CVE-2026-30905: External Control of File Name or Path

External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access...

CVE-2026-36738

U-SPEED AC1200 Gigabit Wi-Fi Router Model: T18-21K V1.0 is vulnerable to Incorrect Access Control. The device exposes a UART interface that lacks authentication, authorization, or access control mechanisms. An attacker with physical access to the UART pins can connect to the interface and gain...

Improper Memory Buffer Handling

uuid is vulnerable to Improper Memory Buffer Handling. The vulnerability is due to missing validation of buffer size and offset values during UUID generation, which allows an attacker to trigger silent partial writes into caller-provided buffers...

PT-2026-40033

A Stored Cross-Site Scripting XSS vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authenticated administrator to upload crafted SVG files containing malicious JavaScript code. Once uploaded, the script executes in the browser of any user who...

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: "Dirty Frag" is a new universal Local Privilege Escalation LPE vulnerability in the Linux kernel CVE-2026-43284 For more details about the security issues, including the impact, a CVSS...

Apple macOS USD Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. Interaction with the USD library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the USD...

Apple macOS USD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. Interaction with the USD library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the USD library. T...

CVE-2026-34961

barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the ehentries field against buffer capacity in fs/ext4/ext4common.c. Attackers can supply a malicious ext4 filesystem image via USB, SD card, or network boot to trigg...

CVE-2026-8153

OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to craft commands that will execute code on the robot's OS...

Important: Red Hat Security Advisory: Red Hat Ceph Storage

A new version of Red Hat build of Ceph Storage has been released The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 8.1. This release updates to the latest version...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: aspell (UTSA-2026-017600)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017600 advisory. libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the...

CVE-2026-8177

creationtimestamp| type| source ---|---|--- 2026-05-10 23:10:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mljuyplz5e2o 2026-05-10 23:51:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mljxawslek2b 2026-05-11 15:47:14+00:00| seen|...

PT-2026-44684

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.216 Description An inappropriate implementation in the USB component allows a remote attacker to execute arbitrary code through the use of a crafted HTML page. Recommendations Update to version...

SUSE CVE-2026-43259

In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: set platform driver data Add missing platformsetdrvdata as the data will be used in remove...

SUSE CVE-2026-43279

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received packets fit with the buffer size. But whe...

CVE-2026-43436

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB-audio driver, specifically within the Scarlett2 mixer quirk. A local attacker could exploit this vulnerability by providing a specially crafted, malformed USB descriptor. This could lead to a NULL dereference in the...

CVE-2026-43428

A flaw was found in the Linux kernel's USB core. The usbcontrolmsg, usbbulkmsg, and usbinterruptmsg APIs allow for unlimited timeout durations. These APIs use uninterruptible waits, which can cause a task to hang indefinitely. This can lead to a denial of service DoS as the task cannot be...

CVE-2026-43427

A flaw was found in the Linux kernel's USB CDC WDM driver. Due to compiler optimizations or CPU out-of-order execution, a memory reordering issue can occur during the read operation. This can lead to the driver accessing uninitialized memory, potentially resulting in information disclosure to a...

CVE-2026-43415

A flaw was found in the Linux kernel's Universal Flash Storage UFS host controller driver scsi: ufs: core. A race condition exists during the UFS suspend process, where a timing issue can cause critical operations to execute out of sequence. This can lead to an Asynchronous SError Interrupt and a...

CVE-2026-43375

A flaw was found in the Linux kernel's MCTP Message Control Transport Protocol implementation. During device probe failures, a redundant reference to a USB device is not properly released. This can lead to memory leaks, potentially resulting in a Denial of Service DoS condition on the affected...