CVE-2026-48037

CVE-2026-48037 affects Hulumi, specifically accounts using pre-1.4.0 AccountFoundation and related baseline components. The vulnerability arises from reuse paths that import existing AWS GuardDuty and Security Hub resources without verifying their operational status, allowing deployments to appea...

CVE-2026-48036

Hulumi drift classifier (package @hulumi/drift)

CVE-2026-48035

Hulumi CVE-2026-48035 affects @hulumi/baseline prior to 1.4.0, enabling deletion of CloudTrail/Config audit logs by any S3-delete-capable principal in AccountFoundation deployments. The issue arises from three defects: (1) startup-hardened audit bucket allowed object deletion because object-lock/...

CVE-2026-48033

CVE-2026-48033 affects Hulumi before version 1.4.0. The vulnerability arises in the policy packs component: policy rules incorrectly trust URNs and can be bypassed when a developer names a resource with a trusted substring in the Pulumi-URN, allowing exemptions to be applied to resources that sho...

CVE-2026-48032

Hulumi (open-source toolkit for Pulumi) contains a vulnerability in the @hulumi/policies that affects IAM-role policy checks. Before v1.4.0, the policy validators incorrectly handled a JSON array in Principal.Federated, bypassing checks when a role trusts multiple OIDC providers. This could allow...

CVE-2026-48034

CVE-2026-48034 affects Hulumi components used with Pulumi. Before v1.4.0, a bypass exists in the decoy-sibling mechanism: an unhardened raw S3 bucket could appear compliant when paired with five hardening siblings that reference a different bucket, allowing a bypass of access controls. The issue ...

CVE-2026-48021

CVE-2026-48021 affects epa4all prior to 2026-05-20. An attacker who can intercept TLS between epa4all and the ePA backend could complete the VAU handshake with attacker-controlled keys, deriving session encryption keys. This allows reading and modifying inner HTTP traffic (including patient conse...

CVE-2026-54342

The CVE affects epa4all prior to 2026-05-20, where TLS certificate verification is disabled on CXF transport clients. A network attacker can intercept connections between epa4all and backends (ePA Aktensystem, Konnektor, IDP, TSS) by presenting a self-signed certificate. For non-VAU backends (Kon...

CVE-2026-59714

Open WebUI Open WebUI advisory CVE-2026-59714 (GHSA-X2FF-V5V8-M75M) describes a channel-overwrite flaw in the chat-completions endpoint (POST /api/chat/completions) where an authenticated user can overwrite messages in a channel they do not belong to by supplying a channel-prefixed chat_id and me...

CVE-2026-66035

CVE-2026-66035 affects libssh2 up to 1.11.1 and was fixed in commit 42e33d8. The vulnerability is a pre-authentication heap buffer overflow in the Encrypt-then-MAC (ETM) cipher negotiation path. In libssh2’s fullpacket() implemented under src/transport.c, the ETM code path allocates a buffer of p...

CVE-2026-66034

Impact: libssh2 up to 1.11.1 contains a missing bounds check in libssh2_publickey_list_fetch() that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and to free an uninitialized pointer during error cleanup. This leaks heap pointers from adjacent allocations, d...

CVE-2026-66033

CVE-2026-66033 affects libssh2 up to 1.11.1. A pre-authentication integer underflow in the ssh2_cipher_crypt() function (src/openssl.c) allows a malicious SSH server to crash a connecting client during handshake by negotiating AES-GCM ciphers. The underflow (blocksize − aadlen − taglen) can trigg...

CVE-2026-66032

libssh2

CVE-2026-65623

CVE-2026-65623 describes a Quadratic CPU blow-up in Bandit’s WebSocket message reassembly. The vulnerability arises when handling fragmented WebSocket frames: each non-final continuation frame is appended to a left-nested iolist and the entire buffer is re-measured with IO.iodata_length/1 on ever...

CVE-2026-61632

Technical details for CVE-2026-61632 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-59940

Summary: CVE-2026-59940 affects the npm package seroval used by Root (package @rootio/seroval). The vulnerability arises from a promise resolver type confusion in the deserialization path (seroval.fromJSON()), allowing attacker-controlled methods to be invoked during deserialization. Affected ver...

CVE-2026-59949

The connected advisory describes a vulnerability in lz4-java (JNI-based XXHash) where insufficient validation of byte array arguments in XXHash native calls can crash the JVM when an attacker-controlled array, offset, or length is supplied. Affected products: lz4-java up to version 1.11.0 (and ea...

CVE-2026-65711

CVE-2026-65711 affects sysPass up to version 3.2.11. An authenticated administrator can trigger an OS command injection via the backup path. The FileBackupService constructs a tar shell command by concatenating the admin-configurable siteBackupPath without proper sanitization (no escapeshellarg o...

CVE-2026-63381

Technical details for CVE-2026-63381 are not publicly available in the provided documents. Monitor for updates as new information is published.

CVE-2026-63384

Technical details for CVE-2026-63384 are not publicly available in the provided documents. No affected product/version or impact information is provided. Monitor for updates.

CVE-2026-63387

Technical details for CVE-2026-63387 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-63383

Technical details for CVE-2026-63383 are not provided in the supplied documents. No affected products, impacts, or fixes are specified. Monitor for updates from sources like the Mageia advisory (libevent updates) for potential linkage.

CVE-2026-63382

Technical details for CVE-2026-63382 are not publicly available in the provided documents. Monitor for updates from official advisories for any affected products, impact, and remediation.

CVE-2026-63388

Technical details for CVE-2026-63388 are not publicly available in the provided documents. This entry appears reserved; monitor for updates from the Mageia advisory MGASA-2026-0294 and any related CVE disclosures.

CVE-2026-63385

The Initial CVE-2026-63385 entry is reserved/no public details in the provided description. The connected Mageia advisory MGASA-2026-0294 indicates that updated libevent packages fix security vulnerabilities, but there is no explicit mapping to CVE-2026-63385 or detailed vulnerability data (affec...

CVE-2026-63379

Technical details for CVE-2026-63379 are not publicly available in the provided documents. Monitor for updates from advisories such as Mageia MGASA-2026-0294 for related vendor fixes.

CVE-2026-65710

SysPass 3.2.11 is affected by a missing authorization vulnerability in the PublicLink flow. Authenticated users with the PUBLICLINK_CREATE profile flag can trigger unauthorized decryption and persistence of vault passwords by abusing the absence of AccountAcl checks in the public link creation pa...

CVE-2026-65709

CVE-2026-65709 concerns sysPass up to version 3.2.11, with a missing object-level authorization vulnerability in the JSON-RPC API. The issue allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access checks. ...

CVE-2026-65708

CVE-2026-65708 affects sysPass version 3.2.11. An insecure direct object reference in the AccountFileController lets any authenticated attacker access account file attachments they lack ACL permissions for by supplying arbitrary numeric file IDs in actions such as download, view, delete, upload, ...

CVE-2026-63632

GHSA-p893-rvq9-2xf9 describes a heap-buffer-overflow READ in ONNX’s Gemm version converter adapter (7→6 downgrade) triggered by Gemm nodes with input tensors having fewer than 2 dimensions. The code accesses B_shape[1] (and A_shape[0]/A_shape[1]) without proper rank bounds checks, leading to a 16...

CVE-2026-65707

Likeshop 3.0.5 is affected by an authenticated SQL injection in the adjustAccount endpoint. The UserLogic.php adjustAccount function concatenates money, integral, growth, and earnings directly into Db::raw() fragments without type casting, validation, or parameter binding, enabling an admin-level...

CVE-2026-65693

Microweber CMS up to version 2.0.20 exposes a server-side template injection in mail templates via Twig in TwigView::render(). The unsandboxed Twig environment, lacking SandboxExtension or a SecurityPolicy, allows authenticated administrators to inject Twig expressions (e.g., filter('system')) in...

CVE-2026-64254

The CVE-2026-64254 issue concerns the Linux kernel NTB epf driver where, during teardown, pci_iounmap() could be invoked on the same iomem with an offset when BAR_PEER_SPAD and BAR_CONFIG share a PCI BAR. This caused a kernel warning such as vunmap() on a nonexistent VM area. The documented fix e...

CVE-2026-64255

Summary: CVE-2026-64255 affects the Linux kernel WiFi stack (iwlwifi, MLD). Three BA session handlers compute station IDs with ffs(ba_data->sta_mask) - 1 without ensuring sta_mask is non-zero, causing an out-of-bounds access on fw_id_to_link_sta[] when sta_mask is zero (ffd returns 0, wrapped ...

CVE-2026-64253

The CVE-2026-64253 issue affects the Linux kernel, specifically in kernel/fork within copy_process(). The bug allowed PF_BLOCK_TS to be inherited from the parent after the child’s plug pointer is reset to NULL, breaking the invariant that PF_BLOCK_TS can only be relied upon when current->plug ...

CVE-2026-64252

The CVE-2026-64252 issue affects the Linux kernel on MIPS DEC paths, where in 64-bit configurations the initial console output buffer could be placed in XKPHYS, and if the initial console handler is invoked from a non-initial thread, the buffer address could be truncated by 32-bit firmware, riski...

CVE-2026-64250

CVE-2026-64250 affects the Linux kernel on LoongArch. The issue arises when smp_send_stop() parks secondary CPUs and marks them offline without informing RCU, causing RCU to expect quiescent states from CPUs that are effectively stopped. This can lead to RCU grace period stalls, especially after ...

CVE-2026-64251

CVE-2026-64251 concerns a Linux kernel bug in the pwrseq core where use-after-free occurs in the pwrseq_debugfs_seq_next() path due to incorrect reference counting. The fix standardizes reference management across seq_file callbacks to prevent prematurely dropped references: start() now returns a...

CVE-2026-64249

In Linux kernel fpga region code, a use-after-free occurred in child_regions_with_firmware() when memory for child_region could be referenced by pr_err() after it was freed. The fix moves of_node_put(child_region) to occur after the error print to avoid dereferencing freed memory. Affected area: ...

CVE-2026-64248

CVE-2026-64248 affects the Linux kernel on MIPS (Realtek MIPS interAptiv). The issue arises in smp_send_stop() which parks secondary CPUs and marks them offline via set_cpu_online(false) without informing RCU, causing RCU to still expect a quiescent state. This can lead to a stall when irq_work_s...

CVE-2026-64247

CVE-2026-64247 concerns the Linux kernel KVM code for x86 with hyper-v virtualization. The issue arises when checking if a VP ID is in a sparse bank set: the VP ID could be copied without bounds checking, risking an out-of-bounds read when testing the sparse bank and potentially triggering an unn...

CVE-2026-64246

CVE-2026-64246 pertains to the Linux kernel, fixing a use-after-free in the linkstation_poweroff_init path of the power: reset flow. The change moves of_node_put(dn) after the of_match_node() call because the node pointer is still needed, and ensures the node reference is released after use. The ...

CVE-2026-64245

The CVE-2026-64245 issue concerns the Linux kernel fbdev subsystem, specifically in fb_find_mode() within fbdev/modedb. The vulnerability arises when mode_option is NULL and is assigned from mode_option_buf via fb_get_options; later, name is derived from mode_option. If mode_option_buf is freed (...

CVE-2026-64244

The CVE-2026-64244 issue affects the Linux kernel in drivers/base/memory where mem->altmap could be left set if __add_memory_block() fails during xa_store(), triggering a WARN_ON(mem->altmap) during device_unregister/memory_block_release, notably after virtio-mem driver changes. The root ca...

CVE-2026-64243

CVE-2026-64243 (Linux kernel, ASoC codecs: simple-mux) A fix was applied to correct the bounds check in simple_mux_control_put for enum controls. Previously the code rejected values greater than e->items, but enum controls are zero-based, making 0 and 1 valid for a two-entry mux and 2 should b...

CVE-2026-64242

In the Linux kernel, the net2280 USB gadget driver fix eliminates a double-free in the probe error path. The gadget_init registers gadget_release() as the release callback; net2280_remove() tears down the device and drops the gadget reference with usb_put_gadget(). A subsequent kfree(dev) could f...

CVE-2026-64241

The CVE-2026-64241 entry describes a Linux kernel GPIO driver issue for Rockchip: teardown bugs and resource leaks in the rockchip GPIO driver. Root causes include (1) a debounce clock reference leak from of_clk_get() without a corresponding clk_put(), fix requires a devm action to release on unb...

CVE-2026-64239

CVE-2026-64239 affects the Linux kernel’s DAMON sysfs implementation (mm/damon/sysfs-schemes). The vulnerability arises when refreshing region directories: during removal, only kobj objects are deleted and the container region object is removed from the linked list in the kobj release callback. I...

CVE-2026-64240

Affected software: Linux kernel (media: rc: igorplugusb driver). Issue: the control request storage was converted from an embedded struct to an allocated pointer to meet DMA coherency, but usb_fill_control_urb() still used the pointer to the struct as the setup packet. This caused the URB setup t...

CVE-2026-64238

The CVE-2026-64238 issue affects the Linux kernel GPIO subsystem for shared GPIO proxies. A previously wide-critical-section around a mutex in struct gpio_shared_entry could deadlock during removal of a shared proxy’s parent because the offset field could be modified after assignment. The fix sho...