THREAT ALERT

Daily vulnerability intelligence for defenders – fresh CVEs with exploitability signals, patch status, and action-oriented priorities from 17 sources.

CVEs published

Track vulnerabilities that matter to your stack

Personalized alerts, dashboards, and weekly digests – free.

Trending Now

Critical Watch

Attack Technique Trend

Prediction based on ZDI Disclosures & CVE data · 30 days

Analytics

Vendor Today – Quick Filter

Techniques

results

Sort:

Base Score

Vector String

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

Integrity (I)

Availability (A)

0 | 3.9| 6.9| 8.9| 10

NONE LOW MEDIUM HIGH CRITICAL

CVSS Filter – CVEs match

No CVEs match the selected criteria

Browse older vulnerabilities in Archive

Live Feed auto-refresh 60s

Vulnerability Intelligence — February 04, 2026

237 CVEs tracked today. 17 Critical, 67 High, 106 Medium, 8 Low.

CVE-2026-25539 CRITICAL CVSS 9.1
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file operations on the server.

Ssh RCE Siyuan
CVE-2026-25526 CRITICAL CVSS 9.8
JinJava template engine has a server-side template injection vulnerability enabling arbitrary code execution through crafted Jinja-style templates.

Java Golang Django Jinjava
CVE-2026-25512 HIGH CVSS 8.8
Authenticated attackers can execute arbitrary commands on Group-Office servers through unsanitized user input in the email attachment endpoint, where shell metacharacters are directly passed to system execution functions. The vulnerability affects Group-Office versions prior to 6.8.150, 25.0.82, and 26.0.5, and public exploit code exists. Organizations should apply available patches immediately as this is actively exploitable by authenticated users.

RCE Group Office
CVE-2026-25505 CRITICAL CVSS 9.8
Bambuddy 3D printer management system has missing authentication (CVSS 9.8) allowing unauthenticated access to printer control and print archive.

Authentication Bypass Bambuddy
CVE-2026-25481 CRITICAL CVSS 9.6
Langroid LLM framework prior to 0.5 has a code injection vulnerability (CVSS 9.6) allowing attackers to execute arbitrary code through the AI agent system.

Code Injection AI / ML Langroid
CVE-2026-25160 CRITICAL CVSS 9.1
Alist file manager has an improper certificate validation vulnerability allowing MITM attacks that could compromise file operations and stored credentials.

Tls Alist Suse
CVE-2026-25139 CRITICAL CVSS 9.1
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure or crashes on IoT devices.

IoT Denial Of Service Riot
CVE-2026-25115 CRITICAL CVSS 9.9
n8n has a protection mechanism bypass (CVSS 9.9) in the Python sandbox allowing authenticated users to escape code execution restrictions.

Python N8n
CVE-2026-25053 CRITICAL CVSS 9.9
n8n has a command injection vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary OS commands through workflow definitions.

RCE Remote Code Execution Command Injection Information Disclosure Node.js
CVE-2026-25052 CRITICAL CVSS 9.9
n8n has a TOCTOU race condition vulnerability (CVSS 9.9) enabling bypass of execution restrictions in workflow processing.

Information Disclosure AI / ML N8n
CVE-2026-25049 CRITICAL CVSS 9.9
n8n workflow automation platform has an authenticated code execution vulnerability (CVSS 9.9) through improper runtime behavior modification, enabling server takeover.

RCE Remote Code Execution Command Injection Code Injection Node.js
CVE-2026-1633 CRITICAL CVSS 10.0
Synectix LAN 232 TRIO serial-to-ethernet adapter exposes its web management interface without authentication (CVSS 10.0), enabling unauthenticated control of serial devices.

IoT Authentication Bypass
CVE-2025-64712 CRITICAL CVSS 9.8
The unstructured Python library for document ingestion has a path traversal vulnerability allowing arbitrary file read/write during document processing.

Path Traversal Unstructured
CVE-2025-62616 CRITICAL CVSS 9.8
AutoGPT has a second SSRF vulnerability (CVSS 9.8) in a different endpoint, providing an additional path to access internal network resources.

SSRF AI / ML Autogpt Platform
CVE-2025-62615 CRITICAL CVSS 9.8
AutoGPT has a Server-Side Request Forgery vulnerability (CVSS 9.8) allowing unauthenticated attackers to make the AI platform access internal network resources.

SSRF AI / ML Autogpt Platform
CVE-2025-59818 CRITICAL CVSS 10.0
A product has an authenticated command injection vulnerability (CVSS 10.0) allowing execution of arbitrary OS commands on the underlying system.

Command Injection Tcis 3 Firmware
CVE-2025-13375 CRITICAL CVSS 9.8
IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 allows unauthenticated users to execute certain cryptographic operations that should require elevated privileges.

IBM
CVE-2025-5329 CRITICAL CVSS 9.8
An Emit Informatics product has a SQL injection vulnerability allowing unauthenticated attackers to compromise the database through unsanitized input.

SQLi
CVE-2026-25585 HIGH CVSS 7.8
Out-of-bounds memory read in iccDEV versions prior to 2.3.1.3 allows local attackers to disclose sensitive memory contents or trigger application crashes by crafting malformed ICC color profiles that bypass array bounds validation. The vulnerability exists in IccCmm.cpp during profile index processing and has public exploit code available. Update to version 2.3.1.3 or later to remediate.

Buffer Overflow Iccdev
CVE-2026-25584 HIGH CVSS 7.8
Stack buffer overflow in iccDEV versions prior to 2.3.1.3 allows local attackers to corrupt memory, leak sensitive information, or execute arbitrary code by supplying malformed ICC color profile files. The vulnerability exists in the CIccTagFloatNum<>::GetValues() function and is triggered during profile processing, affecting users who handle untrusted ICC files. Public exploit code exists for this vulnerability.

Memory Corruption Information Disclosure Iccdev
CVE-2026-25583 HIGH CVSS 7.8
Heap buffer overflow in iccDEV versions prior to 2.3.1.3 allows local attackers to achieve code execution with high privileges by crafting malformed ICC color profile files that trigger unsafe memory operations during file parsing. Public exploit code exists for this vulnerability. All users of iccDEV should upgrade to version 2.3.1.3 or later immediately.

Buffer Overflow Iccdev
CVE-2026-25582 HIGH CVSS 7.8
Heap buffer overflow in iccDEV versions prior to 2.3.1.3 allows local attackers with user interaction to read sensitive memory and potentially execute code by supplying malformed XML files to the iccFromXml tool during ICC profile conversion. Public exploit code exists for this vulnerability. A patch is available in version 2.3.1.3 and later.

Buffer Overflow Iccdev
CVE-2026-25575 HIGH CVSS 7.5
Navigatum contains a vulnerability that allows attackers to overwrite files in directories writable by the application user (e (CVSS 7.5).

Path Traversal Navigatum
CVE-2026-25546 HIGH CVSS 7.8
Remote code execution in Godot MCP prior to version 0.1.1 results from unsafe shell command execution when processing user-supplied project paths. An unauthenticated attacker can inject shell metacharacters through multiple tools (create_scene, add_node, load_sprite, etc.) to execute arbitrary commands with the privileges of the MCP server process. No patch is currently available for affected deployments.

RCE Command Injection Godot Mcp
CVE-2026-25541 HIGH CVSS 7.5
Integer overflow in the Bytes library versions 1.2.1 through 1.11.0 allows attackers to corrupt the BytesMut capacity value, leading to out-of-bounds memory access and undefined behavior in release builds. Public exploit code exists for this vulnerability, affecting applications that depend on Bytes for buffer management. A patch is available in version 1.11.1.

Integer Overflow Bytes
CVE-2026-25538 HIGH CVSS 8.8
Devtron is an open source tool integration platform for Kubernetes. [CVSS 8.8 HIGH]

Kubernetes Devtron Suse
CVE-2026-25537 HIGH CVSS 7.5
jsonwebtoken prior to version 10.3.0 allows attackers to bypass JWT time-based validation checks through type confusion when standard claims like nbf or exp are provided with incorrect JSON types. The library incorrectly treats malformed claims as absent rather than invalid, enabling bypass of critical security restrictions if validation is enabled but the claim is not explicitly marked as required. Public exploit code exists for this vulnerability.

Buffer Overflow Jsonwebtoken Redhat
CVE-2026-25536 HIGH CVSS 7.1
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. [CVSS 7.1 HIGH]

Race Condition Information Disclosure Mcp Typescript Sdk Redhat
CVE-2026-25521 HIGH CVSS 8.8
Locutus versions up to 2.0.39 is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 8.8).

Code Injection Locutus Redhat
CVE-2026-25519 HIGH CVSS 8.1
OpenSlides versions prior to 4.2.29 allow unauthorized authentication bypass for SAML-synchronized users through the local login form by using the victim's username with a hardcoded trivial password. An attacker can gain complete access to any SAML user account without knowing their actual credentials, potentially compromising sensitive assembly management data including agendas, motions, and election information. A patch is available in version 4.2.29 and should be applied immediately to all affected instances.

Authentication Bypass Openslides
CVE-2026-25514 HIGH CVSS 8.8
FacturaScripts is open-source enterprise resource planning and accounting software. [CVSS 8.8 HIGH]

SQLi Facturascripts
CVE-2026-25513 HIGH CVSS 8.8
Authenticated users can execute arbitrary SQL commands against FacturaScripts REST API endpoints through unsanitized sort parameters in the ModelClass::getOrderBy() method, allowing data theft, modification, or deletion. Public exploit code exists for this vulnerability affecting all versions prior to 2025.81. Organizations using vulnerable FacturaScripts instances should immediately apply the available patch and restrict API access to trusted users.

SQLi Facturascripts
CVE-2026-25499 HIGH CVSS 7.5
The Terraform/OpenTofu Proxmox Provider prior to version 0.93.1 contains a path traversal vulnerability in its SSH sudoer configuration documentation that permits attackers to escape directory restrictions using ../ sequences and modify arbitrary files on the system. Public exploit code exists for this vulnerability, affecting users who implement the documented SSH configuration. The vulnerability has been patched in version 0.93.1 and a fix is available.

Ssh Proxmox Terraform Provider Suse
CVE-2026-25161 HIGH CVSS 8.8
Path traversal in Alist prior to version 3.57.0 allows authenticated users to manipulate filename parameters and bypass directory restrictions within the same storage mount. Attackers can exploit this vulnerability to perform unauthorized file operations including deletion, movement, and copying across user boundaries. Public exploit code exists for this vulnerability.

Path Traversal Alist Suse
CVE-2026-25157 HIGH CVSS 7.7
OpenClaw AI assistant versions prior to 2026.1.29 contain two command injection vulnerabilities: unescaped user input in SSH project paths allows remote code execution on SSH hosts, and insufficient validation of SSH target parameters enables local command execution through malicious flag injection. An attacker can exploit these flaws to achieve arbitrary code execution either remotely via SSH or locally on the system running OpenClaw.

Ssh Command Injection AI / ML Openclaw
CVE-2026-25143 HIGH CVSS 7.8
Melange versions 0.10.0 through 0.40.2 allow unauthenticated command injection through the patch pipeline, enabling attackers to execute arbitrary shell commands on build hosts by injecting shell metacharacters into patch-related inputs such as series paths and filenames. This vulnerability affects users who build APK packages using melange build or melange license-check operations, particularly in CI/CD environments where build inputs may be controlled by untrusted sources. A patch is available in version 0.40.3 and later.

Command Injection RCE Melange Suse
CVE-2026-25140 HIGH CVSS 7.5
Apko versions 0.14.8 through 1.1.0 are vulnerable to denial of service when processing APK packages from untrusted repositories due to missing decompression limits in the ExpandApk function. An attacker controlling a compromised APK repository can provide a malicious small, highly-compressed package that expands into a massive tar stream, exhausting disk space and CPU resources on the build host. The vulnerability affects Golang and Apko products and has been patched in version 1.1.1.

Golang Denial Of Service Apko Suse
CVE-2026-25121 HIGH CVSS 7.5
Apko versions up to 1.1.1 contains a vulnerability that allows attackers to build and publish OCI container images built from apk packages (CVSS 7.5).

Golang Path Traversal Apko Suse
CVE-2026-25056 HIGH CVSS 8.8
N8N versions up to 1.118.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).

RCE AI / ML N8n
CVE-2026-25055 HIGH CVSS 8.1
n8n is an open source workflow automation platform. [CVSS 8.1 HIGH]

Ssh RCE AI / ML N8n
CVE-2026-24884 HIGH CVSS 8.4
Compressing library versions 1.10.3 and prior, and 2.0.0 fail to validate symbolic link targets during TAR archive extraction, allowing attackers to write files to arbitrary locations on the filesystem. Public exploit code exists for this vulnerability, which could enable overwriting critical system files or establishing persistence. Patched versions 1.10.4 and 2.0.1 are available.

Path Traversal Compressing
CVE-2026-24844 HIGH CVSS 7.9
melange allows users to build apk packages using declarative pipelines. [CVSS 7.9 HIGH]

Command Injection RCE Melange Suse
CVE-2026-24843 HIGH CVSS 8.2
Melange versions 0.11.3 through 0.40.2 suffer from a path traversal vulnerability in the retrieveWorkspace function that fails to validate tar entry paths, allowing an attacker with control over a QEMU guest VM's tar stream to write arbitrary files outside the intended workspace directory on the host system. An attacker exploiting this vulnerability could achieve arbitrary file write capabilities on the host machine, potentially leading to system compromise. A patch is available in version 0.40.3 and later.

Path Traversal Melange Suse
CVE-2026-24735 HIGH CVSS 7.5
Answer contains a vulnerability that allows attackers to retrieve restricted or sensitive information (CVSS 7.5).

Apache Answer Suse
CVE-2026-23897 HIGH CVSS 7.5
Apollo Server's standalone mode (versions 2.0.0-3.13.0, 4.2.0-4.12.x, and 5.0.0-5.3.x) is vulnerable to denial of service attacks when processing GraphQL requests with non-standard character set encodings, allowing unauthenticated remote attackers to crash the service. This vulnerability only affects direct usage of startStandaloneServer and does not impact applications using Apollo Server through integration packages. No patch is currently available.

Denial Of Service Apollo Server
CVE-2026-23105 HIGH CVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq.

Linux Information Disclosure Redhat Suse
CVE-2026-23103 HIGH CVSS 7.8
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per port Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL.

Linux Information Disclosure Redhat Suse
CVE-2026-23099 HIGH CVSS 7.1
The Linux kernel bonding driver fails to validate device types before enabling 802.3AD mode, allowing local privileged attackers to trigger out-of-bounds memory reads via malformed hardware address operations. This vulnerability affects systems running vulnerable Linux kernel versions and could lead to denial of service or information disclosure. No patch is currently available for this high-severity vulnerability.

Linux Buffer Overflow Information Disclosure Google Linux Kernel
CVE-2026-23098 HIGH CVSS 8.8
A use-after-free vulnerability in the Linux kernel's netrom subsystem allows local attackers with user privileges to cause a denial of service or potentially execute code by triggering a double-free condition in the nr_route_frame() function when nr_neigh->ax25 is NULL. The vulnerability requires local access and user-level privileges to exploit, with no patch currently available.

Linux Information Disclosure Redhat Suse
CVE-2026-23095 HIGH CVSS 7.5
A memory leak in the Linux kernel's GUE (Generic UDP Encapsulation) implementation occurs when processing packets with inner IP protocol 0, allowing a local attacker to cause a denial of service by exhausting kernel memory. The vulnerability exists because gue_udp_recv() fails to properly handle protocol 0 during packet resubmission, resulting in unreferenced skb objects that are never freed. No patch is currently available for this medium-severity issue affecting the Linux kernel.

Linux Information Disclosure Redhat Suse
CVE-2026-23092 HIGH CVSS 7.8
Local stack buffer overflow in the Linux kernel's AD3552R DAC driver allows a local authenticated attacker to write beyond allocated buffer boundaries through improper bounds checking in the ad3552r_hs_write_data_source function. An attacker with local access can trigger out-of-bounds writes on the stack, potentially leading to privilege escalation or denial of service. No patch is currently available for this vulnerability.

Linux Memory Corruption Buffer Overflow Linux Kernel Redhat
CVE-2026-23089 HIGH CVSS 7.8
A use-after-free vulnerability in the Linux kernel's ALSA USB audio mixer can be triggered by local attackers with low privileges when mixer initialization fails, causing the kernel to access freed memory during sound card registration and potentially leading to information disclosure or denial of service. The flaw affects Linux systems with USB audio devices and remains unpatched, exploitable without user interaction after initial access to the system.

Linux Use After Free Memory Corruption Information Disclosure Linux Kernel
CVE-2026-23083 HIGH CVSS 7.8
Local privilege escalation in the Linux kernel's FOU (Foo-over-UDP) tunnel implementation allows authenticated local users to trigger a memory leak and denial of service by setting the FOU_ATTR_IPPROTO attribute to zero, causing network packets to remain unfreed in memory. This vulnerability affects all Linux systems with the vulnerable kernel code and requires local access to exploit. No patch is currently available for this high-severity issue.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23078 HIGH CVSS 7.8
A buffer overflow in the Linux kernel's ALSA scarlett2 USB driver allows local attackers with user privileges to corrupt memory and potentially execute code by triggering improper endianness conversion during audio device configuration retrieval. The vulnerability stems from incorrect size validation that causes the function to access more bytes than allocated when processing multiple configuration elements. No patch is currently available for this vulnerability affecting Linux systems with Scarlett audio interfaces.

Linux Buffer Overflow Memory Corruption Linux Kernel Redhat
CVE-2026-23077 HIGH CVSS 7.8
Linux kernel memory corruption via use-after-free (UAF) in virtual memory area (VMA) handling allows local attackers with user privileges to cause denial of service or potentially execute code by triggering incorrect VMA merges during mremap() operations on faulted and unfaulted memory regions. The vulnerability stems from improper handling of anonymous VMA merges when remapping memory adjacent to unfaulted pages. No patch is currently available for this high-severity issue affecting the Linux kernel.

Linux Memory Corruption Information Disclosure Use After Free Redhat
CVE-2026-23076 HIGH CVSS 7.1
Out-of-bounds array access in the Linux kernel's ctxfi audio mixer driver allows local attackers with user privileges to read sensitive memory or cause denial of service through improper loop index initialization in the amixer_index() and sum_index() functions. The vulnerability stems from uninitialized conf field handling that enables array bounds bypass with no user interaction required. No patch is currently available for this high-severity issue affecting all Linux distributions.

Linux Buffer Overflow Information Disclosure Linux Kernel Redhat
CVE-2026-23074 HIGH CVSS 7.8
A use-after-free vulnerability in the Linux kernel's teql qdisc implementation allows local attackers with low privileges to trigger memory corruption and cause denial of service or potential code execution by improperly nesting teql as a non-root qdisc when it is designed to operate only as a root qdisc. The flaw exists due to missing validation of qdisc constraints and currently has no available patch. This affects all Linux systems using the vulnerable kernel versions.

Linux Information Disclosure Memory Corruption Use After Free Redhat
CVE-2026-23073 HIGH CVSS 7.8
The RSI911x WiFi driver in the Linux kernel fails to allocate sufficient memory for virtual interface driver data, causing out-of-bounds writes to the ieee80211_vif structure and memory corruption. A local attacker with low privileges can exploit this to corrupt kernel memory and potentially execute arbitrary code. No patch is currently available.

Linux Memory Corruption Buffer Overflow Linux Kernel Redhat
CVE-2026-23068 HIGH CVSS 7.8
Double-free vulnerability in the Linux kernel's spi-sprd-adi driver allows local attackers with low privileges to cause a denial of service or potentially execute code by triggering a probe error path that improperly frees the SPI controller structure twice. The vulnerability exists in error handling where devm_spi_register_controller() is paired with manual spi_controller_put() calls, causing the kernel to attempt freeing the same memory region twice when device registration fails. No patch is currently available.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23066 HIGH CVSS 7.8
A local privilege escalation in the Linux kernel's rxrpc subsystem allows authenticated users to trigger use-after-free or reference count underflow conditions by exploiting improper queue management in the recvmsg() function when MSG_DONTWAIT is specified. An attacker with local access can cause denial of service or potentially execute arbitrary code by corrupting the recvmsg queue through repeated calls that unconditionally requeue already-queued items. No patch is currently available for this medium-severity vulnerability (CVSS 5.5).

Linux Information Disclosure Redhat Suse
CVE-2026-22038 HIGH CVSS 8.1
AutoGPT platform versions prior to v0.6.46 expose API keys and authentication secrets in application logs due to insecure logging of decrypted credentials across three Stagehand integration blocks. Authenticated users can access these plaintext secrets through log files, enabling credential theft and unauthorized access to integrated services. Public exploit code exists for this vulnerability, though a patch is available in v0.6.46 and later.

Information Disclosure AI / ML Autogpt Platform
CVE-2026-21893 HIGH CVSS 7.2
n8n versions 0.187.0 through 1.120.2 contain a command injection vulnerability in the community package installation feature that allows authenticated administrators to execute arbitrary system commands on the host. The vulnerability requires high privilege access and specific conditions to exploit but carries high risk due to potential complete system compromise. A patch is available in version 1.120.3.

Command Injection N8n
CVE-2026-20983 HIGH CVSS 7.8
Android versions up to 14.0 contains a vulnerability that allows attackers to launch arbitrary activity with Samsung Dialer privilege (CVSS 7.8).

Samsung Android
CVE-2026-20979 HIGH CVSS 7.8
Android versions up to 15.0 contains a vulnerability that allows attackers to launch arbitrary activity with Settings privilege (CVSS 7.8).

Information Disclosure Android
CVE-2026-20119 HIGH CVSS 7.5
Unauthenticated remote attackers can crash Cisco TelePresence Collaboration Endpoint and RoomOS devices by sending specially crafted text through meeting invitations or similar channels, exploiting insufficient input validation in the text rendering subsystem. The vulnerability requires no user interaction and causes device reloads resulting in denial of service. No patch is currently available.

Cisco Denial Of Service
CVE-2026-20098 HIGH CVSS 8.8
Unauthenticated file upload in Cisco Meeting Management's Certificate Management interface allows authenticated attackers to write arbitrary files and execute commands with root privileges on affected systems. An attacker with valid credentials can exploit improper input validation in the web management interface to overwrite system files processed with elevated privileges, leading to complete system compromise. No patch is currently available for this vulnerability.

Cisco Meeting Management
CVE-2026-1819 HIGH CVSS 8.8
Karel Electronics Industry and Trade Inc. ViPort is affected by cross-site scripting (xss) (CVSS 8.8).

Industrial XSS
CVE-2026-1756 HIGH CVSS 8.8
WP FOFT Loader (WordPress plugin) is affected by unrestricted upload of file with dangerous type (CVSS 8.8).

WordPress RCE
CVE-2026-0945 HIGH CVSS 8.8
The Drupal Role Delegation module versions 1.3.0 through 1.5.0 contains an unsafe privilege definition vulnerability that permits authenticated users with delegation permissions to escalate their privileges within the application. An attacker with limited account access could exploit this flaw to gain elevated permissions and modify system settings or access restricted functionality. No patch is currently available for this vulnerability.

Privilege Escalation
CVE-2026-0662 HIGH CVSS 7.8
Arbitrary code execution in Autodesk 3ds Max occurs when users open max files from maliciously crafted project directories that exploit an untrusted search path vulnerability. Local attackers can leverage this to execute arbitrary code with the privileges of the current user without requiring special permissions or interaction beyond opening a file. No patch is currently available for this high-severity vulnerability affecting 3ds Max users.

Privilege Escalation RCE 3ds Max
CVE-2026-0661 HIGH CVSS 7.8
Arbitrary code execution in Autodesk 3ds Max can be achieved by processing a specially crafted RGB file, affecting users who open untrusted files. This memory corruption vulnerability requires user interaction but grants attackers full system privileges within the application context. No patch is currently available.

Memory Corruption 3ds Max
CVE-2026-0660 HIGH CVSS 7.8
Arbitrary code execution in Autodesk 3ds Max via malicious GIF file parsing exploits a stack-based buffer overflow vulnerability, allowing local attackers to execute code with the privileges of the application. The vulnerability requires user interaction to open a crafted GIF file and currently has no available patch. This affects 3ds Max users who may unknowingly process untrusted image files.

Buffer Overflow Stack Overflow 3ds Max
CVE-2026-0659 HIGH CVSS 7.8
Malicious USD files trigger an out-of-bounds write vulnerability in Autodesk Arnold and 3ds Max, enabling arbitrary code execution within the affected application when a user loads or imports the crafted file. Local attackers with user interaction can exploit this to gain full system compromise with the privileges of the running process. No patch is currently available.

Buffer Overflow RCE
CVE-2026-0538 HIGH CVSS 7.8
Arbitrary code execution in Autodesk 3ds Max occurs when processing specially crafted GIF files due to an out-of-bounds write flaw. Attackers can exploit this vulnerability locally to execute malicious code with the privileges of the application user. No patch is currently available for affected systems.

Buffer Overflow RCE 3ds Max
CVE-2026-0537 HIGH CVSS 7.8
Arbitrary code execution in Autodesk 3ds Max results from improper handling of maliciously crafted RGB files, allowing an attacker to corrupt memory and execute code with the privileges of the application user. The vulnerability requires local file interaction but poses high risk due to widespread use of 3ds Max in design and animation workflows. No patch is currently available, leaving affected users vulnerable to exploitation through social engineering or supply chain attacks involving malicious RGB assets.

Memory Corruption 3ds Max
CVE-2026-0536 HIGH CVSS 7.8
Autodesk 3ds Max is vulnerable to arbitrary code execution when processing maliciously crafted GIF files due to a stack-based buffer overflow (CVE-2026-0536, CVSS 7.8). Local attackers can exploit this vulnerability by tricking users into opening a malicious GIF file to execute code with the privileges of the 3ds Max process. No patch is currently available.

Buffer Overflow Stack Overflow 3ds Max
CVE-2025-71031 HIGH CVSS 7.5
Water-Melon Melon commit 9df9292 and below is vulnerable to Denial of Service. The HTTP component doesn't have any maximum length. [CVSS 7.5 HIGH]

Denial Of Service Melon
CVE-2025-69621 HIGH CVSS 8.1
file import process of Comic Book Reader v1.0.95 contains a vulnerability that allows attackers to overwrite critical internal files, potentially leading to arbitrary code executi (CVSS 6.5).

RCE
CVE-2025-69215 HIGH CVSS 8.8
OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, there is a SQL Injection vulnerability in the Stampe Module. [CVSS 8.8 HIGH]

SQLi Openstamanager
CVE-2025-69213 HIGH CVSS 8.8
OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists in the ajax_complete.php endpoint when handling the get_sedi operation. [CVSS 8.8 HIGH]

PHP SQLi Openstamanager
CVE-2025-61917 HIGH CVSS 7.7
n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the task runner allowed untrusted code to allocate uninitialized memory. [CVSS 7.7 HIGH]

Node.js Information Disclosure N8n
CVE-2025-15368 HIGH CVSS 8.8
The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be...

WordPress PHP Lfi Information Disclosure RCE
CVE-2025-15285 HIGH CVSS 7.5
The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. [CVSS 7.5 HIGH]

WordPress Authentication Bypass
CVE-2025-15268 HIGH CVSS 7.5
The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action in all versions up to, and including, 2.14.46. [CVSS 7.5 HIGH]

WordPress SQLi PHP
CVE-2026-25579 MEDIUM CVSS 6.5
Navidrome versions prior to 0.60.0 allow authenticated users to trigger denial of service by requesting image resizing with extremely large parameters, causing uncontrolled memory allocation and potential disk exhaustion. Public exploit code exists for this vulnerability, which can crash the server process via the OOM killer or fill the cache directory with massive files. An attacker with valid credentials can achieve complete service outage without administrative privileges.

Linux Denial Of Service Navidrome Suse
CVE-2026-25578 MEDIUM CVSS 6.1
Navidrome versions before 0.60.0 contain a stored cross-site scripting vulnerability in song comment metadata that allows attackers to inject malicious scripts and steal user credentials when victims view affected music files. Public exploit code exists for this vulnerability. Administrators should upgrade to version 0.60.0 or later to remediate the risk.

XSS Navidrome Suse
CVE-2026-25543 MEDIUM CVSS 6.1
Htmlsanitizer versions up to 9.0.892 is affected by improper encoding or escaping of output (CVSS 6.1).

Dotnet XSS Htmlsanitizer
CVE-2026-25540 MEDIUM CVSS 6.5
Mastodon versions prior to 4.3.19, 4.4.13, and 4.5.6 are vulnerable to web cache poisoning in ActivityPub endpoints when AUTHORIZED_FETCH is enabled, allowing cached responses to be served across different user contexts regardless of request signing. An attacker could exploit this to view content intended for non-blocked accounts or cause blocked users to receive empty responses meant for them, potentially bypassing access controls. No patch is currently available for affected deployments.

Information Disclosure Mastodon
CVE-2026-25532 MEDIUM CVSS 6.3
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. [CVSS 6.3 MEDIUM]

IoT Integer Overflow Esp Idf
CVE-2026-25523 MEDIUM CVSS 5.3
Magento-lts versions prior to 20.16.1 expose the admin panel URL through improper handling of the X-Original-Url header in certain server configurations, allowing unauthenticated attackers to discover the administrative interface location without prior knowledge. This information disclosure weakness could facilitate follow-up attacks targeting the admin panel. The vulnerability affects Magento Community Edition long-term support installations and has been patched in version 20.16.1.

Magento
CVE-2026-25518 MEDIUM CVSS 5.9
Denial-of-service in cert-manager versions 1.18.0-1.18.4 and 1.19.0-1.19.2 allows network-adjacent attackers to crash the controller by poisoning DNS cache entries during ACME DNS-01 validation through unencrypted DNS traffic interception. An attacker positioned to intercept DNS queries from the cert-manager pod can inject malicious DNS responses that trigger a panic in the controller, disrupting certificate management operations in affected Kubernetes clusters. A patch is available for immediate deployment.

Kubernetes Dns Cert Manager Redhat Suse
CVE-2026-25511 MEDIUM CVSS 4.9
Server-side request forgery in Group Office's WOPI service discovery allows authenticated System Administrators to access internal hosts, ports, and files on the affected server. The vulnerability enables attackers to exfiltrate SSRF response bodies through the debug system, effectively converting a blind SSRF into a visible information disclosure attack. Public exploit code exists for this medium-severity flaw, which has been patched in versions 6.8.150, 25.0.82, and 26.0.5.

SSRF Group Office
CVE-2026-25508 MEDIUM CVSS 6.3
Out-of-bounds read in ESP-IDF versions 5.1.6 through 5.5.2 allows remote attackers to trigger memory corruption via malformed BLE prepare-write requests during device provisioning mode. An unauthenticated BLE client can exploit improper length tracking in the protocomm_ble transport to cause the provisioning handler to read beyond allocated buffer boundaries. This results in potential information disclosure and denial of service for affected IoT devices.

IoT Memory Corruption Esp Idf
CVE-2026-25507 MEDIUM CVSS 6.3
Espressif IoT Development Framework versions 5.1.6-5.5.2 contain a use-after-free vulnerability in the BLE provisioning layer that allows remote attackers to trigger memory corruption when provisioning is stopped with keep_ble_on enabled. A connected BLE client can exploit freed GATT metadata through read/write callbacks to cause denial of service or potential code execution. Patches are available for all affected versions.

IoT Use After Free Esp Idf
CVE-2026-25475 MEDIUM CVSS 6.5
OpenClaw versions prior to 2026.1.30 suffer from a path traversal vulnerability in the isValidMedia() function that permits authenticated agents to read arbitrary files on the system by crafting malicious MEDIA output directives. An attacker with agent access can leverage this flaw to exfiltrate sensitive data accessible to the application process. Public exploit code exists for this vulnerability, and no patch is currently available.

Path Traversal AI / ML Openclaw
CVE-2026-25145 MEDIUM CVSS 5.5
Melange versions 0.14.0 through 0.40.2 allow local attackers with configuration file control to read arbitrary files from the host system through path traversal in license file path validation, potentially exfiltrating sensitive data embedded in generated SBOMs. This vulnerability affects build pipeline scenarios where configuration is user-controlled, such as pull request-driven CI or build-as-a-service environments. A patch is available in version 0.40.3.

Golang Path Traversal Melange Suse
CVE-2026-25122 MEDIUM CVSS 5.5
Resource exhaustion in Apko versions 0.14.8 through 1.0.x allows local attackers to cause denial of service by supplying a malicious APK archive with excessive gzip-compressed data that forces unbounded decompression work. The expandapk.Split function fails to impose limits on gzip inflation, enabling attackers to exhaust CPU resources and trigger process timeouts when parsing attacker-controlled APK streams. This issue is resolved in version 1.1.0.

Denial Of Service Apko Suse
CVE-2026-25054 MEDIUM CVSS 5.4
Stored cross-site scripting in n8n's markdown rendering component allows authenticated users to inject malicious scripts into workflows and sticky notes that execute with session privileges when viewed by other users. An attacker with workflow modification permissions can exploit this to hijack sessions and compromise accounts of users who interact with affected workflows. Versions 1.123.9 and 2.2.1 contain fixes for this vulnerability.

XSS AI / ML N8n
CVE-2026-25051 MEDIUM CVSS 5.4
Improper Content Security Policy enforcement in n8n workflow automation allows authenticated users to inject persistent XSS payloads into webhook responses that execute with same-origin privileges when other users access the affected workflows. An attacker with workflow creation/modification permissions could exploit this to hijack sessions and compromise user accounts. The vulnerability affects n8n versions prior to 1.123.2.

XSS AI / ML N8n
CVE-2026-24447 MEDIUM CVSS 6.5
Malformed data processed by the affected product can be embedded in exported CSV files, which execute arbitrary code when opened by users due to improper input validation. Movable Type 7 and 8.4 series (both EOL) along with current versions are vulnerable to this code injection attack through user-initiated file downloads. An authenticated attacker can craft malicious input to compromise any user who downloads and opens the resulting CSV file.

Code Injection
CVE-2026-23704 MEDIUM CVSS 6.5
Movable Type allows non-administrative users to upload arbitrary files that execute malicious scripts in an administrator's browser when accessed, enabling cross-site scripting attacks with medium impact on confidentiality, integrity, and availability. This vulnerability affects both current and end-of-life versions (7.x and 8.4 series) with no patch currently available. An attacker with basic user privileges can compromise administrator sessions through stored script execution.

File Upload
CVE-2026-23624 MEDIUM CVSS 4.3
GLPI versions 0.71 through 10.0.22 and 11.0.4 are vulnerable to session hijacking when SSO-based remote authentication is enabled, allowing a local attacker to impersonate another user by stealing an active session on the same machine. An authenticated attacker with local access can exploit this by leveraging SSO variables to gain unauthorized access to victim sessions without requiring elevated privileges. No patch is currently available for this vulnerability.

Information Disclosure Glpi
CVE-2026-23110 MEDIUM CVSS 4.7
A race condition in the Linux kernel's SCSI error handling mechanism can prevent the error handler from being properly awakened when concurrent command completions occur, causing I/O operations to hang indefinitely. A local attacker with low privileges can trigger this condition through timing-sensitive operations to cause a denial of service. No patch is currently available for this vulnerability.

Linux Race Condition Information Disclosure Linux Kernel Redhat
CVE-2026-23109 MEDIUM CVSS 5.5
A denial of service vulnerability in the Linux kernel's writeback mechanism allows local users with standard privileges to cause indefinite hangs in wait_sb_inodes() when interacting with faulty FUSE servers that fail to respond to write requests. The vulnerability stems from improper handling of mappings without data integrity semantics, which should be skipped during synchronization operations but are instead waited upon indefinitely. An attacker controlling a malfunctioning FUSE server can exploit this to freeze system operations that depend on filesystem synchronization.

Linux Denial Of Service Linux Kernel Redhat Suse
CVE-2026-23108 MEDIUM CVSS 5.5
The Linux kernel USB CAN driver (usb_8dev) fails to properly manage URB memory when USB transfers complete, allowing a local attacker with user privileges to trigger a memory leak and cause a denial of service through resource exhaustion. The vulnerability occurs because completed URBs are unanchored by the USB framework before the callback function executes, preventing proper cleanup during driver shutdown. No patch is currently available for this issue.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23104 MEDIUM CVSS 5.5
A use-after-free vulnerability in the Linux kernel's ice driver causes a denial of service when devlink reload is followed by driver removal, as freed HWMON sensor memory is accessed by sysfs attribute handlers. Local users with sufficient privileges can trigger recurring kernel page faults approximately every 10 minutes when system monitoring tools attempt to read the orphaned hwmon attributes. This affects Linux systems with ice network drivers and causes system instability through repeated call traces.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23100 MEDIUM CVSS 5.5
The Linux kernel's hugetlb_pmd_shared() function fails to properly detect PMD table sharing, resulting in a denial of service condition affecting systems with local user access. An attacker with local privileges can exploit this to cause system instability or performance degradation through resource exhaustion. No patch is currently available.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23097 MEDIUM CVSS 5.5
A deadlock vulnerability in the Linux kernel's hugetlb file folio migration code allows a local privileged user to cause a denial of service by triggering conflicting lock acquisitions between folio locks and memory mapping semaphores. The vulnerability occurs when migrate_pages() and hugetlbfs_fallocate() operations compete for locks in opposite orders, freezing affected processes. No patch is currently available for this medium-severity issue.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23096 MEDIUM CVSS 5.5
The Linux kernel's uacce subsystem can hang during device cleanup when cdev_device_add fails, as subsequent calls to cdev_device_del attempt to release already-freed memory. Local users with sufficient privileges can trigger a denial of service by causing the device initialization to fail, resulting in a system hang. A patch is not currently available.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23094 MEDIUM CVSS 5.5
The Linux kernel uacce driver improperly validates callback function implementations before creating isolation policy sysfs files, allowing local users with sufficient privileges to trigger a system crash by accessing unimplemented callback functions. This denial of service vulnerability affects systems where device isolation is configured but callback functions are incompletely implemented. No patch is currently available.

Linux Denial Of Service Linux Kernel Redhat Suse
CVE-2026-23093 MEDIUM CVSS 5.5
CVE-2026-23093 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23091 MEDIUM CVSS 5.5
The Linux kernel's Intel Trace Hub driver fails to properly release device references during output device operations, leading to resource exhaustion on systems with local access. A local authenticated user can trigger this memory leak through repeated open/close cycles or error conditions, potentially causing denial of service. No patch is currently available for this vulnerability.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23090 MEDIUM CVSS 5.5
The Linux kernel's Slimbus core driver fails to properly release device references when processing report-present messages, leading to a memory leak that can exhaust system resources. A local attacker with user privileges can trigger this leak by causing repeated Slimbus device registration events, potentially causing a denial of service through memory exhaustion. No patch is currently available for this vulnerability.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23088 MEDIUM CVSS 5.5
Linux kernel null pointer dereference in the tracing subsystem causes a denial of service when synthetic events reference stacktrace fields from other synthetic events. Local users with tracing permissions can trigger a kernel crash by creating chained synthetic events that pass stacktrace data between them. No patch is currently available for this vulnerability.

Linux Debian Denial Of Service Null Pointer Dereference Linux Kernel
CVE-2026-23087 MEDIUM CVSS 5.5
The Linux kernel's Xen SCSI backend driver fails to properly deallocate memory for vscsiblk_info structures during device removal and error handling, allowing local users with appropriate privileges to trigger denial of service through memory exhaustion. The vulnerability exists because scsiback_remove() does not free memory allocated in scsiback_probe(), resulting in persistent memory leaks when removing the device or during probe failures. No patch is currently available for this issue.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23086 MEDIUM CVSS 5.5
Local denial of service in Linux kernel vsock virtio transport allows a local attacker with unprivileged user privileges to exhaust host memory by advertising a large peer buffer size and reading data slowly, forcing the kernel to queue excessive sk_buff allocations. The vulnerability affects both guest-to-host and host-to-guest communication paths due to shared code between virtio transports. No patch is currently available.

Linux Ubuntu Information Disclosure Linux Kernel Redhat
CVE-2026-23085 MEDIUM CVSS 5.5
The GICv3 interrupt controller driver in the Linux kernel on 32-bit systems with CONFIG_ARM_LPAE can truncate physical memory addresses above the 4GB limit when storing them in 32-bit variables, potentially causing system crashes or memory corruption. A local attacker with kernel-level privileges could trigger this condition through memory allocation patterns that force addresses into higher physical memory ranges. This vulnerability affects Linux systems using ARM Large Physical Address Extension with 32-bit address space configurations.

Linux Denial Of Service Linux Kernel Redhat Suse
CVE-2026-23084 MEDIUM CVSS 5.5
A null pointer dereference vulnerability in the Linux kernel's be2net driver allows local users with low privileges to cause a denial of service by triggering a crash through improper parameter handling in the be_cmd_get_mac_from_list() function. The vulnerability occurs when the driver passes both a false pmac_id_valid flag and a NULL pointer to this function, causing the kernel to dereference the invalid pointer. No patch is currently available for this issue.

Linux Null Pointer Dereference Denial Of Service Linux Kernel Redhat
CVE-2026-23082 MEDIUM CVSS 5.5
The Linux kernel's CAN gs_usb driver contains a denial of service vulnerability where failure to submit a USB request results in an anchored URB that is never released, causing the device close function to hang indefinitely. A local attacker with USB device access can trigger this condition by causing usb_submit_urb() to fail, blocking system operations. No patch is currently available for this medium-severity flaw.

Linux Denial Of Service Linux Kernel Redhat Suse
CVE-2026-23081 MEDIUM CVSS 5.5
The Intel XWay PHY driver in the Linux kernel fails to properly release device tree node references, causing memory leaks that can degrade system stability over time. Local users with sufficient privileges can trigger this refcount leakage through repeated device tree operations, potentially leading to denial of service conditions as memory resources become exhausted.

Linux Information Disclosure Intel Linux Kernel Redhat
CVE-2026-23080 MEDIUM CVSS 5.5
Memory leak in Linux kernel CAN USB driver (mcba_usb) allows local attackers with user privileges to exhaust system memory by triggering improper URB cleanup in the USB bulk read callback function. The vulnerability occurs because USB framework unanchors URBs before the completion callback executes, preventing proper deallocation when the device is closed. No patch is currently available.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23079 MEDIUM CVSS 5.5
Memory resource leaks in the Linux kernel's GPIO character device interface allow local users with basic privileges to exhaust system memory through repeated errors in the lineinfo_changed_notify() function. An attacker can trigger this condition without user interaction, potentially causing denial of service through memory exhaustion. No patch is currently available.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23075 MEDIUM CVSS 5.5
The Linux kernel esd_usb driver leaks memory in its USB bulk transfer callback function because unanchored URBs are not properly freed during device closure, allowing a local attacker with device access to exhaust kernel memory and cause a denial of service. The vulnerability affects systems using esd_usb CAN interface devices and can be triggered repeatedly through device open/close cycles.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23072 MEDIUM CVSS 5.5
A memory leak in the Linux kernel's l2tp_udp_encap_recv() function fails to properly release l2tp_session and l2tp_tunnel structures when protocol version validation fails, allowing a local attacker to exhaust kernel memory and trigger a denial of service. The vulnerability affects all Linux systems running the vulnerable kernel versions, and exploitation requires local access with unprivileged user privileges. No patch is currently available.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23071 MEDIUM CVSS 4.7
The Linux kernel's regmap hwspinlock implementation contains a race condition where concurrent threads accessing a shared spinlock flags variable can corrupt IRQ state, potentially leading to denial of service through system hangs or crashes. A local attacker with sufficient privileges can exploit this condition to cause the kernel to become unresponsive. The vulnerability affects Linux systems and currently has no available patch.

Linux Race Condition Information Disclosure Linux Kernel Redhat
CVE-2026-23070 MEDIUM CVSS 5.5
The Linux kernel's OcteonTX2 firmware driver fails to validate firmware data structures before access, causing kernel panics on systems without a MAC block. A local privileged attacker can trigger a denial of service by accessing the uninitialized firmware data region. No patch is currently available for this medium-severity vulnerability.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23069 MEDIUM CVSS 5.5
An integer underflow in the Linux kernel's vsock/virtio credit calculation allows a local attacker with unprivileged access to cause a denial of service by exhausting system resources when the peer shrinks its advertised buffer while data is in flight. The vulnerability enables more data to be queued than the peer can handle, potentially leading to system instability. No patch is currently available for this medium-severity issue.

Linux Integer Overflow Information Disclosure Linux Kernel Redhat
CVE-2026-23067 MEDIUM CVSS 5.5
The Linux kernel's ARM IOMMU page table unmapping function returns a signedness-corrupted value when encountering unmapped memory, causing IOVA address overflow that triggers a kernel panic. Local attackers with sufficient privileges can exploit this to cause a denial of service by attempting to unmap invalid IOMMU pages. A patch is not yet available for this medium-severity vulnerability.

Linux Buffer Overflow Linux Kernel Redhat Suse
CVE-2026-23065 MEDIUM CVSS 5.5
A memory leak in the Linux kernel's AMD platform driver allows local authenticated users to exhaust system memory through repeated failures in the WBRF (Wifi Band RFI Mitigation) record function, potentially leading to denial of service. The vulnerability exists in the wbrf_record() function where a temporary buffer allocated via kcalloc() is not properly freed when the acpi_evaluate_dsm() call fails. An attacker with local access and sufficient privileges could trigger this condition multiple times to consume available memory and degrade system performance.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23064 MEDIUM CVSS 5.5
A null pointer dereference in the Linux kernel's net/sched act_ife module allows local users with low privileges to cause a denial of service through a kernel crash when the ife_encode() function fails to validate return values. The vulnerability affects the traffic control scheduling subsystem and requires local access to trigger.

Linux Null Pointer Dereference Denial Of Service Linux Kernel Redhat
CVE-2026-23063 MEDIUM CVSS 5.5
Linux kernel UACCE subsystem is vulnerable to a null pointer dereference that causes a denial of service when queue release and device removal operations execute concurrently during system shutdown. A local attacker with standard user privileges can trigger this condition by forcing accelerator queue cleanup while the device is being removed, crashing the kernel. No patch is currently available.

Linux Null Pointer Dereference Denial Of Service Linux Kernel Redhat
CVE-2026-23062 MEDIUM CVSS 5.5
The hp-bioscfg driver in the Linux kernel contains a null pointer dereference vulnerability triggered by an off-by-one error and missing NULL checks in the GET_INSTANCE_ID macro when accessing BIOS configuration sysfs attributes. Local users with unprivileged access can trigger a kernel panic by reading certain attribute files, causing denial of service during BIOS configuration operations. No patch is currently available for this vulnerability.

Linux Null Pointer Dereference Denial Of Service Linux Kernel Redhat
CVE-2026-23061 MEDIUM CVSS 5.5
The Linux kernel's Kvaser USB CAN driver fails to properly release USB request block (URB) memory in its completion callback, allowing a local attacker with user privileges to cause a denial of service through memory exhaustion. The vulnerability occurs because URBs are unanchored by the USB framework before the completion function executes, preventing proper cleanup during device removal. No patch is currently available for this medium-severity issue.

Linux Information Disclosure Linux Kernel Redhat Suse
CVE-2026-23060 MEDIUM CVSS 5.5
The Linux kernel's authencesn crypto module fails to validate minimum AAD (Associated Authenticated Data) length, allowing local attackers with unprivileged access to trigger a NULL pointer dereference and kernel panic by submitting specially crafted authentication requests with oversized AAD parameters. This denial-of-service vulnerability affects systems running vulnerable Linux kernel versions and requires local access to exploit. No patch is currently available.

Linux Null Pointer Dereference Denial Of Service Linux Kernel Redhat
CVE-2026-22875 MEDIUM CVSS 5.4
Stored XSS in Movable Type's Export Sites feature allows authenticated attackers to inject malicious scripts that execute in the browsers of logged-in users. The vulnerability affects Movable Type 7 and 8.4 series (both EOL) and requires an attacker to first store the crafted payload through the application. No patch is currently available for this medium-severity flaw.

XSS
CVE-2026-22549 MEDIUM CVSS 4.9
F5 BIG-IP Container Ingress Services contains an improper privilege management flaw that allows high-privileged users to read sensitive cluster secrets beyond their intended authorization scope. An authenticated attacker with elevated permissions could exploit this vulnerability to gain unauthorized access to confidential Kubernetes cluster data. No patch is currently available for this medium-severity issue.

Privilege Escalation Big Ip Container Ingress Services
CVE-2026-22548 MEDIUM CVSS 5.9
BIG-IP Advanced WAF and ASM experience denial of service when processing specific requests under certain conditions, causing the bd process to terminate and disrupting security policy enforcement. An unauthenticated remote attacker can trigger this crash without user interaction, though exploitation requires specific timing and environmental factors. No patch is currently available for affected versions.

Race Condition Big Ip Application Security Manager Big Ip Advanced Web Application Firewall
CVE-2026-22247 MEDIUM CVSS 4.1
GLPI versions 11.0.0 through 11.0.4 allow authenticated administrators to conduct Server-Side Request Forgery (SSRF) attacks via the Webhook functionality, potentially enabling reconnaissance of internal network resources. An attacker with administrative privileges could leverage this capability to probe internal services or bypass network access controls. A patch is available in version 11.0.5 and later.

SSRF Glpi
CVE-2026-22044 MEDIUM CVSS 6.5
Authenticated users in GLPI versions 0.85 through 10.0.22 can exploit a SQL injection vulnerability to read sensitive data from the application database. The vulnerability requires valid credentials and network access but does not allow data modification or denial of service. Version 10.0.23 contains the fix, though no patch is currently available for affected deployments.

SQLi Glpi
CVE-2026-21393 MEDIUM CVSS 5.4
Stored XSS in Movable Type's Edit Comment feature allows authenticated attackers to inject malicious scripts that execute in logged-in users' browsers, affecting both current and end-of-life versions including the 7 and 8.4 series. An attacker with login credentials can craft and store malicious input that triggers arbitrary script execution when other users view or interact with comments. No patch is currently available for this medium-severity vulnerability.

XSS
CVE-2026-20986 MEDIUM CVSS 5.5
Samsung Members versions prior to 15.5.05.4 contain a path traversal vulnerability that enables local attackers to overwrite arbitrary data within the application. This vulnerability requires local access and valid user credentials but does not provide read access to sensitive information. No patch is currently available to address this issue.

Samsung Path Traversal Members
CVE-2026-20985 MEDIUM CVSS 4.3
Members versions up to 5.6.00.11 contains a vulnerability that allows attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privile (CVSS 4.3).

Samsung Members
CVE-2026-20982 MEDIUM CVSS 6.0
Android ShortcutService path traversal vulnerability prior to the February 2026 SMR Release 1 enables privileged local attackers to create files with system-level privileges. The vulnerability requires high-level authentication and does not affect confidentiality significantly, but could allow attackers to modify system files or degrade availability. No patch is currently available.

Path Traversal Android
CVE-2026-20981 MEDIUM CVSS 6.6
Arbitrary command execution with system privileges in Android's FacAtFunction component allows a privileged physical attacker to bypass input validation controls prior to the February 2026 Security Maintenance Release 1. An adversary with physical access and elevated privileges can exploit this vulnerability to execute arbitrary commands at the system level. No patch is currently available.

RCE Android
CVE-2026-20980 MEDIUM CVSS 6.8
Android versions up to 14.0 contains a vulnerability that allows attackers to execute arbitrary commands (CVSS 6.8).

RCE Android
CVE-2026-20978 MEDIUM CVSS 6.1
Android versions up to 13.0 contains a vulnerability that allows attackers to bypass the persistence configuration of the application (CVSS 6.1).

Authentication Bypass Android
CVE-2026-20977 MEDIUM CVSS 5.5
Android versions up to 14.0 contains a vulnerability that allows attackers to interrupt its functioning (CVSS 5.5).

Authentication Bypass Android
CVE-2026-20123 MEDIUM CVSS 4.3
Open redirect in Cisco Prime Infrastructure and Evolved Programmable Network Manager allows unauthenticated remote attackers to redirect users to malicious websites through insufficient input validation in the web management interface. An attacker can intercept and modify HTTP requests to craft malicious URLs that deceive users into visiting attacker-controlled pages. No patch is currently available for this vulnerability.

Cisco Prime Infrastructure Evolved Programmable Network Manager
CVE-2026-20111 MEDIUM CVSS 4.8
Stored XSS in Cisco Prime Infrastructure's web management interface allows authenticated administrators to inject malicious scripts that execute in other users' browsers, potentially leading to session hijacking or sensitive data theft. The vulnerability stems from insufficient input validation on specific data fields and requires valid admin credentials to exploit. No patch is currently available.

Cisco XSS Prime Infrastructure
CVE-2026-20056 MEDIUM CVSS 4.0
Cisco Secure Web Appliance's DVS Engine improperly handles certain archive files, allowing unauthenticated remote attackers to bypass the anti-malware scanner and deliver malicious archives to end users. An attacker can exploit this by sending crafted archive files through affected devices to circumvent malware detection. While downloaded malware requires manual extraction and execution by the user, this vulnerability enables distribution of malicious content that would normally be blocked.

Cisco
CVE-2026-1895 MEDIUM CVSS 6.3
Wekan versions up to 8.20. contains a vulnerability that allows attackers to improper access controls (CVSS 6.3).

Information Disclosure Wekan
CVE-2026-1894 MEDIUM CVSS 6.3
Improper authorization in WeKan's REST API (versions up to 8.20) allows authenticated users to manipulate checklist item parameters and gain unauthorized access to resources across different boards and checklists. An attacker with valid credentials can exploit this vulnerability to read or modify data they should not have access to. The vulnerability has been patched in version 8.21 and users should upgrade immediately.

Information Disclosure Wekan
CVE-2026-1892 MEDIUM CVSS 5.0
Improper authorization in WeKan's REST API setBoardOrgs function (versions up to 8.20) allows authenticated attackers to manipulate cardId, checklistId, and boardId parameters to gain unauthorized access to sensitive board information. The vulnerability requires local network access and high attack complexity, limiting its practical exploitation. A patch is available in version 8.21 and should be applied to all affected deployments.

Information Disclosure Wekan
CVE-2026-1884 MEDIUM CVSS 4.7
ZenTao versions up to 21.7.6-85642 contain a server-side request forgery vulnerability in the Webhook Module's fetchHook function that allows remote attackers to initiate requests from the affected server. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early disclosure notification.

PHP SSRF Zentao
CVE-2026-1835 MEDIUM CVSS 4.3
lcg0124 BootDo is susceptible to cross-site request forgery (CSRF) attacks due to insufficient request validation, allowing remote attackers to perform unauthorized actions on behalf of authenticated users. Public exploit code exists for this vulnerability, though no patch is currently available. The rolling release model used by this product complicates version tracking for affected and patched instances.

CSRF
CVE-2026-1813 MEDIUM CVSS 6.3
Unrestricted file upload in Bolo Solo up to version 2.6.4 allows authenticated remote attackers to upload arbitrary files via the FreeMarker Template Handler component. Public exploit code exists for this vulnerability, and the vendor has not yet released a patch despite early notification. An attacker with valid credentials can achieve limited confidentiality, integrity, and availability impacts.

Java Bolo Solo
CVE-2026-1642 MEDIUM CVSS 5.9
NGINX proxy configurations forwarding traffic to upstream TLS servers can be exploited by network-positioned attackers to inject unencrypted data into proxied responses, potentially compromising data integrity. This vulnerability affects NGINX OSS, NGINX Plus, and related products when specific upstream server conditions are present. No patch is currently available for this medium-severity issue.

Nginx Nginx Ingress Controller Nginx Open Source Nginx Instance Manager Nginx Gateway Fabric
CVE-2026-1554 MEDIUM CVSS 4.2
Central Authentication System Server versions up to 2.0.3 contains a security vulnerability (CVSS 4.2).

Drupal Privilege Escalation Central Authentication System Server
CVE-2026-1553 MEDIUM CVSS 4.8
Improper authorization controls in Drupal Canvas versions before 1.0.4 enable attackers to bypass access restrictions and enumerate or access restricted resources through direct browsing. The vulnerability requires specific conditions to exploit (high attack complexity) but affects all unauthenticated users with network access. Currently, no patch is publicly available and exploitation activity has not been confirmed.

Drupal Drupal Canvas
CVE-2026-1370 MEDIUM CVSS 4.9
SQL injection in the SIBS WooCommerce payment gateway plugin for WordPress (versions up to 2.2.0) allows authenticated administrators to extract sensitive database information through the unescaped 'referencedId' parameter. An attacker with administrator-level access can inject arbitrary SQL queries due to insufficient input sanitization and query preparation. No patch is currently available for this vulnerability.

WordPress SQLi
CVE-2026-0948 MEDIUM CVSS 6.5
The Microsoft Entra ID SSO Login module for Drupal before version 1.0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to escalate privileges through an alternate authentication channel. An attacker can exploit this flaw to gain unauthorized access with elevated permissions on affected Drupal installations. No patch is currently available, and the vulnerability has low exploit probability (EPSS 0.1%).

Drupal Privilege Escalation Authentication Bypass Microsoft Entra Id Sso Login
CVE-2026-0947 MEDIUM CVSS 4.8
At Internet Piano Analytics versions up to 1.0.1 is affected by cross-site scripting (xss) (CVSS 4.8).

Drupal Industrial XSS At Internet Piano Analytics
CVE-2026-0946 MEDIUM CVSS 6.1
Cross-site scripting in the AT Internet SmartTag Drupal module versions before 1.0.1 enables attackers to inject malicious scripts through improper input validation on web pages. An attacker can exploit this vulnerability remotely without authentication to steal session cookies, perform actions on behalf of users, or deface content, though user interaction is required for successful exploitation. No patch is currently available for affected Drupal installations.

Drupal XSS At Internet Smarttag
CVE-2026-0944 MEDIUM CVSS 5.3
Group Invite versions up to 2.3.9 is affected by improper check for unusual or exceptional conditions (CVSS 5.3).

Drupal Group Invite
CVE-2026-0816 MEDIUM CVSS 4.9
The All push notification for WP plugin through version 1.5.3 contains a time-based SQL injection flaw in the 'delete_id' parameter that allows authenticated administrators to execute arbitrary SQL queries and extract sensitive database information. The vulnerability stems from insufficient input escaping and improper query preparation, requiring high-privilege access to exploit. No patch is currently available.

WordPress SQLi
CVE-2026-0743 MEDIUM CVSS 4.4
Stored XSS in WordPress WP Content Permission plugin through the 'ohmem-message' parameter allows authenticated administrators to inject malicious scripts that execute for all users viewing affected pages. The vulnerability exists in versions up to 1.2 due to inadequate input sanitization and output escaping. Exploitation requires administrator-level privileges and no patch is currently available.

WordPress XSS
CVE-2026-0742 MEDIUM CVSS 6.4
Stored cross-site scripting in the Smart Appointment & Booking WordPress plugin through version 1.0.7 allows authenticated subscribers and higher-privileged users to inject malicious scripts into pages via the saab_save_form_data AJAX action due to inadequate input sanitization. Attackers can exploit this vulnerability to execute arbitrary JavaScript that persists and runs for any user viewing the compromised pages. No patch is currently available for this medium-severity flaw.

WordPress XSS
CVE-2026-0681 MEDIUM CVSS 4.4
Extended Random Number Generator (WordPress plugin) is affected by cross-site scripting (xss) (CVSS 4.4).

WordPress XSS
CVE-2026-0679 MEDIUM CVSS 5.3
Unauthenticated attackers can manipulate WooCommerce order statuses through an authorization bypass in the Fortis for WooCommerce plugin (versions up to 1.2.0), allowing them to fraudulently mark orders as paid without receiving payment. The vulnerability stems from an inverted nonce validation check in the payment notification handler that fails to properly authenticate requests. This affects all WordPress sites running the vulnerable plugin and has no available patch.

WordPress Authentication Bypass
CVE-2026-0572 MEDIUM CVSS 6.5
Unauthenticated attackers can modify WordPress plugin settings in WebPurify Profanity Filter up to version 4.0.2 due to missing authorization checks on the options-saving function. This allows unauthorized configuration changes without requiring user authentication or interaction. No patch is currently available for this vulnerability.

WordPress
CVE-2025-70997 MEDIUM CVSS 6.5
A vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an arbitrary user password reset under any user permission level. [CVSS 6.5 MEDIUM]

Authentication Bypass Eladmin
CVE-2025-70545 MEDIUM CVSS 6.1
A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmware v1.1.9_206L. [CVSS 6.1 MEDIUM]

XSS Ppc 2k05x Firmware
CVE-2025-69620 MEDIUM CVSS 5.0
A path traversal in Moo Chan Song v4.5.7 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage. [CVSS 5.0 MEDIUM]

Denial Of Service Path Traversal Office Reader
CVE-2025-69618 MEDIUM CVSS 6.5
Coto versions up to 11.4.0 is affected by unrestricted upload of file with dangerous type (CVSS 6.5).

File Upload RCE Coto
CVE-2025-68699 MEDIUM CVSS 6.5
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing / forwarding inconsistency when handling shared subscriptions ($share/). [CVSS 6.5 MEDIUM]

Denial Of Service Nanomq
CVE-2025-15555 MEDIUM CVSS 6.9
A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hss_ogs_diam_cx_mar_cb of the file src/hss/hss-cx-path.c of the component VoLTE Cx-Test. [CVSS 7.3 HIGH]

Buffer Overflow
CVE-2025-15508 MEDIUM CVSS 5.3
Magic Import Document Extractor (WordPress plugin) versions up to 1.0.4 is affected by information exposure (CVSS 5.3).

WordPress Information Disclosure PHP
CVE-2025-15507 MEDIUM CVSS 5.3
The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_usage() function in all versions up to, and including, 1.0.4. [CVSS 5.3 MEDIUM]

WordPress Authentication Bypass
CVE-2025-15487 MEDIUM CVSS 4.9
The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via the 'file' parameter. [CVSS 4.9 MEDIUM]

WordPress Path Traversal PHP
CVE-2025-15482 MEDIUM CVSS 5.3
Chapa Payment Gateway Plugin for WooCommerce (WordPress plugin) versions up to 1.0.3 is affected by information exposure (CVSS 5.3).

WordPress Information Disclosure PHP
CVE-2025-15260 MEDIUM CVSS 6.5
Loyalty Points and Rewards for WooCommerce versions up to 5.6.0. is affected by missing authorization (CVSS 6.5).

WordPress Authentication Bypass
CVE-2025-14740 MEDIUM CVSS 6.7
Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling of the C:\ProgramData\DockerDesktop directory. [CVSS 6.7 MEDIUM]

Windows Docker Race Condition RCE
CVE-2025-14461 MEDIUM CVSS 5.3
The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, and including, 6.0.2. This is due to the plugin exposing a publicly accessible WooCommerce API callback endpoint (`wc_xendit_callback`) that processes payment callbacks without any authentication or cryptographic verification that the requests originate from Xendit's payment gateway. This makes it possible for unauthenticated attackers to mark any WooCommerce order as paid by...

WordPress Authentication Bypass
CVE-2024-51451 MEDIUM CVSS 6.5
Concert versions up to 2.1.0 contains a vulnerability that allows attackers to conduct various attacks against the vulnerable system, including cross-site scri (CVSS 6.5).

IBM XSS Concert
CVE-2024-43181 MEDIUM CVSS 6.3
IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. [CVSS 6.3 MEDIUM]

IBM Concert
CVE-2024-40685 MEDIUM CVSS 4.3
Log Analysis versions 1.3.5.0 versions up to 1.3.8.3 is affected by cross-site request forgery (csrf) (CVSS 4.3).

IBM Industrial CSRF
CVE-2024-39724 MEDIUM CVSS 5.3
IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not properly limit the allocation of system resources. An authenticated user with internal knowledge of the environment could exploit this weakness to cause a denial of service. [CVSS 5.3 MEDIUM]

IBM Denial Of Service
CVE-2023-38281 MEDIUM CVSS 5.3
IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. [CVSS 5.3 MEDIUM]

IBM Os Image For Red Hat Linux Systems Cloud Pak System
CVE-2023-38017 MEDIUM CVSS 5.3
IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. [CVSS 5.3 MEDIUM]

IBM XSS Cloud Pak System Os Image For Red Hat Linux Systems
CVE-2023-38010 MEDIUM CVSS 5.3
IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system. [CVSS 5.3 MEDIUM]

IBM Cloud Pak System Os Image For Red Hat Linux Systems
CVE-2026-25547 None
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the...

Node.js Denial Of Service
CVE-2026-25517 LOW CVSS 2.7
Wagtail is an open source content management system built on Django. [CVSS 2.7 LOW]

Django
CVE-2026-23107 None
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA The code to restore a ZA context doesn't attempt to allocate the task's sve_state before setting TIF_SME.

Linux Null Pointer Dereference Linux Kernel
CVE-2026-23106 None
In the Linux kernel, the following vulnerability has been resolved: timekeeping: Adjust the leap state for the correct auxiliary timekeeper When __do_ajdtimex() was introduced to handle adjtimex for any timekeeper, this reference to tk_core was not updated.

Linux Industrial Linux Kernel
CVE-2026-23102 None
In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the kernel may read from out-of-bounds memory (and may potentially take a fatal fault) and/or may kill the task with a SIGKILL.

Linux Golang Linux Kernel
CVE-2026-23101 None
In the Linux kernel, the following vulnerability has been resolved: leds: led-class: Only Add LED to leds_list when it is fully ready Before this change the LED was added to leds_list before led_init_core() gets called adding it the list before led_classdev.set_brightness_work gets initialized.

Linux Linux Kernel
CVE-2026-23059 None
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Sanitize payload size to prevent member overflow In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size reported by firmware is used to calculate the copy length into item->iocb.

Linux Linux Kernel
CVE-2026-23058 None
In the Linux kernel, the following vulnerability has been resolved: can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak").

Linux Linux Kernel
CVE-2026-23057 None
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Coalesce only linear skb vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOOD_COPY_LEN = 128), an attempt is made to join them.

Linux Linux Kernel
CVE-2026-23056 None
In the Linux kernel, the following vulnerability has been resolved: uacce: implement mremap in uacce_vm_ops to return -EPERM The current uacce_vm_ops does not support the mremap operation of vm_operations_struct. Implement .mremap to return -EPERM to remind users.

Linux Linux Kernel
CVE-2026-23055 None
In the Linux kernel, the following vulnerability has been resolved: i2c: riic: Move suspend handling to NOIRQ phase Commit 53326135d0e0 ("i2c: riic: Add suspend/resume support") added suspend support for the Renesas I2C driver and following this change on RZ/G3E the following WARNING is seen on entering suspend ...

Linux Linux Kernel
CVE-2026-23054 None
In the Linux kernel, the following vulnerability has been resolved: net: hv_netvsc: reject RSS hash key programming without RX indirection table RSS configuration requires a valid RX indirection table.

Linux Linux Kernel
CVE-2026-23053 None
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong reports a deadlock involving NFSv4.1 state recovery waiting on kthreadd, which is attempting to reclaim memory by calling nfs_release_folio().

Linux Linux Kernel
CVE-2026-23052 None
In the Linux kernel, the following vulnerability has been resolved: ftrace: Do not over-allocate ftrace memory The pg_remaining calculation in ftrace_process_locs() assumes that ENTRIES_PER_PAGE multiplied by 2^order equals the actual capacity of the allocated page group.

Linux Linux Kernel
CVE-2026-23051 None
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix drm panic null pointer when driver not support atomic When driver not support atomic, fb using plane->fb rather than plane->state->fb. (cherry picked from commit 2f2a72de673513247cd6fae14e53f6c40c5841ef)

Linux Null Pointer Dereference Linux Kernel
CVE-2026-23050 None
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix a deadlock when returning a delegation during open() Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415 1 [ffffd0b50e177548] schedule at ffffffff9ca05717 2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1 3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb 4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5 5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4] 6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4] 7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4] 8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4] 9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4] 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4] 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4] 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4] 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4] 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4] 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4] 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4] 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935 The issue is that the delegreturn is being asked to wait for a layout return that cannot complete because a state recovery was initiated.

Linux Linux Kernel
CVE-2026-23049 None
In the Linux kernel, the following vulnerability has been resolved: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel The connector type for the DataImage SCF0700C48GGU18 panel is missing and devm_drm_panel_bridge_add() requires connector type to be set.

Linux Linux Kernel
CVE-2026-23048 None
In the Linux kernel, the following vulnerability has been resolved: udp: call skb_orphan() before skb_attempt_defer_free() Standard UDP receive path does not use skb->destructor. But skmsg layer does use it, since it calls skb_set_owner_sk_safe() from udp_read_skb().

Linux Linux Kernel
CVE-2026-23047 None
In the Linux kernel, the following vulnerability has been resolved: libceph: make calc_target() set t->paused, not just clear it Currently calc_target() clears t->paused if the request shouldn't be paused anymore, but doesn't ever set t->paused even though it's able to determine when the request should be paused.

Linux Linux Kernel
CVE-2026-23046 None
In the Linux kernel, the following vulnerability has been resolved: virtio_net: fix device mismatch in devm_kzalloc/devm_kfree Initial rss_hdr allocation uses virtio_device->device, but virtnet_set_queues() frees using net_device->device.

Linux Linux Kernel
CVE-2026-23045 None
In the Linux kernel, the following vulnerability has been resolved: net/ena: fix missing lock when update devlink params Fix assert lock warning while calling devl_param_driverinit_value_set() in ena.

Linux Linux Kernel
CVE-2026-23044 None
In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: Fix crash when freeing invalid crypto compressor When crypto_alloc_acomp() fails, it returns an ERR_PTR value, not NULL.

Linux Denial Of Service Linux Kernel
CVE-2026-23043 None
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix NULL pointer dereference in do_abort_log_replay() Coverity reported a NULL pointer dereference issue (CID 1666756) in do_abort_log_replay().

Linux Null Pointer Dereference Linux Kernel
CVE-2026-23042 None
In the Linux kernel, the following vulnerability has been resolved: idpf: fix aux device unplugging when rdma is not supported by vport If vport flags do not contain VIRTCHNL2_VPORT_ENABLE_RDMA, driver does not allocate vdev_info for this vport.

Linux Null Pointer Dereference Linux Kernel
CVE-2026-23041 None
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup When bnxt_init_one() fails during initialization (e.g., bnxt_init_int_mode returns -ENODEV), the error path calls bnxt_free_hwrm_resources() which destroys the DMA pool and sets bp->hwrm_dma_pool to NULL.

Broadcom Linux Null Pointer Dereference Denial Of Service Linux Kernel
CVE-2026-23040 None
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: fix typo in frequency notification The NAN notification is for 5745 MHz which corresponds to channel 149 and not 5475 which is not actually a valid channel.

Linux Null Pointer Dereference Linux Kernel
CVE-2026-20987 None
Improper input validation in GalaxyDiagnostic versions up to 3.5.050 contains a security vulnerability.

Industrial
CVE-2026-20984 None
Improper handling of insufficient permission in Galaxy Wearable installed on non-Samsung Device versions up to 2.2.68 contains a vulnerability that allows attackers to access sensitive information.

Samsung
CVE-2026-20732 LOW CVSS 3.1
Big-Ip Access Policy Manager is affected by user interface (ui) misrepresentation of critical information (CVSS 3.1).

Information Disclosure
CVE-2026-20730 LOW CVSS 3.3
A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated [CVSS 3.3 LOW]

Windows
CVE-2026-1791 LOW CVSS 2.7
Hillstone Networks Operation and Maintenance Security Gateway on Linux is affected by unrestricted upload of file with dangerous type (CVSS 2.7).

Linux
CVE-2026-1622 None
Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability to access the local log files. The "obfuscate_literals" option in the query logs does not redact error information, exposing unredacted data in the query log when a customer writes a query that fails. It can allow a user with legitimate...

Information Disclosure
CVE-2026-0873 None
On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an authenticated entity administrator with knowledge to elevate his account to global administrator.

XSS
CVE-2025-71199 None
In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver at91_adc_interrupt can call at91_adc_touch_data_handler function to start the work by schedule_work(&st->touch_st.workq).

Linux Use After Free Linux Kernel
CVE-2025-71198 None
In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection The st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL event_spec field, indicating support for IIO events.

Linux Linux Kernel
CVE-2025-71197 None
In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended.

Linux Buffer Overflow Linux Kernel
CVE-2025-71196 None
In the Linux kernel, the following vulnerability has been resolved: phy: stm32-usphyc: Fix off by one in probe() The "index" variable is used as an index into the usbphyc->phys[] array which has usbphyc->nphys elements. So if it is equal to usbphyc->nphys then it is one element out of bounds.

Linux Linux Kernel
CVE-2025-71195 None
In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix regmap max_register The max_register field is assigned the size of the register memory region instead of the offset of the last register.

Linux Linux Kernel
CVE-2025-71194 None
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type When wait_current_trans() is called during start_transaction(), it currently waits for a blocked transaction without considering whether the given transaction type actually needs to wait for that particular transaction state.

Linux Linux Kernel
CVE-2025-71193 None
In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend Enabling runtime PM before attaching the QPHY instance as driver data can lead to a NULL pointer dereference in runtime PM callbacks that expect valid driver data.

Linux Null Pointer Dereference Denial Of Service Linux Kernel
CVE-2025-71192 None
In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() fails, put_device() is the correct way to drop the device reference. kfree() is not required.

Linux Linux Kernel
CVE-2025-41085 None
Stored Cross-Site Scripting (XSS) vulnerability type in Apidog in the version 2.7.15, where SVG image uploads are not properly sanitized.

XSS
CVE-2025-29867 None
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Hancom Inc. Hancom Office 2018, Hancom Inc.

Buffer Overflow
CVE-2025-27550 LOW CVSS 3.5
Jazz Reporting Service versions up to 7.0.3 contains a vulnerability that allows attackers to an authenticated user on the host network to obtain sensitive information about (CVSS 3.5).

IBM
CVE-2025-22873 LOW CVSS 3.8
It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. [CVSS 3.8 LOW]

Path Traversal
CVE-2025-2134 LOW CVSS 3.5
Jazz Reporting Service versions up to 7.0.3 contains a vulnerability that allows attackers to an authenticated user on the network to affect the system's performance using co (CVSS 3.5).

IBM
CVE-2025-1823 LOW CVSS 3.5
Jazz Reporting Service versions up to 7.0.3 is affected by allocation of resources without limits or throttling (CVSS 3.5).

IBM Denial Of Service

Today's Vulnerabilities Vulnerabilities