CVE-2026-34460

NamelessMC (Minecraft server website software) is affected in versions up to 2.2.4 where the OAuth callback handling does not validate the state parameter server‑side before exchanging the authorization code. This can let an attacker capture a valid OAuth callback URL for their own account and ca...

CVE-2026-34460 NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping

NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause ...

CVE-2026-34460: Authentication Bypass by Assumed-Immutable Data

NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: drm/i915/ttm: fixed handling of CCS Crucible + recent Mesa sometimes causes the following issue: GEMBUGONnumccsblks NUMCCSBLKSPERXFER It seems that this issue can also be triggered with gemlmemswapping, if we modify the tests ...

Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

Summary A race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This advisory covers the race during mountpoint creation. The related race during the subsequent mount syscall is tracked in...

CVE-2025-62625

Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthorized access to privileged resources and loss of confidentiality...

EUVD-2025-209846

Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthorized access to privileged resources and loss of confidentiality...

CVE-2025-62625

Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthorized access to privileged resources and loss of confidentiality...

CVE-2025-62625

Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthorized access to privileged resources and loss of confidentiality...

PT-2026-40939

Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthorized access to privileged resources and loss of confidentiality...

The vulnerability of the Windows operating system’s kernel, which allows a hacker to increase their privileges

The vulnerability of the Windows operating system’s kernel is related to the swapping of an untrusted pointer. Exploiting this vulnerability can allow an attacker to increase their privileges...

AMD Device Management Portal Key Download

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Score ---|---|--- CVE-2025-62619| Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retrieve sensitive keys, potentially leading to...

The vulnerability in the DevVGA_VBVA.cpp script of the Core component in the Oracle VM VirtualBox virtual machine allows a hacker to trigger a service failure.

The vulnerability in the DevVGAVBVA.cpp script of the Core component in the Oracle VM VirtualBox virtual machine is related to a numerical overflow resulting from pointer swapping. Exploiting this vulnerability can allow an attacker to cause a system failure...

The vulnerability of the Suricata intrusion detection and prevention system, related to the swapping of pointers, allows an intruder to trigger a service failure.

The vulnerability of the Suricata intrusion detection and prevention system is related to the handling of pointers. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service interruptions...

The vulnerability of the md_endFlush() function in Linux operating systems allows a attacker to compromise the accessibility of protected information.

The vulnerability of the mdendFlush function in Linux operating systems is related to the swapping of pointers. Exploiting this vulnerability can allow an attacker to compromise the accessibility of protected information...

The vulnerability of the Linux operating system’s kernel, related to the swapping of the zero pointer, allows a hacker to trigger a service failure.

The vulnerability of the Linux operating system’s kernel is related to a pointer arithmetic error. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-35359

A Time-of-Check to Time-of-Use TOCTOU vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the ONOFOLLOW flag. An attacker with...

The vulnerability of the `move_pages_huge_pmd()` function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the movepageshugepmd function in the Linux operating system is related to the swapping of pointers. Exploiting this vulnerability could allow an attacker to trigger a service failure...

ID-Eraser: Proactive Defense against Face Swapping Via Identity Perturbation

Deepfake technologies have rapidly advanced with modern generative AI, and face swapping in particular poses serious threats to privacy and digital security. Existing proactive defenses mostly rely on pixel-level perturbations, which are ineffective against contemporary swapping models that extra...

AZL-83363 CVE-2026-31467 affecting package kernel for versions less than 6.6.134.1-2

In the Linux kernel, the following vulnerability has been resolved: erofs: add GFPNOIO in the bio completion if needed The bio completion path in the process context e.g. dm-verity will directly call into decompression rather than trigger another workqueue context for minimal scheduling latencies...