CVE-2026-93226

The Linux kernel contains a race condition in the ipv6 networking stack. The function rt6_nh_dump_exceptions() improperly uses hlist_for_each_entry() to iterate over RCU-protected exception lists . Because the caller holds rcu_read_lock() but fails to hold rt6_exception_lock, the function rt6_ins...

CVE-2026-96873

The Mediawiki - CirrusSearch extension is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability due to the improper neutralization of input during web page generation. This issue specifically affects versions through 1.46.0 . While the CVSS 4.0 score indicates a Medium severity with ...

CVE-2026-77581

BentoPDF, a self-hostable client-side PDF toolkit, contains a Server-Side Request Forgery (SSRF) vulnerability in the cloud/cors-proxy-worker.js component (versions 2.8.6 and earlier ). The root cause is a DNS-based hostname allowlist bypass where the isPrivateOrReservedHost() function validates ...

CVE-2025-32000

The HCL Sametime application is vulnerable to insufficient input sanitization due to the improper sanitization of user input. This flaw allows malicious actors to leverage implicitly or explicitly trusted input to target the application. Impacted versions are addressed in HCL Sametime 12.0.4 . It...

CVE-2026-93225

The Linux kernel contains a vulnerability in the fsl-imx8mq-usb phy driver where a typec switch leak occurs during the probe error path. Specifically, if imx95_usb_phy_get_tca() succeeds but the subsequent probe fails, the switch leaks because the cleanup path was only located in .remove(), which...

CVE-2026-93224

The Linux kernel contains a vulnerability in the svcrdma component where svc_rdma_accept() fails to properly handle the error path when rpcrdma_rn_register() has not succeeded. Because svcxprt_rdma is kzalloc'd, the cleanup block unconditionally calls rpcrdma_rn_unregister, causing it to xa_erase...

CVE-2026-93223

The Linux kernel contains a vulnerability in the tegra-video media driver. Specifically, the tegra_vip_channel_of_parse() function incorrectly handles reference counting by initializing np from dev->of_node without taking a reference, while its error paths proceed to call err_node_put(). This ...

CVE-2026-93222

The Linux kernel contains a vulnerability where the send_signal_locked() function rewrites sender IDs for the target namespace. Because group sends reuse the same siginfo structure, one recipient can inadvertently affect the next. The issue is resolved by copying the siginfo before modification. ...

CVE-2026-56739

Logto versions prior to 1.43.0 are vulnerable to Server-Side Request Forgery (SSRF) because the application fails to validate outbound destinations controlled by administrators. Specifically, Webhook delivery in packages/core/src/libraries/hook/utils.ts can access cloud metadata addresses. Additi...

CVE-2026-63203

In Logto versions 1.31.0 through 1.42.0 , a vulnerability exists in the Account API handlers located in packages/core/src/routes/account/third-party-tokens.ts. The root cause is that the handlers authenticate users but fail to require the identities scope , allowing callers with only an openid sc...

CVE-2026-67233

The messaging and streaming broker RabbitMQ is vulnerable to an authorization bypass in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1 . When both the rabbitmq_shovel and rabbitmq_shovel_management plugins are enabled, a user with a monitoring tag can perform unauthorized state-chang...

CVE-2026-93221

The Linux kernel is vulnerable to a race condition in the nfsd component due to a lack of serialization when accessing boolean fields in nfsd_net. Specifically, the nfsd4_end_grace() function uses a plain boolean for grace_ended, allowing concurrent paths—such as the laundromat path and the RECLA...

CVE-2026-93220

The Linux kernel contains a vulnerability in sched_ext where the kick_sync_wait_bal_cb() function incorrectly assumes it always executes on the request queue's (rq ) own CPU. Because the rq lock can be dropped while the callback is queued, it may be executed on a foreign CPU . This leads to compa...

CVE-2026-93219

The Linux kernel contains a vulnerability in the clocksource/drivers/timer-sun4i component. The sun4i_clkevt_next_event() function compensates for timer synchronization delays by programming an interval that allows for a zero-tick interval when the clockevents core calls set_next_event() with evt...

CVE-2026-93218

The Linux kernel contains a vulnerability in the mm/huge_memory component related to how it handles device-private Page Middle Directories (PMDs). A race condition occurs when an HMM-based GPU driver interacts with madvise(MADV_FREE). Specifically, migrate_vma_pages() can flip a PMD to a device-p...

CVE-2026-93217

The Linux kernel contains a vulnerability in mm/madvise where madvise_cold_or_pageout_pte_range() can trigger a kernel panic. The issue occurs because pmd_is_huge() returns true for device-private PMDs, causing a VM_BUG_ON() assertion to trip when the PMD is not present. This is potentially trigg...

CVE-2026-93216

The Linux kernel contains a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in mm/page_owner. The function print_page_owner_memcg() initially reads page->memcg_data but subsequently re-reads it locklessly in page_memcg_check(page) and PageMemcgKmem(page). If a page is concurrently freed an...

CVE-2026-93215

The Linux kernel contains a double free vulnerability within the cdx component. Specifically, in the cdx_create_res_attr() function, a failure during sysfs_create_bin_file() leads to res_attr being freed without setting cdx_dev->res_attr[num] to NULL . This leaves a dangling pointer in the arr...

CVE-2026-93213

The Linux kernel contains an out-of-bounds read vulnerability in the of_alias_scan() stem parser. The flaw occurs because the parser evaluates isdigit(*(end - 1)) before verifying that end > start. This logic error causes the system to read one byte before the property name when the name is em...

CVE-2026-93214

A deadlock vulnerability exists in the Linux kernel within the usb gadget f_tcm component. The issue occurs in usbg_make_tpg() because it holds the dep_lock while calling configfs_depend_item_unlocked(), which acquires the configfs root inode lock. This creates a circular lock dependency with con...

CVE-2026-93212

A vulnerability exists in the Linux kernel nfsd service where a NULL pointer dereference occurs in nfsd_file_net_dispose(). During per-net teardown, nn->nfsd_serv is cleared before the filecache laundrette is shut down. This allows the service thread to execute a dispose pass that identifies e...

CVE-2026-93211

The Linux kernel contains a vulnerability in the nfsd component where the DRC hash table is not fully initialized before the shrinker is registered. On weakly-ordered architectures such as arm64 and ppc , a shrinker scan can observe the drc_hashsize before the bucket list heads are initialized, r...

CVE-2026-93210

The Linux kernel contains a vulnerability in the SMB client component where the DFS cache is not properly hardened against invalid target hints. Specifically, the get_tgt_name() function returns ERR_PTR(-ENOENT) when ce->tgthint is NULL, while dfs_cache_noreq_update_tgthint() incorrectly assum...

CVE-2026-93209

The Linux kernel contains a vulnerability in the Bluetooth hci_core component where BT enable fails intermittently with -ETIMEDOUT (-110) . The root cause is that hci_send_cmd_sync() uses skb_clone() to copy a sent command into hdev->req_skb ; under memory pressure, this clone operation fails,...

CVE-2026-93208

The Linux kernel contains a race condition in KASAN involving cache shrinking and CPU hotplug . Specifically, kmem_cache_shrink() fails to hold the cpus_read_lock(), allowing a race where objects are moved to a CPU's shrink_qlist just before that CPU goes offline. Because the offline CPU's list i...

CVE-2026-93207

The Linux kernel is affected by a SUNRPC vulnerability where the svcauth_gss_decode_credbody() function fails to properly clear the rpc_gss_wire_cred field before decoding. Because this storage is reused across requests, early decode failures leave partially decoded states mixed with residues fro...

CVE-2026-93206

The Linux kernel contains a vulnerability in the procfs interface where proc_bus_pci_read() incorrectly checks for CAP_SYS_ADMIN using the credentials of the task calling read() rather than the process that opened the file. This inconsistency with the sysfs behavior allows a privileged process to...

CVE-2026-93205

The Linux kernel contains a vulnerability in the iommu/arm-smmu-v3 component due to an incorrect cleanup order during device removal. Specifically, arm_smmu_device_remove() manually frees the IOPF queue and destroys the vmid_map while IRQs and queues are managed by devm . Because devm unwinds onl...

CVE-2026-92680

Araxis Merge for Windows versions 2011.4074 through 2026.0 are vulnerable to insufficient protection of user-configured credentials for remote servers. The software stores these credentials in the Windows registry without applying adequate cryptographic protection. An authenticated, non-administr...

CVE-2026-97225

A code injection vulnerability exists in DbGate versions up to 7.2.5-beta.5 within the JSON Runner component. The flaw resides in an unknown function of the file packages/api/src/controllers/runners.js, where manipulating the comment.text or script.schedule arguments can allow for remote code exe...

CVE-2026-56737

The open source FAQ web application phpMyFAQ versions 3.2.0 through 4.1.5 contains an authentication bypass in its two-factor authentication (2FA) flow. An unauthenticated attacker can bypass the password requirement by submitting a target account’s numeric user ID and a valid or brute-forced six...

CVE-2026-73064

The Mbed TLS library (versions 3.2.0 through 3.6.6 and 4.0.0 through 4.1.0 ) is vulnerable to a flaw where a failure in the entropy source allows an attacker to remove or inject bytes into the start of a TLS stream. This issue specifically impacts TLS 1.3 servers . The root cause is linked to a r...

CVE-2026-58008

A stack-based buffer overflow vulnerability exists in Altera Trusted Firmware on HPS , specifically due to an unchecked HKDF key-size input in EL3 . This flaw allows for the exploitation of improperly configured or implemented memory protections. The vulnerability affects Trusted Firmware version...

CVE-2026-58007

The Altera Trusted Firmware on HPS is vulnerable to an untrusted pointer dereference due to an unchecked SDM mailbox response address . This flaw allows for the exploitation of improperly configured or implemented memory protections , specifically leading to EL3 secure-memory corruption . The vul...

CVE-2026-58006

A high-severity untrusted pointer dereference vulnerability exists in Altera Trusted Firmware on HPS, affecting versions through socfpga_v2.14.0 . The root cause is insufficient validation of the Mailbox Output Pointer in the SoCFPGA BL31 component, which enables EL3 secure-memory corruption . Th...

CVE-2026-58005

Altera Trusted Firmware on HPS is vulnerable to an out-of-bounds read through unvalidated SiP v2 mailbox pointers . This flaw allows for Privilege Escalation and Overflow Buffers , specifically enabling non-secure EL1 access to arbitrary physical addresses through EL3 . The vulnerability affects ...

CVE-2026-58004

An out-of-bounds read vulnerability exists in Altera Trusted Firmware on HPS affecting versions up to and including socfpga_v2.14.0 . The root cause involves a crafted oversized firmware image which triggers an EL3 stack overflow during VAB authentication . This vulnerability can lead to Privileg...

CVE-2026-13467

Altera Trusted Firmware on HPS is affected by an out-of-bounds write vulnerability caused by systemic missing address validation in SiP SMC handlers . This flaw allows for the exploitation of improperly configured or implemented memory protections. The vulnerability impacts versions up to and inc...

CVE-2026-13466

A buffer overflow vulnerability exists in Altera Trusted Firmware on HPS due to an incorrect calculation of buffer size . This issue affects versions up to and including socfpga_v2.14.0 . The vulnerability allows for buffer overflows , which could impact the integrity and availability of the syst...

CVE-2026-13465

A stack-based buffer overflow vulnerability exists in the Altera Trusted Firmware on HPS . The root cause is the exploitation of improperly configured or implemented memory protections . This vulnerability affects versions through socfpga_v2.14.0 . The impact includes high integrity and availabil...

CVE-2026-97362

HFS2 version 2.4.0 and earlier is vulnerable to a denial of service (DoS) flaw. An unauthenticated attacker can send a single crafted request to trigger a hung serving thread that enters a busy loop . This results in a complete and persistent loss of availability, rendering the file server unresp...

CVE-2026-90959

A path traversal vulnerability exists in pulpcore within the content upload API's file_url parameter. The root cause is a validation mismatch: the system rejects URLs starting with file://, but Python's URL parser accepts the file: scheme without double slashes. This allows an authenticated user ...

CVE-2026-97224

A cross-site scripting (XSS) vulnerability exists in Excalidraw versions up to 0.18.1 . The flaw is located within an unknown function in the packages/excalidraw/data/restore.ts file, specifically affecting the Imported File Handler component. An attacker can achieve remote execution of XSS by ma...

CVE-2026-77707

The HAVELSAN Inc. Liman Render Engine (versions 1.0 before 1.2-75 ) is vulnerable to an improper certificate validation flaw. This security weakness allows an Adversary in the Middle (AiTM) to intercept or manipulate traffic due to TLS certificate validation being disabled specifically for Keyclo...

CVE-2026-65422

A flaw in the authorization mechanism for the Media Gateway API in Genetec Security Center may allow a user lacking playback privileges to generate video thumbnails . The vulnerability impacts confidentiality as indicated by the CVSS score. Remediation is available in Security Center version 5.14...

CVE-2026-77703

The HAVELSAN Inc. Liman Render Engine (versions 1.0 before 1.2-75 ) is vulnerable to an SSH Host Key Verification Bypass due to a key exchange without entity authentication. This flaw enables an Adversary in the Middle (AiTM) attack. The vulnerability has a CVSS 3.1 base score of 5.9 (Medium) , i...

CVE-2026-97404

In OpenStack Zaqar versions before 22.0.2 , the WSGI transport mishandles the URL-Signature header . An unauthenticated remote attacker who knows a target project's UUID can bypass Keystone authentication and pre-signed URL verification by sending a request with an empty URL-Signature header. Thi...

CVE-2026-82094

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a path traversal vulnerability (CWE-22 ) due to improper limitation of a pathname to a restricted directory. A remote authenticated attacker could exploit this to traverse directories on the system. IBM strongly recommends upgrading to ...

CVE-2026-82093

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to arbitrary code execution because of the unsafe deserialization of untrusted data. This flaw could be exploited by a remote authenticated attacker . No specific remediation, exploit details, or affected components beyond the software ver...

CVE-2026-81552

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is vulnerable to a flaw that could allow a remote authenticated attacker to execute arbitrary commands . The root cause is identified as the improper neutralization of environment variables . This vulnerability carries a High base severity (CVSS...