CVE-2026-90890 ASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer Dereference

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to dereference an unvalidated pointer, resulting in an operating system crash...

CVE-2026-90890

This vulnerability affects the driver component of ASRock Polychrome SYNC/RGB software utility , a utility developed by ASRock Inc. for managing RGB lighting. The root cause is an Untrusted Pointer Dereference : an authenticated local attacker with low privileges can send a specially crafted IOCT...

PT-2026-91758

Name of the Vulnerable Software and Affected Versions DevSpace versions prior to 6.3.22 Description The software fails to reject parent-directory segments in tar entry names originating from the in-pod sync stream. This allows an attacker operating a malicious container to stream tar entries...

CVE-2026-90890: Untrusted Pointer Dereference

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to dereference an unvalidated pointer, resulting in an operating system crash...

CVE-2026-90891: Improper Restriction of Software Interfaces to Hardware Features

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to write to improperly restricted I/O ports, resulting in a forced operating system reboo...

PT-2026-91160

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to write to improperly restricted I/O ports, resulting in a forced operating system reboo...

CVE-2026-54542: Out-of-bounds Read

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds th...

CVE-2026-54541: Uncaught Exception

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify call...

CVE-2026-77161: Improper Neutralization of Special Elements used in an SQL Command

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-89558

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix stilldegraded being inverted in raid10syncrequest Commit fe6a19d40ceb "md/md-bitmap: merge mdbitmapstartsync into bitmapoperations" converted stilldegraded from int to bool, but inverted the assignment in the loop...

CVE-2026-89601

In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for ISSYNC inodes ext2setsize and ext2xattrset2 had a construct like: if ISSYNCinode syncinodemetadatainode, 1; else markinodedirtyinode; which leads to lost inode updates for ISSYNC inodes because...

EUVD-2026-76367

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040work requeues itself after every poll. canceldelayedwork only cancels a pending instance and does not wait for a callback that is already running. If syste...

SUSE CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

PT-2026-89893

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1 V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync server daemon on TCP port 13136. The daemon, which ru...

PT-2026-90317

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ext2 file system where inode updates may be lost for IS SYNC inodes. This occurs within the ext2 setsize and ext2 xattr set2 functions because sync inode metadata...

PT-2026-89894

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1 V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync server daemon on TCP port 13136. The daemon...

EUVD-2026-75173

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes...

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

GHSA-WJWR-XFP9-R66P Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the caching of user roles on active Socket.IO connections during SSO-driven role changes. An attacker can retain unauthorized read and write access to other users' private note...