker to cause a service failure.

The vulnerability of the restorevstate function in the arch/riscv/kernel/signal.c module of the Linux operating system’s RISC-V architecture kernel subsystem is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-27584

Name of the Vulnerable Software and Affected Versions Safari versions prior to 26.4 iOS versions prior to 18.7.7 iPadOS versions prior to 18.7.7 macOS Tahoe versions prior to 26.4 visionOS versions prior to 26.4 Description A logic issue exists due to improved state management. A malicious websit...

PT-2026-27536

Name of the Vulnerable Software and Affected Versions Safari versions prior to 26.4 iOS versions prior to 18.7.7 iPadOS versions prior to 18.7.7 macOS Tahoe versions prior to 26.4 tvOS versions prior to 26.4 visionOS versions prior to 26.4 watchOS versions prior to 26.4 Description The issue...

NVIDIA Triton Inference Server 竞争条件问题漏洞

NVIDIA Triton Inference Server is an open-source software developed by NVIDIA Corporation. It helps standardize model deployment and provide fast, scalable AI in production environments. NVIDIA Triton Inference Server has a vulnerability known as a race condition issue, which can lead to internal...

PT-2026-27604

Name of the Vulnerable Software and Affected Versions macOS versions prior to 15.7.5 macOS versions prior to 14.8.5 macOS versions prior to 26.4 Description A race condition existed due to improper state handling, potentially allowing an application to gain root privileges. There is no informatio...

PT-2026-27554

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.5 macOS Sonoma versions prior to 14.8.5 macOS Tahoe versions prior to 26.4 Description A race condition existed due to improper state handling. This allowed a sandboxed process to potentially bypass sandbox...

PT-2026-27566

Name of the Vulnerable Software and Affected Versions macOS versions prior to Sequoia 15.7.5 macOS versions prior to Sonoma 14.8.5 macOS versions prior to Tahoe 26.4 Description An authorization issue was resolved through improved state management. An application could potentially access sensitiv...

PT-2026-27569

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.5 macOS Sonoma versions prior to 14.8.5 macOS Tahoe versions prior to 26.4 Description A race condition existed due to improper state handling. This could allow an application to cause unexpected system...

PT-2026-27464

Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest users can access Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions regenerate-yaml, apply-yaml-chang...

CVE-2026-33159: Missing Authentication for Critical Function

Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, guest users can access Config Sync updater index, obtain signed data, and execute state-changing Config Sync actions regenerate-yaml, apply-yaml-chang...

JLSEC-2026-5 nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2sessionterminatesession or nghttp2sessionterminatesession2 is called by the application. They might be...

GO-2026-4734 Mattermost fails to preserve the redacted state of burn-on-read posts during deletion in github.com/mattermost/mattermost-server

Mattermost fails to preserve the redacted state of burn-on-read posts during deletion in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2026-31849

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools and other administrative interfaces. As a result, an attacker can craft malicious web requests that are executed in the context of an...

CVE-2026-31849 Missing CSRF Protection on Administrative Endpoints in Nexxt Nebula 300+

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing endpoints such as /goform/setSysTools and other administrative interfaces. As a result, an attacker can craft malicious web requests that are executed in the context of an...

EUVD-2026-14382

The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flushing is done, and...

ROS-20260323-73-0027

A vulnerability in the tmptcp components of the Linux operating system kernel is related to state management errors. Exploitation of the vulnerability allows an attacker to gain access to sensitive data, compromise its integrity, and cause denial of service...