CVE-2026-88817 Privilege escalation via legacy access group creation endpoint

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access t...

CVE-2026-92359 ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function createstrandsapp of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted...

CVE-2026-92465

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

CVE-2026-58147

WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the httppasswdhidden and httppasswdConfirmhidden parameters, allowing an authenticated attacker to...

CVE-2026-58146

WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the clicookie POST parameter. The clicookie parameter value is directly concatenated into a find command string without proper...

CVE-2026-40857

WNC T-Mobile 5G Box IDU router contains a cross-site request forgery CSRF vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrftokenvalue parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on the...

CVE-2026-40856

WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wncmaccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi...

CVE-2026-40855

WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the pingip, pingsize, and pingtimes POST parameters. The root cause is the failure to verify and sanitize...

CVE-2026-40854

WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/loginuser. An attacker can bypass authentication b...

CVE-2026-92463

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

CVE-2026-92462

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required...

CVE-2026-92461

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal...

CVE-2026-92460

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

CVE-2026-92458

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to...

CVE-2026-92459

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other...

CVE-2026-92457

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify...

CVE-2026-92456

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints ...

CVE-2026-92455

yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office user to send SMS and email to arbitrary customers. Attackers can invoke POST /admin-api/crm/customer/send-sms and POST...

CVE-2026-92357

A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument currentsegment leads to information disclosure. The attack may be initiated remotely. The identifier o...

CVE-2026-86107

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...

CVE-2026-90049

CVE-2026-90049 affects the Linux kernel in the skb_zerocopy() function (net/skbuff). When skb_orphan_frags() fails, the helper calls skb_tx_error() on the source skb it does not own, prematurely completing the zerocopy uarg and clearing the SKBFL_SHARED_FRAG page-ownership flag. On Open vSwitch's...

CVE-2026-90048

CVE-2026-90048 is a slab-out-of-bounds write in the Linux kernel's fs/ntfs3 driver, specifically in ni_create_attr_list(). The function allocates a fixed-size buffer equal to the primary MFT record size, but when a crafted NTFS record contains many unnamed minimum-size resident attributes—each ex...

CVE-2026-90046

CVE-2026-90046 affects the Linux kernel's mm/page_alloc subsystem. The root cause is an unsafe use of spin_trylock() in an NMI context on uniprocessor (UP) builds, specifically on the free path of free_pages_nolock() . A prior commit fixed the alloc side but missed this free-side case. If BPF pro...

CVE-2026-90047

CVE-2026-90047 affects the Linux kernel DRM/XE driver (Intel GPU). The function get_flat_ccs_offset() computes the boundary of flat CCS (compression) storage and rounds it up to 128 KiB instead of rounding down to the allocator's page size. This publishes a small region of CCS-owned memory into t...

CVE-2026-90045

CVE-2026-90045 affects the Linux kernel USB gadget ffs (FunctionFS) subsystem. The root cause is that io_data stores a pointer to the submitting task's mm_struct without holding a reference while asynchronous requests remain pending. If the task exits before completion handling finishes, this res...

CVE-2026-90044

CVE-2026-90044 is a Use-After-Free vulnerability in the Linux kernel USB gadget FunctionFS (f_fs) subsystem. In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure is freed while the kiocb cancel function rema...

CVE-2026-90042

CVE-2026-90042 affects the Ceph filesystem client in the Linux kernel. The fscrypt subsystem's scatterlist crypto API requires buffers to reside in the linear mapping region, but the Ceph messenger client uses kvmalloc() , which can return vmalloc()-allocated buffers under memory fragmentation. C...

CVE-2026-90043

CVE-2026-90043 affects the zram module in the Linux kernel on 64-bit big-endian systems. The root cause is that the slot lock bit, stored as part of the __lock word, lands in the ac_time field instead of the flags field due to endianness. When ZRAM_TRACK_ENTRY_ACTIME is enabled, storing an access...

CVE-2026-90041

CVE-2026-90041 is a use-after-free in the Linux kernel's Sony HID driver (hid-sony). When sony_input_configured() links a controller into sony_device_list and a subsequent input_register_device() call fails, sony_probe() frees the devres-managed sony_sc without removing its list node. The next ma...

CVE-2026-90040

CVE-2026-90040 affects the Linux kernel KVM SEV-SNP (AMD Secure Nested Paging) subsystem. When the backing guest_memfd page for the guest-provided VMSA (Virtual Machine State Area) is invalidated (e.g., via PUNCH_HOLE or memslot deletion/move), KVM fails to invalidate the vCPU's cached control.vm...

CVE-2026-90039

This Linux kernel vulnerability affects the NFSD subsystem. Writing to /proc/fs/nfsd/unlock_filesystem or sending the NFSD_CMD_UNLOCK_FILESYSTEM/NFSD_CMD_UNLOCK_EXPORT netlink commands walks NFSv4 client hash tables, but the existing guard (nn->nfsd_serv) is set before nn->conf_id_hashtbl i...

CVE-2026-90038

CVE-2026-90038 affects the Linux kernel NFS daemon (NFSD ) component. The vulnerability is a use-after-free in nfsd4_revoke_export_states(): the function drops nn->client_lock across revoke_one_stid() and the subsequent read of clp->cl_minorversion, but the stateid reference it holds does n...

CVE-2026-90037

CVE-2026-90037 is a use-after-free in the Linux kernel NFSD (NFS Server Daemon) subsystem. An nfs4_openowner retained on nn->close_lru after its final CLOSE holds only a raw pointer to its nfs4_client. When the laundromat reaps timed-out entries and calls nfs4_put_stid(), a concurrent force_ex...

CVE-2026-90035

CVE-2026-90035 affects the Linux kernel AMD display driver (drm/amd/display ). The root cause is a division by zero in the get_estimated_bw() function, which divides by link->dpia_bw_alloc_config.bw_granularity—a value zeroed by reset_bw_alloc_struct() and only populated after DP_TUNNELING_BW_...

CVE-2026-90036

CVE-2026-90036 is a use-after-free in the Linux kernel's NFSD subsystem, occurring during blocked-lock reaping. A bare lock owner holds only a raw pointer to its nfs4_client without a reference keeping the client alive. When the per-net laundromat reaps such a lock, a concurrent force_expire_clie...

CVE-2026-90034

CVE-2026-90034 affects the Linux kernel's usb_mdc800 driver (USB Image MDC800). The root cause is the use of kmalloc() instead of kzalloc() for the irq_urb_buffer and download_urb_buffer allocations in usb_mdc800_init(). Because the memory is not zero-initialized, a shorter-than-expected message ...

CVE-2026-90032

CVE-2026-90032 is a use-after-free in the Linux kernel's usbtv media driver. The root cause is a lifecycle mismatch: an open ALSA PCM file can outlive a USB disconnect because usbtv_audio_free() uses snd_card_free_when_closed(). The disconnect path can then drop the V4L2 device reference and free...

CVE-2026-90033

CVE-2026-90033 is an out-of-bounds write in the Linux kernel 's ALSA usb-audio subsystem, specifically in the snd_usbmidi_us122l_output() function. The root cause is that the function uses a fixed transfer count of 2 on speeds below high-speed without checking ep->max_transfer. When a device (...

CVE-2026-90031

CVE-2026-90031 affects the Linux kernel's ene_ub6250 USB storage driver. The root cause is a race condition on the shared us->current_urb field: the delayed scan work (via usb_stor_Bulk_max_lun()) and the probe path (via ene_get_card_type()) both access it concurrently, with only the scan path...

CVE-2026-90029

CVE-2026-90029 is a use-after-free vulnerability in the Linux kernel 's USB storage realtek_cr driver, triggered on device disconnect . The root cause is that realtek_cr_destructor() calls timer_delete() before the chip containing the timer is freed, allowing the timer callback to rearm itself ag...

CVE-2026-90030

CVE-2026-90030 affects the Linux kernel DWC3 USB driver . The forceRM bit of the DEPCMD register controls how the EndTransfer command stops an active transfer. On DWC_usb31 v2.00a and v2.10a controllers , setting forceRM=1 caused a transfer aborted via the ep_dequeue path to remain active after E...

CVE-2026-90028

CVE-2026-90028 affects the Linux kernel USB Type-C driver for the hd3ss3220 controller. The root cause is that regulator_is_enabled() reports the aggregate regulator state rather than whether this particular consumer holds an enable reference. When another consumer enables VBUS first, the driver ...

CVE-2026-90027

CVE-2026-90027 affects the Qualcomm PMIC Type-C controller driver (usb: typec: qcom-pmic-typec) in the Linux kernel. The root cause is a use-after-free on pmic_typec_port: port_stop() returns before tcpm_unregister_port() destroys the TCPM worker thread. Flushing that worker during unregister can...

CVE-2026-90026

CVE-2026-90026 is a use-after-free vulnerability in the Linux kernel 's qcom-pmic USB Type-C PHY driver. The root cause is a race condition: pdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ handler schedules the work just before disable_irq(), the work executes after remove() ...

CVE-2026-90025

CVE-2026-90025 is an out-of-bounds array index in the Linux kernel's UCSI DisplayPort driver . The driver uses the GET_CURRENT_CAM response from the PPM to index into a port altmode array of size UCSI_MAX_ALTMODES. While the code checks that the value is not 0xff, it does not verify it is below U...

CVE-2026-90024

CVE-2026-90024 affects the Linux kernel USB gadget MIDI 2.0 function (drivers/usb/gadget/function/f_midi2.c). When the block direction is set to SNDRV_UMP_DIR_INPUT via configfs, the midi1_ep_out endpoint initialization is skipped during the gadget bind phase, leaving usb_ep->card as NULL . La...

CVE-2026-90023

CVE-2026-90023 is a null pointer dereference in the Linux kernel USB gadget f_mass_storage driver, specifically in fsg_common_set_num_buffers(). The root cause is that the earlier removal of fsg_num_buffers_validate() relied on Kconfig limits (2–256) for the buffer count n, but a user can write p...

CVE-2026-90022

CVE-2026-90022 is a use-after-free vulnerability in the Linux kernel 's USB gadget f_midi2 module. The f_midi2_opts_str_show() function takes the string lock internally, but its callers dereference the opts->info. pointer outside the lock. This races with f_midi2_opts_str_store(), which frees ...

CVE-2026-90021

In the Linux kernel , the USB gadget f_midi driver contained a bug where INIT_WORK was performed in f_midi_bind() rather than f_midi_alloc(). If f_midi_bind() was never executed, the work struct remained uninitialized, causing f_midi_free to trigger a warning in __flush_work due to work->func ...

CVE-2026-90019

CVE-2026-90019 affects the Linux kernel USB gadget subsystem. In the UVC function implementation, usb_put_function_instance() dereferences fi->fd to retrieve the module reference in the uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance(), so...