378665 matches found
CVE-2026-10090
A flaw was found in the Application Subscription controller multicluster-operators-subscription of Red Hat Advanced Cluster Management for Kubernetes ACM. A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they contro...
CVE-2026-10059
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...
CVE-2026-8029
The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the thef...
CVE-2026-64581
CVE-2026-64581: Linux kernel XFRM double-free in xfrm_user_policy() due to non-atomic sk_dst_cache updates. A per-socket policy change can race with UDP transmit path, causing both sides to release the same dst and freeing the xfrm_dst bundle twice. The fix uses an atomic sk_dst_reset() with a si...
CVE-2026-64580
The CVE-2026-64580 entry describes a Linux kernel issue in xfrm6 where on error path the code releases a device reference with netdev_put() but leaves xdst->u.dst.dev set, causing a double netdev_put on dst->dev and underflow of the net_device refcount. The fix, as detailed in the disclosur...
CVE-2026-64579
The CVE-2026-64579 entry describes a Linux kernel xfrm policy issue in xfrm_hash_rebuild: the first loop preallocates bins for the reinsert path, but the guard inversion causes inexact policy reinserts to allocate at GFP_ATOMIC during reinsert, risking LIST_POISON2 dereferences and a crash under ...
CVE-2026-64577
The CVE-2026-64577 issue is in the Linux kernel’s GTP/gtp1u path: gtp1u_send_echo_resp() ignores the return value of skb_pull_data(), while gtp1u_udp_encap_recv() can require 20 bytes but only guarantees 16. When a 16–19 byte echo request triggers a failed pull, the code continues and skb_push() ...
CVE-2026-64578
CVE-2026-64578 affects the Linux kernel ksmbd SMB2 handling. A compound (chained) SMB2 request could trigger a slab-out-of-bounds read when ksmbd_smb2_check_message() reads the StructureSize2 field at offset 64 without first ensuring the compound element is large enough. The vulnerable path occur...
CVE-2026-64576
CVE-2026-64576 : In the Linux kernel, the vulnerability lies in nh_res_bucket_migrate() where an uninitialized netlink_ext_ack is passed to call_nexthop_res_bucket_notifiers(). If nh_notifier_res_bucket_info_init() fails (e.g., kzalloc returns -ENOMEM), the error path uses an uninitialized extack...
CVE-2026-64575
The CVE-2026-64575 issue affects the Linux kernel’s BPF TCP batch iterator. The root cause is a double release of socket references during batch realloc; on realloc failure, cur_sk/end_sk remain and later code dereferences a cookie as a struct sock, causing a null-ptr-deref in __sock_gen_cookie a...
CVE-2026-64574
Summary (CVE-2026-64574) : In the Linux kernel’s wifi/mac80211 subsystem, the error path when updating VIF links can leak newly created link containers. If drv_change_vif_links() fails, the code frees the new containers but does not remove their debugfs entries or stop the links, leaving file->...
CVE-2026-64572
CVE-2026-64572 affects the Linux kernel's IPv4 FIB path. In fib_table_insert(), new_fa is published to the leaf’s fa_list before notifiers run; if a notifier fails, the code removes new_fa via fib_remove_alias() and frees it with kmem_cache_free(). A concurrent, already-reached reader in fib_tabl...
CVE-2026-64573
The CVE-2026-64573 issue affects the Linux kernel Bluetooth stack (qca TLV parser). In the TLV_TYPE_NVM branch of qca_tlv_check_data(), the loop bound used length - sizeof(struct tlv_type_nvm) with length as a signed int promoted to size_t, which could underflow when firmware
CVE-2026-64571
Technical details are not publicly available in the provided documents. Monitor for updates on affected versions, fixes, and affected hardware/software.
CVE-2026-64569
In CVE-2026-64569, on Linux kernel builds with CONFIG_INET=n, mpls_valid_fib_dump_req() dereferences NULL when handling RTM_GETROUTE dumps for AF_MPLS because tb[RTA_OIF] is passed to nla_get_u32() without checking presence, and the path bypasses ip_valid_fib_dump_req(). This can allow an unprivi...
CVE-2026-64570
In CVE-2026-64570, Linux kernel wifi/mac80211 fixes a double-free in FILS discovery: ieee80211_set_fils_discovery() frees the old template with kfree_rcu() before allocating the replacement. If kzalloc() fails (ENOMEM), link->u.ap.fils_discovery still points to the old object, and a later AP t...
CVE-2026-64568
CVE-2026-64568 affects the Linux kernel’s mac80211/wifi stack. The vulnerability arises in ieee80211_set_unsol_bcast_probe_resp(): it frees the old unsol_bcast_probe_resp template with kfree_rcu() before a replacement has been allocated. If kzalloc() fails, link->u.ap.unsol_bcast_probe_resp st...
CVE-2026-64567
The CVE-2026-64567 issue affects the Linux kernel’s btrfs free-space cache loader. A header-stored num_entries can exceed available pages, causing the reader to index past the allocated pages when loading a v1 free-space cache. This leads to out-of-bounds reads (KASAN) and potential fault handlin...
CVE-2026-64566
The CVE-2026-64566 issue affects the Linux kernel xfrm/IPTFS frag handling. In iptfs_skb_add_frags(), frag references are copied and __skb_frag_ref() increments the page ref count, but SKBFL_SHARED_FRAG is not propagated to the destination SKB’s skb_shinfo->flags, causing the inner SKB to appe...
CVE-2026-55997
CVE-2026-55997 concerns Rancher where long-lived registration tokens used to authenticate nodes/agents into a downstream cluster were stored in plaintext with no expiration. The tokens could be obtained via the Rancher API, etcd, automation, or direct file access on a node and used at any time to...
CVE-2026-55998
The CVE describes an unauthenticated import endpoint vulnerability: /v3/import/{token}_{clusterId}.yaml returns 502 for valid cluster IDs that reference clusters with private registry secrets due to a null pointer dereference in pkg/systemtemplate/private_registry.go ; non-existent cluster IDs re...
CVE-2026-59675
CVE-2026-59675 affects Rancher Manager when API audit logging is enabled. The audit middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because it is positioned earlier than Rancher’s APIBodyLimitingHandler, the default 1 MiB body cap is by...
CVE-2026-55996
CVE-2026-55996 affects Rancher components ( Rancher server and cattle-cluster-agent ) that use the dynamiclistener TLS library. Without an effective CN filter, dynamiclistener appends every SNI hostname to the serving certificate’s SANs. An unauthenticated attacker with network access can send ma...
CVE-2026-11920
CVE-2026-11920 affects the WordPress plugin “JoomSport – for Sports: Team & League, Football, Hockey & more” up to version 5.7.9. The vulnerability is a time-based SQL Injection in the query path that uses the user-supplied, insufficiently escaped parameters in the SQL statement, triggered when b...
CVE-2026-11977
The affected software is the WordPress plugin WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars . The vulnerability is a generic SQL Injection via the parameter wpma_metabox_authors_list in all versions up to and including 3.9.1, caused by insufficient escaping and lac...
CVE-2026-7520
The MailChimp Forms by MailMunch plugin for WordPress (affected versions up to 3.2.7) is vulnerable to unauthorized data modification due to a missing capability check on the sign_in() and sign_up() AJAX handlers. This allows an attacker with Subscriber-level access (or higher) to relink the site...
CVE-2026-11969
The vulnerability (CVE-2026-11969) affects the WordPress plugin WP TripAdvisor Review Slider up to version 14.3 . The issue is a SQL Injection via the 'curselrevs[]' parameter caused by insufficient escaping and inadequate preparation of the SQL query. Attack feasibility requires authenticated ac...
CVE-2026-6020
The ShopLentor plugin for WordPress is affected by an authentication-restricted arbitrary function execution vulnerability. All versions up to 3.3.7 expose the woolentoropt/v1/custom-action REST endpoint; the handle_action() method passes user-supplied input directly to call_user_func() without a...
CVE-2026-4431
The CVE-2026-4431 entry concerns the Easy Post Submission WordPress plugin (up to version 2.3.0). A missing capability check on create_post() enables an unauthenticated actor to invoke the rbsm_submit_post AJAX action (registered via wp_ajax_nopriv_rbsm_submit_post) without authorization when a p...
CVE-2026-71215
CVE-2026-71215 affects art-template. Sub-template resolution (resolve-filename.js) resolves target file paths using path.resolve(root, filename) without validating the resulting path is inside root, allowing traversal via include()/extend() and passing the path to fs.readFileSync. An attacker can...
CVE-2026-71214
CVE-2026-71214 (NASA-AMMOS plandev sequencing-server) : The authorization middleware in sequencing-server derives the caller’s Hasura session role via getHasuraSession(), preferring a client-supplied session_variables object from the request body over JWT claims in the Authorization header, witho...
CVE-2026-71213
CVE-2026-71213 (typemill) : The login endpoint POST /tm/login (ControllerWebAuth::login()) has no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled (default). An unauthenticated attacker can perform unlimited password-guessing against any account, including admin...
CVE-2026-71212
xidown (a yt-dlp/ffmpeg GUI wrapper) constructs its yt-dlp command by appending a user-supplied URL as a bare trailing positional argument, with no end-of-options marker (-- or scheme validation). Because yt-dlp treats any argument starting with '-' as an option, a crafted URL such as -U or --exe...
CVE-2026-71211
MLflow’s AI Gateway allows an auth_config.api_base value to be stored without validation (scheme/host/IP range), and the gateway proxy endpoint then issues HTTP requests to api_base plus a caller-supplied path, returning the response body. The existing SSRF guard (_validate_webhook_url) is never ...
CVE-2026-71210
Mealie is affected by a DNS-rebinding TOCTOU in its AsyncSafeTransport SSRF guard. The guard validates a target host by resolving its IP once and checking private-range rules, but the actual outbound request is issued using the original hostname, which is re-resolved by the underlying transport. ...
CVE-2026-71209
Audiobookshelf CVE-2026-71209 describes an authentication-exemption bypass in server/routers/Auth.js. The regex checks unauthenticated GET routes against req.path, but because req.path can contain URL-encoded %2F sequences, an encoded directory traversal like ..%2f..%2f..%2ftmp%2fpwned escapes th...
CVE-2026-71208
KubeSphere CVE-2026-71208 describes SSRF risk in the cluster-controller reconciliation. The addCluster path reads every Cluster CRD’s connection config and calls Discovery().ServerVersion() against the CRD-specified Kubernetes API endpoint, using only URL syntax validation (no allow/deny list for...
CVE-2026-71207
The Stock-Inventory-Management-System is affected in login.php, where raw $_POST values are assigned to $_SESSION and concatenated into a SQL query without parameterization, enabling unauthenticated SQL injection. An attacker could bypass authentication by submitting payloads like ' OR '1'='1, le...
CVE-2026-71206
Shiori CVE-2026-71206 affects the JWT CheckToken flow: it validates only the HMAC signature and returns the embedded claims.Account without re-fetching from the DB, with no session store or token revocation. Deletion or demotion of an account does not invalidate existing tokens, so an attacker co...
CVE-2026-71205
The CVE-2026-71205 issue affects changedetection.io: the /login endpoint authenticates against a single shared password using PBKDF2-HMAC-SHA256 with no per-IP or per-session rate limiting, no failed-attempt counter, and no lockout. This effectively provides unlimited brute-force opportunities, a...
CVE-2026-71204
The CVE-2026-71204 entry concerns changedetection.io. A POST to /settings that omits api_access_token_enabled causes the update logic to silently disable API key enforcement because WTForms treats unchecked checkboxes as False and only the password field is specially handled. This results in the ...
CVE-2026-71203
CVE-2026-71203 affects changedetection.io. The Spec resource at /api/v1/full-spec allows unauthenticated access because its get() method lacks both the @auth.check_token and @validate_openapi_request decorators, bypassing API key protection that guards other /api/v1/* endpoints. This enables retr...
CVE-2026-71202
The CVE-2026-71202 entry concerns the raster Rust crate. The crop() implementation clamps width/height but only clamps offset_x/offset_y against 0, not against the source width/height. If an offset exceeds the source dimension, width2 - offset_x underflows to a negative i32, which is then cast to...
CVE-2026-70378
The CVE describes imagecli: negative values for carve ratio in Carve::apply() (src/image_ops.rs) are not validated to be positive. With ratio <= 1.0 only asserted, a negative ratio can drive the computed target width to 0 via Rust’s float-to-uint cast, then be passed to imageproc::seam_carving...
CVE-2026-70377
The CVE-2026-70377 entry affects imagecli. The vulnerability lies in the Scale::apply() function where output dimensions are computed as (dimension as f32 * ratio) as u32 without upper-bound validation on a CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. ...
CVE-2026-70376
Pluck CMS has a CSRF risk in the admin panel due to relying solely on Referer-based checks (requestedByTheSameDomain()) with no per-request anti-CSRF token. If Referer/Host is missing, the code treats the request as same-origin, enabling a cross-site attacker page to request forged admin actions....
CVE-2026-55747
The CVE-2026-55747 entry concerns the pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow. The root cause is a _path(workdir, p) helper that simply wraps os.path.join(workdir, p) with no canonicalization or containment checks. Because os.path.join can preserve absolute paths and doe...
CVE-2026-55739
CVE-2026-55739 (Crater) : The vulnerability arises from a missing tenant-ownership check in CustomerPolicy where view/update/delete do not verify company ownership, plus unscoped route-model lookups and bulk deletion (self::find($id)) that ignore company filters. As a result, any authenticated us...
CVE-2026-54418
CVE-2026-54418 affects Leantime up to version 3.6.2. The JSON-RPC endpoints leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA accept a caller-supplied userId without ownership checks, session pinning, or permission-attribute gating. An authenticated user can call ...