CVE-2026-53760

Admidio versions 5.0.11 and prior are affected by a CSRF vulnerability in the modules/plugins.php endpoint. Plugin install, uninstall, and update operations are handled via GET requests without CSRF token validation. Because browsers send SameSite=Lax cookies on top-level navigations, an attacker...

CVE-2026-73064

CVE-2026-73064 affects Mbed TLS , where a fault in the random generator can compromise TLS data integrity . The Mbed TLS project has released updated packages addressing this and other vulnerabilities (per MGASA-2026-0375 ). No specific version bounds, exploit code, or in-the-wild exploitation de...

CVE-2026-61688

SolidInvoice , an open-source invoicing platform, is affected by a cross-user information disclosure vulnerability prior to version 3.0.1 . An authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveCom...

CVE-2026-61614

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1 , its REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser ...

CVE-2026-85769

A heap out-of-bounds read in libtpms (software TPM 2.0 emulation, commonly deployed via swtpm in virtual machines) occurs during TPM 2.0 volatile-state restoration. An attacker-controlled oversized skip-block length in block_skip_read() drives a signed size counter negative; a subsequent signed-t...

CVE-2026-73848

Emlog , an open-source website building system, is affected by a stored XSS in versions 2.6.29 and prior . Tag names rendered in the article editor are not HTML-encoded. Because the application uses addslashes() instead of proper HTML entity encoding, a single quote (') stored in a tag name is de...

CVE-2026-53757

Emlog , an open-source website building system, is affected in versions 2.6.29 and prior by a Zip Slip path traversal in the emUnZip() function. The function extracts all ZIP entries via ZipArchive::extractTo() but validates the ../ traversal sequence only for the first entry's subdirectory , all...

CVE-2026-53758

Emlog versions 2.6.29 and prior are affected by a stored cross-site scripting (XSS) vulnerability. Article content is processed by the Parsedown Markdown parser without enabling safe mode, allowing raw HTML—including [removed] tags—embedded in Markdown to pass through unescaped and rendered with ...

CVE-2026-53756

Emlog CMS Pro, an open-source website building system, contains a blind SQL injection in the User_Model::getUserDataByLogin() method prior to version 2.6.16. The root cause is the $account parameter being directly interpolated into SQL queries without filtering. The vulnerability is reachable via...

CVE-2026-61608

SolidInvoice , an open-source invoicing platform, is affected by a flaw in its UserInvitation entities prior to version 3.0.1 . The root cause is the absence of an expiry timestamp on invitation tokens, causing mailed invitation links to remain valid indefinitely. An attacker who obtains a leaked...

CVE-2026-61686

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1 , the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize() after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP s...

CVE-2026-82538

ILIAS before versions 9.22, 10.10, and 11.3 is affected by a SQL injection in the repository trash table . The sort field from HTTP requests is passed directly into the ORDER BY clause without validation against declared sortable columns. Authenticated users with write permission on any container...

CVE-2026-85656

CVE-2026-85656 is an OS command injection vulnerability in the log4j-cve-2021-44228-hotpatch package in Amazon Linux versions before 1.3-9 . A local user with low privileges can execute arbitrary commands with root privileges by leveraging embedded newline characters in a Java process's executabl...

CVE-2026-50553

Note Mark (open-source Go note-taking app, module github.com/enchant97/note-mark/backend) is vulnerable to a path traversal in its data-export CLI commands (migrate export and migrate export-v1) prior to version 0.19.5 . The root cause is an unanchored regex ([a-z0-9-]+) used to validate book and...

CVE-2026-18149

undici 's RetryHandler can leave an already-exposed response body orphaned when a server sends a partial body with a declared Content-Length, closes the connection, and the retry returns a non-retryable status (e.g., 400). The original body stream is neither ended nor destroyed, so reads on it ne...

CVE-2026-80913

CVE-2026-80913 affects the SELinux subsystem of the Linux kernel . The root cause is that p_bools.nprim in a loaded SELinux policy image can declare a count larger than the number of boolean values actually present, causing cond_index_bool() to leave NULL entries in bool_val_to_struct[]. Consumer...

CVE-2026-80912

This Linux kernel vulnerability affects the SELinux subsystem in security_get_classes(). The function sizes an array by p_classes.nprim and fills entries at index value - 1, so a class value the policy never defines leaves a NULL entry. sel_make_classes() then passes every entry to sel_make_dir()...

CVE-2026-80911

CVE-2026-80911 affects the Linux kernel ASoC SOF (Sound Open Firmware) audio driver. The vulnerability resides in the error path of sof_widget_setup_unlocked() . When either tplg_ops->dai_config or widget_kcontrol_setup fails during widget setup, sof_widget_free_unlocked() is called twice, cau...

CVE-2026-80910

CVE-2026-80910 affects the Linux kernel's lpass-wsa-macro ASoC codec driver. The root cause is that the get and put callbacks for the "EAR SPKR PA Gain" and four "WSA RX Mux" * enumerated controls access the value via ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enum...

CVE-2026-80909

CVE-2026-80909 affects the drm/amdgpu driver in the Linux kernel , specifically the UVD (Unified Video Decoder) subsystem. The vulnerability arises when a UVD message containing an invalid number of H.265 references is not validated, leading to an integer overflow during the subsequent calculatio...

CVE-2026-80908

CVE-2026-80908 affects the Linux kernel drm/amdgpu subsystem. When a UVD (Unified Video Decoder) message with dimensions above 4096 is not rejected, it can trigger a potential overflow in DPB (Decoded Picture Buffer) size calculations . The fix, cherry-picked from upstream commit 05e1387d151f7156...

CVE-2026-80907

This CVE affects the drm/amdgpu driver in the Linux kernel, specifically the UVD (Unified Video Decoder) subsystem used for hardware-accelerated H.264 decoding. The bug is an incorrect DPB (Decoded Picture Buffer) minimum size calculation : the code derived the number of reference frames from the...

CVE-2026-80906

CVE-2026-80906 affects the Linux kernel net: packet subsystem. In packet_parse_headers(), when handling a VLAN-tagged frame, skb_set_network_header() advances the network header past the VLAN tag before skb_probe_transport_header() is called. This leaves skb->protocol set to the outer VLAN Eth...

CVE-2026-80905

Linux kernel tap driver vulnerability in tap_get_user_xdp(). When processing VLAN-tagged frames (e.g., ETH_P_8021Q), skb_set_network_header() was called before skb_probe_transport_header(), causing the flow dissector to misinterpret the inner protocol header (e.g., an IP header) as a VLAN header....

CVE-2026-80904

CVE-2026-80904 is a Linux kernel vulnerability in the net/tls (TLS offload) subsystem. When an asynchronous TLS decryption fails, tls_sw_recvmsg() and tls_sw_read_sock() correctly check async_wait.err and abort the read, but tls_sw_splice_read() performs no such check. As a result, a splice opera...

CVE-2026-80903

CVE-2026-80903 affects the Linux kernel's drm/xe/oa component (Intel Xe graphics driver, Open Animation subsystem). The root cause is a memory leak : xe_oa_emit_oa_config() releases sync entries and the syncs array only on its success path. When it fails before the point of no return (fence alloc...

CVE-2026-18540

CVE-2026-18540 affects undici (Node.js HTTP client library). The retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response, presenting the original status and headers. This causes the response body to exceed the observed Content-L...

CVE-2026-18745

CVE-2026-18745 is rejected or withdrawn by its CNA and does not represent an active vulnerability entry.

CVE-2026-57166

CVE-2026-57166 is a pre-authentication stack buffer overflow in the PJLIB-UTIL telnet CLI front-end of PJSIP , an open-source multimedia communication library written in C. When rendering feedback for a command line, several handling paths write an attacker-influenced amount of data into fixed-si...

CVE-2026-57165

PJSIP (PJLIB-UTIL) contains a stack buffer overflow in the telnet CLI front-end (handle_up_down() in cli_telnet.c), triggered when redrawing the command line during history recall. The accumulated line-redraw data can exceed a fixed-size stack buffer, potentially causing application termination ....

CVE-2026-57164

CVE-2026-57164 affects PJSIP , a free and open source multimedia communication library written in C. A heap buffer overflow exists in the PJLIB-UTIL HTTP client (http_client.c) when buffering an HTTP response body. When growing the response buffer, an incorrect size calculation based on the serve...

CVE-2026-57163

CVE-2026-57163 is a stack buffer overflow in PJSIP's GnuTLS TLS backend , specifically in tls_cert_get_info() in ssl_sock_gtls.c, when parsing the Subject Alternative Name (SAN) extension of a peer certificate. An incorrect buffer-size value causes an oversized SAN entry to be written past a fixe...

CVE-2026-57162

CVE-2026-57162 is a stack buffer overflow in PJSIP 's SRTP/SDES media transport, specifically in sdes_encode_sdp() in transport_srtp_sdes.c. During SDP offer/answer negotiation, a=crypto attributes from a remote peer are collected into a fixed-size array without bounding their count. A remote att...

CVE-2026-57161

PJSIP , an open-source multimedia communication library written in C, contains a stack buffer overflow in PJSUA's update_service_route() function (pjsua_acc.c). When processing a 2xx response to a REGISTER request, Service-Route URIs are stored into a fixed-size array without bounding the number ...

CVE-2026-57160

PJSIP , an open-source multimedia communication library written in C, contains a buffer overflow in pjsip_generic_array_hdr_print() (in pjsip/src/pjsip/sip_msg.c), the function responsible for serializing generic array headers such as Allow, Require, Supported, and Unsupported. Under certain outp...

CVE-2026-57159

PJSIP is an open-source multimedia communication library in C. Prior to commit 673b978 , a crafted remote SDP offer or answer can trigger an out-of-bounds read and write in assign_pt_and_update_map() within pjmedia/src/pjmedia/sdp_neg.c, which indexes fixed-size internal tables using payload-type...

CVE-2026-80902

CVE-2026-80902 affects the sun6i-dma driver in the Linux kernel's dmaengine subsystem. When terminating DMA transfers, only cyclic descriptors were properly reclaimed; non-cyclic descriptors and their LLI chains were permanently leaked, resulting in a memory leak that accumulates over repeated DM...

CVE-2026-80901

Linux kernel IPVS (IP Virtual Server) contains a flaw in checksum validation for ICMPv6 traffic. Specifically, ip_vs_in_icmp_v6() was missing checksum validation for ICMPv6 packets from clients, and handle_response_icmp() was missing the pseudo-header calculation when validating ICMPv6 messages f...

CVE-2026-80899

CVE-2026-80899 affects the Linux kernel's EROFS filesystem fscache backend . The fscache subsystem introduced a hard dependency on netfs for a local filesystem and imposed a kernel-defined caching hierarchy considered inflexible compared to fanotify pre-content hooks. The feature had been depreca...

CVE-2026-80900

CVE-2026-80900 affects the Linux kernel 's ASoC SDCA (ALSA System on Chip, SDCA) component. The root cause is an UMP (Unified Multiplex Protocol) message size check that incorrectly passes when the message offset exceeds the buffer length, allowing invalid sizes to go undetected. The fix refactor...

CVE-2026-80898

CVE-2026-80898 affects the Linux kernel netfs subsystem. In netfs_pgpriv2_copy_to_cache(), a folio is marked with PG_private_2 before being appended to the copy-to-cache rolling buffer by netfs_pgpriv2_copy_folio(). If the append fails, the folio is not queued for cache writeback, yet the PG_priv...

CVE-2026-80897

CVE-2026-80897 affects the Linux kernel netfs subsystem. In netfs_prepare_read_iterator(), readahead folios are batched in put_batch so that references can be dropped after the I/O iterator is prepared. If rolling_buffer_load_from_ra() fails after earlier folios have been batched, the function re...

CVE-2026-80896

CVE-2026-80896 affects the mshv (Microsoft Hyper-V) component of the Linux kernel . The root cause is a race condition in mshv_irqfd_deassign(): it traverses pt_irqfds_list without holding the required pt->pt_irqfds_lock spinlock, racing with the EPOLLHUP path in mshv_irqfd_wakeup(). A second ...

CVE-2026-80895

CVE-2026-80895 is a memory-ordering defect in the Linux kernel's mshv (Microsoft Hyper-V) hypervisor driver . The root cause is that mshv_partition_ioctl_create_vp() publishes a virtual-processor (VP) pointer into partition->pt_vp_array without an acquire/release barrier, while mshv_try_assert...

CVE-2026-80894

CVE-2026-80894 affects the Linux kernel iommufd subsystem . The bug is a parameter mismatch in iommufd_hwpt_replace_device(), which passes the new hardware page table (hwpt) to iommufd_auto_response_faults() instead of the old one. Because fault groups are queued under the hwpt active at fault-de...

CVE-2026-80893

CVE-2026-80893 is a Linux kernel vulnerability in the mm/hugetlb subsystem. The root cause lies in copy_hugetlb_page_range(), which clears the userfaultfd write-protect (uffd-wp) bit on swap entries using huge_pte_clear_uffd_wp(). This function operates on the present-PTE bit position, but swap e...

CVE-2026-80892

CVE-2026-80892 affects the Linux kernel's EROFS filesystem driver (fs/erofs/decompressor_lzma.c). When the lzma_streams module parameter is unset, the global MicroLZMA stream pool is sized from num_possible_cpus() , and each stream preallocates an image-supplied dictionary of up to 8 MiB . On hig...

CVE-2026-80891

CVE-2026-80891 affects the Linux kernel 's KVM s390 PCI subsystem. The vulnerability arises when the AIBV (Adaptive Interrupt Bit Vector) size—derived from the NOI and AIBVO—exceeds a single page boundary, making it impossible to safely pin the guest page. Additionally, the AISB (Adaptive Interru...

CVE-2026-80890

This Linux kernel SCTP vulnerability affects sctp_unpack_cookie(), which incorrectly skips cookie expiration checks whenever an association already exists—a broader exception than permitted by RFC 9260 Section 5.2.4 . The bug allows an expired Action A restart cookie to reach sctp_sf_do_dupcook_a...

CVE-2026-80889

CVE-2026-80889 affects the Linux kernel CAN ISOTP (ISO-Transport Protocol) module. This patch is a follow-up to commit cf070fe33bfb ("can: isotp: serialize TX state transitions under so->rx_lock") and resolves multiple race and ordering issues identified by sashiko-bot, including: a stale call...