295838 matches found
[R1] Tenable Identity Exposure Version 3.126.0 (SaaS) Fixes One Vulnerability
R1 Tenable Identity Exposure Version 3.126.0 SaaS Fixes One Vulnerability Arnie Cabral Thu, 10/08/2026 - 12:34 A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure SaaS allows an authenticated, low-privileged attacker to execute arbitrary commands...
EUVD-2026-95100
Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the...
Malware in @design-system-coopeuch/web
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
kernel: igc: set tx buffer type for SMD frames
A flaw was found in the Linux kernel's igc network driver. The igcfpeinitsmdframe function, responsible for initializing transmit TX buffer fields for Stream-based Data SMD frames, does not correctly set the buffer type. This can result in stale XDP eXpress Data Path or XSK AFXDP socket types...
kernel: nfsd: revoke copy-notify stateids before dropping their reference
A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading t...
kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup
A flaw was found in the Linux kernel's Network File System Daemon NFSD. The nfsd4decodesecinfononame function does not properly initialize a pointer sinexp before processing an incoming data stream. If the data stream is malformed or truncated, the uninitialized pointer can retain stale data from...
kernel: igc: set tx buffer type for SMD frames
A flaw was found in the Linux kernel's igc network driver. The igcfpeinitsmdframe function, responsible for initializing transmit TX buffer fields for Stream-based Data SMD frames, does not correctly set the buffer type. This can result in stale XDP eXpress Data Path or XSK AFXDP socket types...
kernel: nfsd: revoke copy-notify stateids before dropping their reference
A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading t...
kernel: nfsd: fix UAF in async copy cancel and shutdown
A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free UAF vulnerability. This allows an async copy object to be freed or used after being freed, potentially causing memory...
Security Bulletin: Security vulnerability affects the Windows S-TAP component as part of IBM Guardium Data Protection (CVE-2026-84290)
Summary Security vulnerability has been addressed in Windows S-TAP component as part of IBM Guardium Data Protection Vulnerability Details CVEID:CVE-2026-84290 DESCRIPTION: IBM Security Guardium Data Protection is affected by an improper validation of user-supplied pointers in the WfpMonitor kern...
CVE-2026-98177
A flaw was found in the Linux kernel's AMD GPU driver amdkfd. A local user could trigger a Denial of Service DoS or system instability due to an integer underflow vulnerability during the calculation of the End of Pipe EOP ring buffer size. Under specific conditions, this improper calculation cou...
Security Bulletin: Multiple Vulnerabilities affect IBM Cloud Pak System
Summary Multiple Vulnerabilities have been addressed in IBM Cloud Pak System v2.3.5.1. Vulnerability Details CVEID:CVE-2025-69873 DESCRIPTION: ajv Another JSON Schema Validator before 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern...
libX11: libX11: Denial of Service via out-of-bounds read in byte-oriented codeset parser
A flaw was found in libX11. An out-of-bounds read vulnerability in the byte-oriented codeset parser allows a malicious X Window System server to cause a Denial of Service DoS by crashing connected client applications. This issue may also allow the server to access limited memory contents from the...
Malware in system-driver
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in system-driver (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5e4a0cbbe434f312002efedefa09d6d1ad79d13300812d7b43e1302fd6e562 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17685 Malicious code in system-driver (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5e4a0cbbe434f312002efedefa09d6d1ad79d13300812d7b43e1302fd6e562 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-98369
A flaw was found in the Linux kernel's IPsec xfrm subsystem. This flaw can lead to a Denial of Service DoS due to missing synchronization locks and device references when reinjecting transport-mode network packets through workqueues. A remote attacker could exploit this vulnerability by sending...
CVE-2026-107615
An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init and ThemeLib load screenhooks32.dll / screenhooks64.dll with LoadLibrary using a bare fi...
WordPress Wallet System for WooCommerce plugin < 2.8.0 - Subscriber+ Wallet Balance Manipulation vulnerability
Subscriber+ Wallet Balance Manipulation vulnerability discovered by Stefan Löwen CODE WHITE GmbH in WordPress Plugin Wallet System for WooCommerce versions 2.8.0...
Security Bulletin: Due to use of IBM WebSphere Application Server - Liberty, Cloud Pak System is affected by vulnerability [CVE-2025-14923]
Summary Due to use of IBM WebSphere Application Server - Liberty, Cloud Pak System is affected by vulnerability. This vulnerability was addressed in IBM Cloud Pak System v2.3.5.1. Vulnerability Details CVEID:CVE-2025-14923 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through...