348410 matches found
CVE-2026-73537
CVE-2026-73537 is a cross-site scripting (CWE-79) vulnerability in the Miraikan Assist App provided by the Japan Science and Technology Agency (JST) . The flaw allows an arbitrary script to be executed in the app's WebView browser component, potentially altering displayed content. The vulnerabili...
CVE-2026-74509
A flaw was found in the Linux kernel's Bluetooth subsystem. Specifically, the hcisync component, which manages Bluetooth advertising data, is susceptible to a Use-After-Free UAF vulnerability. This occurs when a pointer to advertising data becomes invalid but is still accessed, particularly durin...
CVE-2026-74476
A flaw was found in the veth component of the Linux kernel. This vulnerability occurs when a specially crafted network packet, known as a fraglist skb socket buffer, is processed by the veth driver. An attacker could potentially send such a packet, causing the system to misinterpret fragment...
CVE-2026-74531
A flaw was found in the Bluetooth hciconn component of the Linux kernel. A theoretical Use-After-Free UAF vulnerability exists if a connection conn is prematurely freed while the hcisync task is still active. This could potentially allow an attacker to cause a system crash or execute arbitrary co...
CVE-2026-74446
A flaw was found in the drm/amdkfd component of the Linux kernel. A race condition exists in the kfdcriucheckpointevents function where a mutex is not consistently held during event checkpointing. This allows a local attacker to cause memory corruption, potentially leading to privilege escalation...
Miraikan Assist App vulnerable to cross-site scripting
Overview Miraikan Assist App provided by Japan Science and Technology Agency JST contains the following vulnerability. Cross-site scripting CWE-79 - CVE-2026-73537 RyotaK of GMO Flatt Security Inc. reported this vulnerability to the developer and coordinated. After the coordination was completed,...
CVE-2026-77682
A code injection vulnerability exists in Epiphany when the user invokes form autofill from the context menu on a page containing a malicious HTML form. In embed/web-process-extension/resources/js/ephyautofill.js, getSelector builds a CSS selector by directly interpolating an element's id attribut...
Exploit for Eval Injection in Langflow
CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote...
CVE-2026-39155
A flaw was found in Knot DNS. The mod-onlinesign component incorrectly computes the next NSEC Next Secure owner name. This can lead to an overly broad authenticated denial interval, allowing DNS Domain Name System resolvers that use aggressive negative caching to incorrectly generate negative...
CVE-2026-73267
A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...
EUVD-2026-63800
A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...
CVE-2026-73267 Clusterclaims-controller: clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no ownership check
A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...
CVE-2026-73267
In Red Hat's multicluster engine, the clusterclaims-controller deletes ManagedClusters based solely on clusterclaim.spec.namespace without verifying ownership. Any tenant with standard ClusterClaim permissions can delete any cluster, including the hub's local-cluster, causing a HIGH-severity (7.7...
CVE-2026-73267
A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...
CVE-2026-74975
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in the Downloads component in Firefox for Android...
CVE-2026-13789
An use after free flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=493847920...
Security Bulletin: Multiple vulnerabilities have been identified with the DS8900F and DS8A00 Hardware Management Console (HMC)
Summary DS8900F and DS8A00 updates have been released to remediate vulnerabilities in various components like IBM Java Quarterly Update, IBM WebSphere Application Server, IBM Power HMC, Linux Kernel, OpenSSL, libsoup, libssh, OpenSSH, net-snmp, Apache HTTP Server httpd, Expat libexpat, libpng,...
CVE-2026-74982
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Widget component...