374932 matches found
CVE-2026-72751 Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content
CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...
CVE-2026-59112 Signature validation vulnerability affecting DigiDoc applications
Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority RIA libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4:...
CVE-2026-71959 Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log...
CVE-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...
CVE-2026-63106 ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php
ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...
CVE-2026-63105 ReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket Systems
ReadyEcommerce before 4.5.2 contains a stored cross-site scripting XSS vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue,...
CVE-2026-15060 systemd-machined: unprivileged users can terminate arbitrary processes
When systemd-machined = v259 or v258 with a custom polkit policy that allows register-machine access is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless...
CVE-2026-16742 systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user...
CVE-2026-15059 systemd-oomd: unprivileged users can terminate arbitrary processes
Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...
CVE-2026-18478 Stored XSS in Magnolia CMS
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-18370 Heap-based buffer overflow in entr
entr is vulnerable to Heap-based buffer overflow in runutility function. The function allocates a fixed-size heap buffer using mallocARGMAX and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy, which returns the total length of the...
CVE-2026-12984 Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601
Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...
CVE-2026-13206 Multiple Vulnerabilities in Zyxel's WAH7601 - OS Command Injection
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026...
CVE-2026-6373 Sensitive Data Exposure in Zyxel WAH7601 Router
Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...
CVE-2026-6374 Hardcoded Credentials in Zyxel WAH7601 Router
Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026...
CVE-2026-59233 Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...
CVE-2026-19278 Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...
CVE-2026-59090 Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource...
CVE-2026-19429 Jenkins Project Jenkins - Symlink Target Validation Bypass Arbitrary File Read
Jenkins FilePath.untarFrom all versions validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access can trigger extraction of a malicious tar via POST /job/name/build, planting symlinks to secrets/master.key, secrets/hudson.util.Secret, and...
CVE-2026-68428 KVM: x86/mmu: Fix use-after-free on vendor module reload
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...
CVE-2026-68427 gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1xboclearcachedmappings host1xbounpin drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cach...
CVE-2026-68426 xfrm: fix stale skb->prev after async crypto steals a GSO segment
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...
CVE-2026-68425 IB/mad: Drop unmatched RMPP responses before reassembly
In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, aft...
CVE-2026-68424 mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroyjoins mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat leads to a use after free. Fix this by moving mtdvirtconcatputmtddevices before...
CVE-2026-68423 mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()
In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroy mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat after that leads to a use-after-free. Fix it by moving mtdvirtconcatputmtddevices...
CVE-2026-68422 btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix root leak if its reloc root is unexpected in mergerelocroots If we have an unexpected relocroot for our root, we jump to the out label but never drop the reference we obtained for root, resulting in a leak. Add a missi...
CVE-2026-68421 sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
In the Linux kernel, the following vulnerability has been resolved: schedext: Don't warn on core-sched forced idle in putprevtaskscx putprevtaskscx warns when a runnable task drops to a lower schedclass without SCXOPSENQLAST, on the assumption that balanceone would have kept it running. Core...
CVE-2026-68420 xfrm: reject optional IPTFS templates in outbound policies
In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of-bounds read in xfrmstatefind which flows from xfrmtmplresolveone. Commit 3d776e31c841 "xfrm: Reject optional tunnel/BEET mode templates in...
CVE-2026-68419 RDMA/irdma: Prevent rereg_mr for non-mem regions
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent reregmr for non-mem regions When a QP/CQ/SRQ is created, a two step process is used where the buffer is allocated in userspace and explicitly registered with the normal regmr mechanism prior to creating the...
CVE-2026-68418 RDMA/irdma: Prevent user-triggered null deref on QP create
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp-iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp-iwpbl is...
CVE-2026-68417 RDMA/siw: publish QP after initialization
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siwcreateqp currently calls siwqpadd before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being...
CVE-2026-68416 mtd: fix double free and WARN_ON in add_mtd_device() error paths
In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARNON in addmtddevice error paths When deviceregister or mtdnvmemadd fails inside addmtddevice for a partition, the error handling triggers mtdrelease via putdevice or deviceunregister. mtdrelease calls...
CVE-2026-68415 xfrm: clear mode callbacks after failed mode setup
In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...
CVE-2026-68414 wifi: cfg80211: cancel sched scan results work on unregister
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211schedscanresults can queue rdev-schedscanreswk from a driver result notification while a scheduled scan request is present. The work callback recovers the...
CVE-2026-68413 wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100pciinitone The memory allocated in the ipw2100allocdevice function is not freed in some of the error paths in ipw2100pciinitone. Fix that by converting the direct return into a...
CVE-2026-68412 wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...
CVE-2026-68411 wifi: mac80211_hwsim: clamp virtio RX length before skb_put
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: clamp virtio RX length before skbput hwsimvirtiorxwork passes the virtqueue used-ring length reported by the device straight to skbput on a fixed-size receive skb. A backend reporting a length larger than the...
CVE-2026-68410 wifi: libertas: fix memory leak in helper_firmware_cb()
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...
CVE-2026-68409 wifi: mac80211: defer link RX stats percpu free to RCU
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU staremovelink frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: stainfofreelink&alloc-info; kfreercualloc, rcuhead; The...
CVE-2026-68408 wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: convert pmsrfreewk to wiphywork to fix deadlock When a netlink socket that owns a PMSR session is closed, cfg80211releasepmsr clears the request's nlportid and queues pmsrfreewk to call cfg80211pmsrprocessabort...
CVE-2026-68407 wifi: nl80211: free RNR data on MBSSID mismatch
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...
CVE-2026-68406 wifi: cfg80211: validate PMSR FTM preamble range
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate PMSR FTM preamble range PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range. Reject out-of-range values before using them in the parser capability bit test using...
CVE-2026-68405 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb before dropping the lock...
CVE-2026-68404 wifi: cfg80211: use wiphy work for socket owner autodisconnect
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211netlinknotify walks the cfg80211 wireless device list when a NETLINKGENERIC socket is released. If the socket owns a connection, the notifier queues the embedd...
CVE-2026-68403 wifi: brcmfmac: initialize SDIO data work before cleanup
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...
CVE-2026-68402 wifi: cfg80211: bound element ID read when checking non-inheritance
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211iselementinherited reads the first data octet of the candidate element id = elem-data0 to look it up in an extension non-inheritance list. It does so aft...
CVE-2026-68401 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix out-of-bound writes in ffasetupandtransmit Sashiko locally reports multiple out-of-bound issues in ffasetupandtransmit: 1 Writing epmemaccess-reserved can write out of bounds for FFA versions 1.2 as...
CVE-2026-68400 firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...
CVE-2026-68399 bpf: Fix UAF in sock clone early bailouts
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...
CVE-2026-68398 ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tprecv runs in the L2TP UDP-encap softirq RX path: l2tpudpencaprecv - l2tprecvcommon - pppol2tprecv - pppinput&po-chan It runs under rcureadlock holding...