CVE-2026-80738

CVE-2026-80738 affects the Linux kernel BPF subsystem. The functions bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer typed as ARG_PTR_TO_BTF_ID_SOCK_COMMON but access sk->sk_protocol without verifying the socket is a full socket rather than a mini-socket. The fix chec...

CVE-2026-80737

This vulnerability affects the amba-pl011 UART driver in the Linux kernel . During DMA teardown, dmaengine_terminate_all() does not wait for a running callback, allowing the TX callback to access the TX buffer after it has been freed (use-after-free). Additionally, the RX poll timer reads RX buff...

CVE-2026-80736

CVE-2026-80736 is an out-of-bounds array indexing flaw in the Linux kernel's Thunderbolt subsystem , specifically in the tb_consumed_dp_bandwidth() function. Valid bandwidth group IDs range from 1 through MAX_GROUPS, but the local group_reserved[] array only has MAX_GROUPS entries (indices 0–MAX_...

CVE-2026-80735

CVE-2026-80735 affects the ovpn (OpenVPN) module in the Linux kernel . The root cause is a missing type-check: subsystems such as BPF SOCKMAP can set sk_user_data without setting the expected encap_type, and the ovpn driver dereferences sk_user_data without verifying the socket is actually owned ...

CVE-2026-80734

CVE-2026-80734 affects the btrfs filesystem in the Linux kernel . When a btrfs inode is evicted from the page cache under memory pressure and subsequently re-looked up via btrfs_iget(), the code path that reuses a previously cached delayed_node skips calls to btrfs_update_inode_mapping_flags() an...

CVE-2026-80733

CVE-2026-80733 affects the Linux kernel 's sk_mc_loop() networking function. When called for non-INET sockets—such as AF_PACKET sockets sending packets over virtual devices like VRF or ipvlan —the function falls through its switch statement and triggers a spurious WARN_ON_ONCE(1) . Since non-INET...

CVE-2026-80732

CVE-2026-80732 is a use-after-free vulnerability in the Linux kernel's pata_sl82c105 Parallel ATA driver. Commit 44c10138fd4b replaced a PCI configuration-space read with a direct access to the cached revision field but left that access after pci_dev_put(), allowing the bridge device to be freed ...

CVE-2026-80730

CVE-2026-80730 affects the Linux kernel's ring-buffer subsystem. The root cause is in test_ringbuffer()'s out_free cleanup loop: the !rb_threads[cpu] check only catches NULL entries but misses entries holding an ERR_PTR . When kthread_run_on_cpu() fails, it stores ERR_PTR(-ENOMEM) or ERR_PTR(-EIN...

CVE-2026-80731

CVE-2026-80731 is an out-of-bounds write in the Linux kernel's networking subsystem, specifically in dev_validate_header() . When a process holding CAP_SYS_RAWIO sends a packet with a short link-layer header, the function zero-pads using a direct read of dev->hard_header_len . If the device is...

CVE-2026-80729

CVE-2026-80729 affects the Linux kernel in the mm/huge_memory subsystem. The root cause is that __folio_split() leaves the xa_state's xa_lru field unset, while xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes. This allows a live, memcg-charged xa_node to exist without being linked into ...

CVE-2026-80728

This Linux kernel vulnerability affects the DRM/amdgpu driver. The root cause is a devres teardown ordering issue : because devres teardown is LIFO and the aperture devres node was registered after the DRM device node, devres_release_all() unmaps the aperture before the DRM device release callbac...

CVE-2026-80727

CVE-2026-80727 affects the Linux kernel x86 MCE (Machine Check Exception) subsystem. During boot, the CMCI storm detection path (cmci_discover → mce_timer_kick → __mod_timer) attempts to modify a timer that has not yet been initialized via timer_setup(), triggering ODEBUG assertions (assert_init ...

CVE-2026-80726

CVE-2026-80726 affects the Linux kernel's KVM x86 MMU subsystem . The root cause is that role.invalid is not explicitly cleared when deriving a child shadow page's role from its parent. This violates KVM's invariant that invalid pages are not on the active MMU page list, leading to a use-after-fr...

CVE-2026-73600

Dell PowerProtect Data Manager versions 20.2.0.0 and below contain a stack buffer overflow in the file-level restore agent . According to the description, a high-privileged remote attacker could exploit this to achieve information disclosure , though the assigned CVSS 3.1 vector (7.8 HIGH ) score...

CVE-2026-68860

Dell PowerProtect Data Manager (versions 20.2.0.0 and below ) is affected by a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker with high attack complexity and required user interaction could exploit this to launch phishing attacks , resulting in high confidentiali...

CVE-2026-74769

Dell PowerProtect Data Manager versions 20.2.0.0 and below contain an Incorrect Authorization vulnerability in the REST API . A low-privileged remote attacker could exploit this to bypass protection mechanisms, resulting in a HIGH integrity impact (CVSS 3.1 base score 6.5 MEDIUM , vector AV:N/AC:...

CVE-2026-74768

Dell PowerProtect Data Manager versions 20.2.0.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API . A high-privileged remote attacker could exploit this to achieve information disclosure across a scope change. The CVSS v3.1 score is 4.1 (MEDIUM) with vector AV:...

CVE-2026-17539

RTU500 (Hitachi Energy) is affected by a NULL pointer dereference in the last entry of the enhanced message queue, triggered under high-load scenarios such as sending GI (General Interrogation) requests at short intervals . This leads to a BCI_IEC104 fatal write error , causing connection interru...

CVE-2026-9854

A vulnerability in the SYS600 RBAC mechanism (by Hitachi Energy ) allows users with access to the engineering tools to elevate privileges to administrator level on the underlying Windows host , granting themselves full control over the machine. The CVSS 4.0 score is 8.5 (HIGH) , with a local atta...

CVE-2026-9853

CVE-2026-9853 is a vulnerability in Hitachi Energy's SYS600 application that allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without completing SYS600's own authentication. This effectively bypasses the intended ac...

CVE-2026-9852

CVE-2026-9852 is a CSV injection vulnerability in Hitachi Energy SYS600 , affecting the Notify service log export function on Windows. Injected malicious formulas in log data can modify spreadsheet data, insert links, exfiltrate data , and in some configurations execute malicious code on the user...

CVE-2025-10478

A denial-of-service vulnerability exists in the Rockwell Automation 1756-ENBT module , a ControlLogix EtherNet/IP bridge that enables communication between Logix 5000 controllers and Ethernet devices. An attacker can exploit the issue by sending a crafted CIP packet , causing the module to crash;...

CVE-2026-77477

CVE-2026-77477 affects OPCFoundation OPC UA LocalDiscoveryServer (LDS) . During installation, a high-privilege console window is launched that an attacker with physical access (keyboard and display) and the ability to launch the installer with elevated privileges can intercept. Successful exploit...

CVE-2026-2573

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the postBodyCss parameter in all versions up to and including 2.4.4 . The root cause is insufficient input sanitization and output escapin...

CVE-2023-51214

This CVE entry is currently reserved with no public technical details available. The affected product, vulnerability type, and impact are not yet disclosed. Monitor for future updates when the details are publicized.

CVE-2026-85040

ZhongBangKeJi CRMEB (up to 6.0.0 ) is vulnerable to OS command injection in the Custom Scheduled Task feature. The eval function in /adminapi/system/crontab/save unsafely processes the customCode argument, allowing remote attackers to inject operating-system commands. The vendor documents this as...

CVE-2021-38489

CVE-2021-38489 affects the HddPasswordPei driver in Insyde InsydeH2O 5.x firmware, as shipped in Siemens SIMATIC products. The root cause is that the HDD password is stored in plaintext within a UEFI variable, exposing it to attackers with local, high-privilege access. The vulnerability carries a...

CVE-2021-43614

CVE-2021-43614 affects the VariableEditSmm component in Insyde UEFI firmware . The root cause is an error in handling the PlatformLangCodes UEFI variable, which can cause a buffer overflow leading to resource exhaustion and failure; the CVE title further suggests potential for code execution . Th...

CVE-2021-43613

A vulnerability in the SysPasswordDxe driver of Insyde InsydeH2O 5.x exposes user and administrator password hashes in runtime UEFI variables, enabling privilege escalation . The affected firmware is also used in Siemens SIMATIC industrial products. The CVSS 3.1 score is 6.5 (Medium) with a local...

CVE-2026-85031

TOTOLINK CP450 firmware version 4.1.0 contains a buffer overflow in an unknown function of /cgi-bin/cstecgi.cgi, triggered by manipulating the topicurl argument. Remote exploitation is possible. The vulnerability is rated CVSS 3.1: 9.9 (Critical) with a scope change and high impact to confidentia...

CVE-2026-85030

HKUDS AI-Trader (a simulated trading/competition platform) contains a business logic error in the selfRegister API Endpoint within service/server/routes_agent.py. By manipulating the initial_balance argument, a remote attacker can inflate their starting cash/equity value. However, because profit_...

CVE-2026-85092

LiME (Linux Memory Engine) through version 1.12.0 contains an arbitrary file overwrite vulnerability caused by a missing O_NOFOLLOW flag and insufficient validation of the operator-supplied disk acquisition output path. An unprivileged local attacker who controls the output directory can plant a ...

CVE-2026-85093

Cheshire Cat AI (an open-source AI agent framework) contains an information disclosure vulnerability in its GET /memory/collections/{collection_id}/points endpoint. The root cause is a missing per-user filter when retrieving episodic memory points, allowing any authenticated user with MEMORY:READ...

CVE-2026-85091

zlib versions 1.3.1.2 through 1.3.2 are affected by a heap buffer overflow in the gz_vacate() function. The root cause is an unchecked memmove() that writes beyond the internal input buffer boundary when processing non-blocking gzwrite() operations with stale external buffer pointers . An attacke...

CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 are affected by an information disclosure vulnerability in the Save Session Info PDU writers within libfreerdp/core/info.c. Three functions (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Ze...

CVE-2026-85090

FreeRDP before 3.31.0 is affected by a heap out-of-bounds read in the general_ChromaV1ToYUV444 function, which handles AVC444 chroma plane reconstruction . A malicious RDP server can craft an RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an out-of-bounds memory read past the al...

CVE-2026-85022

A cross-site scripting (XSS) vulnerability affects the WebApp Sign-In component of langgenius dify 1.13.0 , specifically in the router.replace function within web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx. Manipulating the redirect_url argument enables remote attackers...

CVE-2026-85021

langgenius/dify version 1.13.0 is affected by a cross-site scripting (XSS) vulnerability in the Splash Layout component, specifically in the router.replace function within web/app/(shareLayout)/components/splash.tsx. The root cause is improper handling of the redirect_url argument, allowing remot...

CVE-2026-80256

A vulnerability in the wcurl script of the curl project (reported via HackerOne) allows an attacker-controlled URL to create a new file outside the directory chosen by a Windows user, subject to the user's filesystem permissions and the target path not already existing. The root cause is in the g...

CVE-2026-59346

CVE-2026-59346 is an integer-overflow vulnerability in the VMXNET3 virtual network adapter of VMware Workstation and VMware Fusion (versions 25H2 and 26H1). Per advisory VMSA-2026-0007, a malicious actor with local administrative privileges on a guest VM can exploit this flaw to execute code on t...

CVE-2026-59347

CVE-2026-59347 is a stack-based buffer overflow in the HGFS (Host-Guest File System) component of VMware Workstation and VMware Fusion versions 25H2 and 26H1 . A malicious actor with local administrative privileges on a guest VM can exploit this flaw to execute code as the VMX process on the host...

CVE-2026-85084

This vulnerability affects Samsung Open Source TizenFX in the MediaBufferBase indexer setter , where a missing bounds check (Improper Validation of Array Index) leads to an Out-of-bounds Write that can overflow buffers. The CVSS 3.1 score is 6.3 (MEDIUM) with a local attack vector, high complexit...

CVE-2026-84888

RightNow-AI OpenFang up to version 0.6.9 contains a vulnerability in the shell_exec function within crates/openfang-runtime/src/tool_runner.rs. The flaw causes uncontrolled memory allocation , exploitable remotely with low privileges and no user interaction. The primary impact is low availability...

CVE-2026-84887

A denial-of-service vulnerability exists in simular-ai Agent-S up to version 0.3.2 , located in the Model-generated GUI Action Execution Workflow component, specifically within the grounding.py file. The root cause is described as an "unknown functionality" manipulation leading to DoS . Remote ex...

CVE-2026-84886

A resource consumption vulnerability affects the OCR HTTP API component of simular-ai Agent-S versions up to 0.3.2. The flaw resides in the ImageData function within the file gui_agents/s1/utils/ocr_server.py, where manipulation of the img_bytes argument can exhaust system resources. The attack i...

CVE-2026-84885

A denial of service vulnerability affects simular-ai Agent-S versions 0.3.1 and 0.3.2 , specifically within the CodeAgent component (file code_agent.py ). The exact function is described as unknown. The attack is launchable remotely with low complexity and requires low privileges, resulting in pa...

CVE-2026-84394

fast-uri (a URI parsing library used by the Fastify ecosystem) contains a host confusion vulnerability: when a URI's authority contains an opening bracket [ without a matching closing bracket ], parse() returns the string as the host without error. Neither an IP literal nor a valid domain name is...

CVE-2026-84851

CVE-2026-84851 is an uncontrolled recursion vulnerability in the Ion reader component of Amazon Ion-C , affecting versions before 1.1.6 . A remote, unauthenticated attacker can craft malicious Ion data that exhausts the native call stack, causing a denial of service in any application using the l...

CVE-2026-84292

fast-uri , a URI library in the Fastify ecosystem, fails to validate the port component when serializing an authority. The recomposeAuthority function concatenates the port verbatim without escaping, so a crafted non-digit value (e.g., containing @) can inject authority delimiters, demoting the i...

CVE-2026-84857

sigoden aichat (versions up to 0.30.4) is affected by an uncontrolled memory allocation flaw in the API Endpoint component, specifically in the file src/serve.rs. The root cause is linked to request body handling, as indicated by the published report titled AIChat_Serve_Request_Body_DoS_Report . ...