CVE-2026-54064

Technical details for CVE-2026-54064 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-60103

Blender 3.0.0–5.1.2 contains an out-of-bounds read via a crafted .blend SDNA block. The signed short member_index is used as an array index into sdna->members[] in sdna_expand_names() without bounds checking, producing an invalid pointer that is then passed to strlen(), causing a SIGSEGV or un...

CVE-2026-53364

The CVE-2026-53364 vulnerability is in the Linux kernel Bluetooth HCI path: hci_le_big_terminate() may leak memory (iso_list_data) when neither pa_sync_term nor big_sync_term flags are set after PA/BIG state evaluation. The function was refactored to accept a struct hci_conn and added PA/BIG flag...

CVE-2026-53365

The CVE-2026-53365 issue affects the Linux kernel’s vsock/virtio zerocopy path. When large messages are fragmented across multiple skbs, the zerocopy uarg was only allocated and attached to the last skb in the loop, leaving non-final skbs with pinned user pages untracked and failing to notify use...

CVE-2026-61505

Vulnerability summary: Rejetto HFS versions 3.0.0–3.2.0 are affected by a path traversal via the lang parameter, allowing a remote, unauthenticated attacker to read certain JSON files outside shared folders. The impact is constrained to files matching a narrow naming/format pattern, with no indic...

CVE-2026-61504

CVE-2026-61504 affects Rejetto HFS 3.0.0–3.2.0, where the basic web listing does not escape file names and can be forced with the browser parameter ?get=basic. This enables stored XSS: a file with a script in its name can execute in the viewer’s browser when the listing is viewed, potentially by ...

CVE-2026-61503

CVE-2026-61503 – Rejetto HFS : Affects HFS 3.0.0–3.2.0. The login endpoint returns observably different responses depending on whether the username exists, enabling remote, unauthenticated actors to confirm valid accounts (including the default admin) and facilitating password guessing and sessio...

CVE-2026-61502

CVE-2026-61502 affects Rejetto HFS versions 3.0.0 through 3.2.0. The root cause is that state-changing API requests can be issued via GET and are exempt from the anti-CSRF header check, enabling a remote attacker to perform administrative actions (e.g., account creation, configuration changes) an...

CVE-2026-61463

CVE-2026-61463 : Shiori contains a privilege escalation in the account update endpoint. An authenticated user can modify the owner field without authorization checks by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token that grants full system a...

CVE-2026-61501

Rejetto HFS versions 3.0.0–3.2.0 expose a stored XSS in the admin log viewer: log entries rendered as HTML without sanitization allow a remote unauthenticated attacker to craft a username, write JavaScript to the error log, and execute code in an administrator’s browser when logs are viewed, pote...

CVE-2026-49259

Technical details for CVE-2026-49259 are not publicly available in the provided documents. Monitor for updates as information remains reserved/no public details; no affected products, impacts, or mitigations can be determined from the current data.

CVE-2026-61500

Affected software: Rejetto HFS 3.0.0–3.2.0. Root cause: session-cookie signing key derived from the non‑cryptographic Math.random() generator; outputs disclosed to unauthenticated clients during login. Impact: remote attacker can observe login responses, reconstruct the generator state, recover t...

CVE-2026-48118

Technical details for CVE-2026-48118 are not publicly available in the provided documents. Monitor for updates as the entry is reserved with no disclosed details.

CVE-2026-45579

Technical details for CVE-2026-45579 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-45573

Technical details for CVE-2026-45573 are not publicly available in the provided documents. No affected products, root cause, impact, or remediation information are included. Monitor for updates as more details may be published later.

CVE-2026-45572

Technical details for CVE-2026-45572 are not publicly available in the provided documents. Monitor for updates; no affected products, impact, or remediation can be inferred from the available data.

CVE-2026-45415

Technical details for CVE-2026-45415 are not publicly available in the provided documents. No affected products, impact, or remediation are described here. Monitor for updates and new disclosures as information becomes available.

CVE-2026-61462

CVE-2026-61462 affects mcp-gitlab. A path traversal weakness exists in the build/index.js job_id parameter, allowing an attacker to escape the intended path prefix (e.g., using ../../../user) and redirect GitLab API requests to arbitrary endpoints. This can enable access to arbitrary GitLab API r...

CVE-2026-45414

Technical details for CVE-2026-45414 are not publicly available in the provided documents. Monitor for updates; no affected products, impact, or remediation information can be confirmed from the supplied data.

CVE-2026-45378

Technical details for CVE-2026-45378 are not publicly available in the provided documents. Monitor for updates as the entry is reserved/not described.