CVE-2026-24240

Summary (CVE-2026-24240): NVIDIA Megatron Bridge for Linux contains a vulnerability that allows deserialization of untrusted data, potentially enabling code execution, privilege escalation, data tampering, and information disclosure. Root cause: insecure deserialization in the bridge component. A...

CVE-2026-58127

PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 (PacsgearMediaServerEngine.dll) with ObjectURIs RemoteObj and UIRemoteObj and no authentication. An unauthenticated attacker can exploit MarshalByRefObject unmarshalling and implement .NET WebClient methods to read/write ...

CVE-2025-23351

NVIDIA advisory for CVE-2025-23351: A vulnerability in the command interface on NVIDIA Networking BlueField and ConnectX allows a local user with VF access to cause an out-of-bounds write, enabling potential arbitrary code execution on the device. Affected products include BlueField GA (BlueField...

CVE-2026-58126

PACSgear PACS Scan 5.2.1 is affected by an unauthenticated remote code execution through an exposed .NET Remoting TCP service (port 22222). The vulnerability chain starts with PGImageExchQueue.exe allowing arbitrary file read/write via the service, which can be leveraged with DLL hijacking in PGI...

CVE-2025-15646

HTML::Gumbo for Perl before 0.19 is vulnerable to heap memory disclosure via type confusion when parsing documents containing a element. The issue arises because libgumbo’s walk_tree was not updated to support , causing the element to be treated as a text node and enabling strlen() over-read of ...

CVE-2025-23350

NVIDIA reports CVE-2025-23350 affecting ConnectX and BlueField through a vulnerability in the command interface that allows a local user with VF access to cause a write out of bounds via crafted input, potentially enabling arbitrary code execution on the device. The issue impacts devices with VF ...

CVE-2026-24260

Technical details about CVE-2026-24260 are not publicly available in the provided documents. Monitor for updates; no affected products, vulnerable components, impact, or remediation details are disclosed here.

CVE-2026-58024

CVE-2026-58024 affects MediaWiki prior to 1.46.0 and some earlier 1.45.x/1.44.x/1.43.x branches. The issue is tied to includes/Api/ApiUserrights.Php, enabling exposure of sensitive information to unauthorized actors via the API. Reported metrics show a CVSSv4 base score of 5.1 (Medium) with netwo...

CVE-2026-13707

CVE-2026-13707 describes a session fixation vulnerability in Wikimedia Foundation OAuth, associated with the file src/Backend/MWOAuthServer.Php. Affected versions include OAuth implementations up to 1.46.0, 1.45.4, 1.44.6, and 1.43.9. The connected documents do not provide explicit root-cause det...

CVE-2026-13706

The CVE pertains to Wikimedia Foundation’s UrlShortener extension, specifically a vulnerability in the UrlShortenerUtils.Php implementation. The issue is improper input validation caused by a discrepancy between PHP’s URL parsing and WHATWG URL parsing, enabling bypassing of validation in the Url...

CVE-2026-58399

The CVE affects @acastellon/auth (authentication control for microservices). Versions

CVE-2026-58031

The CVE-2026-58031 entry describes a stored XSS in MediaWiki (Wikimedia Foundation) via Special:ApiSandbox when a deprecated module is selected. Affected component: resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js; affected software version range: MediaWiki 1.46.0-rc.0 up to prior t...

CVE-2026-58034

The CVE-2026-58034 entry concerns a Stored XSS in Wikimedia Foundation CheckUser, caused by improper neutralization of input during web page generation. The issue is tied to the file modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue and affects CheckUser versions f...

CVE-2026-6283

CVE-2026-6283 affects DivvyDrive Information Technologies Inc. DivvyDrive (versions 4.8.2.23 up to, but not including, 4.8.3.1) with a Stored XSS due to improper neutralization of input during web page generation. Risk is MEDIUM (CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), requiring user inte...

CVE-2026-58035

The CVE describes a stored XSS in MediaWiki (Wikimedia Foundation) related to resources/src/mediawiki.Special.Block/SpecialBlock.Vue in the codex version of Special:Block. The issue arises from improper neutralization of user input during web page generation, enabling XSS via a system message. Af...

CVE-2026-5220

DivvyDrive Information Technologies Inc. DivvyDrive contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. Affected versions are 4.8.2.23 up to, but not including, 4.8.3.1. CVSS v3.1 base score 6.4 (Medium) with network attack vector, low attack...

CVE-2026-14330

CVE-2026-14330 describes an issue in Pipewire’s PulseAudio protocol server, where multiple unbounded alloca() calls can cause a stack overflow. The affected component is the PulseAudio protocol server within Pipewire. Root cause: unbounded alloca() usage leading to potential stack overflow. Accor...

CVE-2026-14324

CVE-2026-14324 — Pipewire RAOP module vulnerability. The RAOP module accepts unbounded Content-Length values and does not validate the return of pw_array_add(), which can lead to a null dereference. This is a technical detail documented in the CVE record and CVE-list entry. The CVSSv3.1 metrics i...

CVE-2026-2891

The CVE-2026-2891 entry concerns Poly Voice IP devices (CCX, Trio, Edge E) and describes a potential DoS if these devices connect to a malicious SIP server sending malformed data. Affected components are the Poly Voice devices themselves; the root cause is triggered by malformed SIP input from a ...

CVE-2026-5138

Foreman vulnerability CVE-2026-5138 involves the taxonomy_scope controller failing to validate organization and location IDs in nested request parameters. An authenticated user with host-edit permissions can trigger cross-tenant information disclosure, leaking sensitive infrastructure metadata (s...