CVE-2026-101145

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The...

CVE-2026-97025

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

CVE-2026-97026 Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

EUVD-2026-88553

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

CVE-2026-97025 Flatpak: flatpak: world-readable oci authentication token in system-helper cache path

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

CVE-2026-97026

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

CVE-2026-97025

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

EUVD-2026-88480

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The...

CVE-2026-101145 Eleveo Call Recording Software User Management userAddAction.do ldap injection

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The...

CVE-2026-101145 Eleveo Call Recording Software User Management userAddAction.do ldap injection

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The...

CVE-2026-101145

A vulnerability exists in Eleveo Call Recording Software 9.7.0 within the User Management component. Specifically, the file /callrec/userAddAction.do is susceptible to ldap injection due to the improper handling of the Username argument. This flaw can be exploited remotely . An exploit is publicl...

CVE-2026-98010

A flaw was found in the Linux kernel's Deficit Round Robin DRR network packet scheduler. This vulnerability allows a local user with network administration privileges to cause a Denial of Service DoS by configuring a traffic class with an unconstrained low quantum value. When processed with large...

CVE-2026-98009

A flaw was found in the Linux kernel's Enhanced Transmission Selection ETS network scheduler. A local user with network administration privileges, including an unprivileged user inside a user namespace, can configure traffic control queue disciplines with invalid or unconstrained quantum...

CVE-2026-98013

A flaw was found in the Linux kernel. A local user with network administration privileges, including within a user namespace, can cause a Denial of Service DoS by configuring the Flow Queue Proportional Integral controller Enhanced FQ-PIE packet scheduler with an excessively low quantum value and...

CVE-2026-18414

The ADI MAX32 ADC driver contains an out-of-bounds write vulnerability due to incorrect buffer size validation in drivers/adc/adc_max32.c. The start_read() function fails to account for sizeof(uint16_t) when comparing the buffer size against the sample count, allowing buffers that are half the re...

CVE-2026-18413 Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation

The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffersize field of struct adcsequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must return an error if the...

Exploit for External Control of File Name or Path in Nomachine

CVE-2026-5053 Abusing a vulnerability on affected installatio...

CVE-2026-98007

A flaw was found in the Linux kernel. A privileged local user can cause a Denial of Service DoS by loading a specially crafted BPF Berkeley Packet Filter program that passes a pointer value instead of a scalar number as the loop iteration count to the bpfloop function. Because the kernel's BPF...

CVE-2026-55157

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

CVE-2026-54674

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...