423808 matches found
CVE-2026-90193 mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...
CVE-2026-90153 ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
CVE-2026-90150 pnfs/blocklayout: Fix device leaks on parse failure
In the Linux kernel, the following vulnerability has been resolved: pnfs/blocklayout: Fix device leaks on parse failure blparseconcat and blparsestripe allocate a child device array and then parse each child in turn. If parsing a child fails, the failed child is not counted in nrchildren and the...
CVE-2026-90146 bpf, xdp: move offload check into dev_xdp_install()
In the Linux kernel, the following vulnerability has been resolved: bpf, xdp: move offload check into devxdpinstall bpfxdplinkupdate calls devxdpinstall directly and skips devxdpattach, so the checks in devxdpattach do not run. A user can make an XDP link with a normal program and then swap in an...
CVE-2026-90100 ptp: netc: fix period truncation and potential divide-by-zero in PEROUT
In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The maxperiod bound in nettimerenableperout was computed as: maxperiod = u64NETCTMRDEFAULTFIPER + integralperiod; which exceeds U32MAX when integralperiod 0...
CVE-2026-90098 net: sparx5: fix sleep in atomic context in MAC table access
In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...
CVE-2026-90094 arm64: process: Fix context switching MTE store-only tag check
In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...
CVE-2026-90081 net/rds: use wq_has_sleeper() in rds_cong_map_updated()
In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...
MINI-VRCV-8QQP-VF4C
Bulletin has no description...
MINI-9XH9-HQ3R-H82C
Bulletin has no description...
MINI-29WH-F62C-M569
Bulletin has no description...
MINI-7HFF-2VGC-6XXH
Bulletin has no description...
MINI-FRV6-59J7-5RWX
Bulletin has no description...
MINI-GC5W-6P8P-6JF9
Bulletin has no description...
MAL-2026-16258 Malicious code in randompkgd (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0ebd1d508d7c8ae4aa2a0693b9d07720a837307b1a5c343c931c6e7d72d6390 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CGA-45Q9-CX9R-FXPH
Bulletin has no description...
CVE-2026-92937 vm2 3.11.6 Remote Code Execution via Promise call/apply
vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host...
CVE-2026-92973 ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8
ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...
CGA-27XC-3889-JM6V
Bulletin has no description...
EEF-CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Summary Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...
EEF-CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication
Summary Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the...
EEF-CVE-2026-82761 Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
Summary Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is mean...
EEF-CVE-2026-82685 Confirmation token accepted on any record in AshAuthentication
Summary Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's...
CVE-2026-82760 Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key. AshAuthentication.Base.decode62/1 in lib/ashauthentication/base.ex splits its argument into one...
EEF-CVE-2026-82759 Reversible IP address pseudonymisation in AshAuthentication audit log hash mode
Summary Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows readers of the audit store to recover the client IP addresses that the audit log add-on's :hash privacy mode is meant to pseudonymise. AshAuthentication.AddOn.AuditLog.IpPrivacy.haship/1...
RLSA-2026:67832 Important: tesseract security update
A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005. Security Fixes: tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata CVE-2026-73066 For more...
BIT-MONGODB-2026-82056 Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been...
BIT-MONGODB-2026-18697 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos router process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the...
RHSA-2026:68234 Red Hat Security Advisory: libsoup security update
Bulletin has no description...
RLSA-2026:67585 Moderate: firewalld security update
firewalld is a firewall service daemon that provides a dynamic customizable firewall with a D-Bus interface. Security Fixes: firewalld: firewalld: Local unprivileged user can modify firewall state due to D-Bus setter mis-authorization CVE-2026-4948 For more details about the security issues,...
CLEANSTART-2026-UX51431 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
Multiple security vulnerabilities affect the velero-fips package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...
CLEANSTART-2026-FS45115 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
Multiple security vulnerabilities affect the atlantis package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...
UBUNTU-CVE-2026-61642
Request Smuggling in HTTP Transfer-Encoding...
OPENSUSE-SU-2026:11805-1 kernel-devel-7.2.6-1.1 on GA media
These are all security issues fixed in the kernel-devel-7.2.6-1.1 package on the GA media of openSUSE Tumbleweed...
GHSA-HCWQ-8WJF-3GCR vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions
Summary The audio decode-duration guard maxdurations, env VLLMMAXAUDIODECODEDURATIONS, default 600s that protects against audio decompression-bomb DoS is wired into only the speech-to-text path /v1/audio/transcriptions. The chat audio path /v1/chat/completions, inputaudio content parts calls the...
CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...
CVE-2026-92594 Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...
CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard
UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...
CVE-2026-92802 kan through 0.6.0 Authorization Bypass via GitHub Project Import
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining...
CVE-2026-92778 CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...
CVE-2026-92774 Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions,...
CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...
CVE-2026-92750 Harness through 3.3.0 Missing Access Control via infraproviders endpoint
Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to...
CVE-2026-92719 Quickwit through 0.9.0 SSRF via SQS queue_url Parameter
Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...
CVE-2026-92717 Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub
Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts,...
GO-2026-6467 Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik
Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik...
CVE-2026-92603 ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController
ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message r...
CVE-2026-61593 djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a...
GHSA-PG97-JVMF-QFVC djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
Impact The SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and POS...
