CVE-2026-97423

The Linux kernel contains a vulnerability in the cxl/region component where the construct_region() function fails to validate the cxled->part value before using it as an index for the cxlds->part[] array. If a partition is never resolved, the value remains at -1 , leading to an out-of-bound...

EUVD-2026-86188

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong value if they are not set later...

EUVD-2026-44813

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding...

DRUPAL-CONTRIB-2026-170

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Forms may be displayed in blocks. Webform does not sufficiently validate an optional token query...

EUVD-2026-85122

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges...

EUVD-2026-85041

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...

PT-2026-97575

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An issue exists where the match value/3 function passes a...

ROS-20260923-73-0019

The vulnerability of the batadvdatforwarddata function in the net/batman-adv/distributed-arp-table.c module, which is part of the networking functions of the Linux kernel, stems from the lack of checking the return value. Exploiting this vulnerability could allow a remote attacker to cause a...

CVE-2026-95625: Improper Validation of Integrity Check Value

The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the on...

PT-2026-97657

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform module fails to sufficiently validate an optional token query value. In specific configurations where a form is rendered for anonymous visitors, a malicious request...

Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Forms may be displayed in blocks. Webform does not sufficiently validate an optional token query...

ROS-20260923-73-0089

The vulnerability of the pinmuxfuncnametoselector function in the drivers/pinctrl/pinmux.c file, a driver for LINUX operating system GPIO controllers, is related to the lack of checking the return value. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

ROS-20260923-73-0087

The vulnerability of the platformgetresource function in the Linux operating system’s kernel is related to an unvalidated return value. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-97496

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The to internal value function in StringListPathField calls os.path.exists using unbounded paths supplied by the user. This allows a tenant superuser to determi...

Linux Distros Unpatched Vulnerability : CVE-2026-95316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. Chromium...

CLEANSTART-2026-AZ15466 etcd is a distributed key-value store for the data of a distributed system

Security vulnerability affects the cortex package. etcd is a distributed key-value store for the data of a distributed system...

PT-2026-96659

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9 Description The plugin contains an Insecure Direct Object Reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists in t...

ROS-20260922-73-0036

The vulnerability of the msmiommumap function in the drivers/gpu/drm/msm/msmiommu.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to incorrect checking of the returned value from this function. Exploiting this vulnerability could allow an attacker...

SUSE CVE-2026-90070

In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Return zero on status read failure st33zp24status ignores the result of the transport read and returns data even when no byte was received. The I2C transport, for example, skips i2cmasterrecv when the register-sele...

org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded symbol value caching

A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, causing a denial of service DoS for legitimate users...