161667 matches found
CVE-2026-63983
A flaw was found in the Linux kernel's network emulator netem component. This vulnerability occurs when netem duplicates a packet and re-enqueues it, leading to a recursive packet duplication loop if multiple netem instances are configured. This uncontrolled recursion can exhaust system resources...
CVE-2026-63977
A flaw was found in the Linux kernel's dpll: zl3073x module. A race condition can occur during device teardown when a changework operation is re-scheduled after a cancelworksync call. This can lead to the system attempting to access a memory location that has been freed or is invalid, potentially...
CVE-2026-63971
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A race condition exists in the sctpwaitforconnect function, where a socket lock is temporarily released and re-acquired. During this brief period, another process can move the SCTP association to a...
CVE-2026-16484
A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /editsubjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published...
CVE-2026-10675
In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...
CVE-2026-10674
The NXP LPUART serial driver drivers/serial/uartmcuxlpuart.c, when CONFIGUARTUSERUNTIMECONFIGURE is enabled, called LPUARTDeinit at the start of mcuxlpuartconfigure, which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards in mcuxlpuartconfigurebasic,...
GHSA-GX3V-Q759-G323 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
Summary I'm reporting two related TOTP one-time-use defects in Gitea that survive the CVE-2021-45331 fix. The 2018 fix PR 3878 introduced the TwoFactor.LastUsedPasscode field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case,...
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface
Summary I'm reporting two related TOTP one-time-use defects in Gitea that survive the CVE-2021-45331 fix. The 2018 fix PR 3878 introduced the TwoFactor.LastUsedPasscode field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case,...
GHSA-Q423-49RW-G9MH Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
Summary GHSA-8fwc-qjw5-rvgp "Gitea may send release notification emails for private repositories to users whose access has been revoked", fix in PR 36319 / commit 8a98ac22 added repomodel.ClearRepoWatches as a defense for the state transition public→private. The cleanup was wired into...
Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
Summary GHSA-8fwc-qjw5-rvgp "Gitea may send release notification emails for private repositories to users whose access has been revoked", fix in PR 36319 / commit 8a98ac22 added repomodel.ClearRepoWatches as a defense for the state transition public→private. The cleanup was wired into...
GHSA-G9G6-QHRC-P3QC Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...
EUVD-2026-41605
Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts...
Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...
GHSA-649P-MMHF-85C7 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High | | Bug...
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High | | Bug...
CVE-2026-63925
A flaw was found in the Linux kernel's MACsec Media Access Control Security subsystem. When using Extended Packet Numbering XPN, a vulnerability exists where the replay protection mechanism can be bypassed. An attacker can exploit an integer overflow when the packet number reaches its maximum...
CVE-2026-63919
A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespa...
EUVD-2026-46430
Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web...
EUVD-2026-46412
lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted imageurl that redirects to internal targets. Attackers can send a POST request to the...
CVE-2026-10675 Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)
In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...