kernel: iio: event: Fix event FIFO reset race

A flaw was found in the Linux kernel's Industrial I/O IIO event subsystem. A local user can exploit a race condition during the reset of the event FIFO First-In, First-Out buffer. This occurs when another thread accesses a newly allocated file descriptor before the FIFO reset is complete. This ca...

CVE-2026-21061

Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...

CVE-2026-57279

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...

CVE-2026-21081

CVE-2026-21081 describes an issue in SamsungPassAutofill (Android) where improper export of components allows a local attacker to access sensitive information. The vulnerability requires user interaction to trigger and affects versions prior to 5.2.10.x. According to the provided metrics, the CVS...

CVE-2026-21081

Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability...

EUVD-2026-55106

Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability...

CVE-2026-21081

Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability...

EUVD-2026-55086

Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...

CVE-2026-21061

Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...

CVE-2026-21061

CVE-2026-21061 concerns the Samsung Dialer, with improper input validation prior to SMR Aug-2026 Release 1. The vulnerability potentially allows remote attackers to access SIM-related functions, but user interaction is required to trigger it. According to the provided metrics, the CVSS base score...

CVE-2026-21061

Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...

CVE-2026-21060

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles...

CVE-2026-21060

Samsung Contacts shows an improper input validation vulnerability in the app prior to SMR Aug-2026 Release 1, enabling a physical attacker to access data across multiple user profiles. The issue affects Samsung Contacts on affected devices and has a CVSS 4.0 vector with a base score of 6.7 (Mediu...

CVE-2026-18960

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

CVE-2026-17541

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

CVE-2026-17540

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

Astra Linux – Vulnerability in PostgresSQL-15

A heap buffer overflow in PostgreSQL’s pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions prior to PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu – added a bounds check in the putuser loop for DSP events. In the DSP event handling code, the putuser loop copies event data. When the user buffer size is not aligned to 4 bytes, it may overwrite data beyond...

Astra Linux – Vulnerability in WebKit2GTK

This issue was addressed through improved state management. This issue is fixed in Safari 26.3, iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, and visionOS 26.3. A website may be able to track users through Safari web extensions...