diff --git a/2000/CVE-2000-0357.md b/2000/CVE-2000-0357.md new file mode 100644 index 0000000000..7643e445c5 --- /dev/null +++ b/2000/CVE-2000-0357.md @@ -0,0 +1,17 @@ +### [CVE-2000-0357](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0357) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +ORBit and esound in Red Hat Linux 6.1 do not use sufficiently random numbers, which allows local users to guess the authentication keys. + +### POC + +#### Reference +- http://www.redhat.com/corp/support/errata/RHSA1999058-01.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2000/CVE-2000-0358.md b/2000/CVE-2000-0358.md new file mode 100644 index 0000000000..d885b36d2c --- /dev/null +++ b/2000/CVE-2000-0358.md @@ -0,0 +1,17 @@ +### [CVE-2000-0358](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0358) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +ORBit and gnome-session in Red Hat Linux 6.1 allows remote attackers to crash a program. + +### POC + +#### Reference +- http://www.redhat.com/corp/support/errata/RHSA1999058-01.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2003/CVE-2003-0235.md b/2003/CVE-2003-0235.md new file mode 100644 index 0000000000..8a56208af2 --- /dev/null +++ b/2003/CVE-2003-0235.md @@ -0,0 +1,17 @@ +### [CVE-2003-0235](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0235) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Format string vulnerability in POP3 client for Mirabilis ICQ Pro 2003a allows remote malicious servers to execute arbitrary code via format strings in the response to a UIDL command. + +### POC + +#### Reference +- http://www.coresecurity.com/common/showdoc.php?idx=315&idxseccion=10 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2003/CVE-2003-0236.md b/2003/CVE-2003-0236.md new file mode 100644 index 0000000000..602cdcff80 --- /dev/null +++ b/2003/CVE-2003-0236.md @@ -0,0 +1,17 @@ +### [CVE-2003-0236](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0236) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Integer signedness errors in the POP3 client for Mirabilis ICQ Pro 2003a allow remote attackers to execute arbitrary code via the (1) Subject or (2) Date headers. + +### POC + +#### Reference +- http://www.coresecurity.com/common/showdoc.php?idx=315&idxseccion=10 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2003/CVE-2003-0237.md b/2003/CVE-2003-0237.md new file mode 100644 index 0000000000..6efed3bec5 --- /dev/null +++ b/2003/CVE-2003-0237.md @@ -0,0 +1,17 @@ +### [CVE-2003-0237](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0237) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +The "ICQ Features on Demand" functionality for Mirabilis ICQ Pro 2003a does not properly verify the authenticity of software upgrades, which allows remote attackers to install arbitrary software via a spoofing attack. + +### POC + +#### Reference +- http://www.coresecurity.com/common/showdoc.php?idx=315&idxseccion=10 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2003/CVE-2003-0238.md b/2003/CVE-2003-0238.md new file mode 100644 index 0000000000..49a9a64e29 --- /dev/null +++ b/2003/CVE-2003-0238.md @@ -0,0 +1,17 @@ +### [CVE-2003-0238](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0238) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +The Message Session window in Mirabilis ICQ Pro 2003a allows remote attackers to cause a denial of service (CPU consumption) by spoofing the address of an ADS server and sending HTML with a -1 width in a table tag. + +### POC + +#### Reference +- http://www.coresecurity.com/common/showdoc.php?idx=315&idxseccion=10 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2003/CVE-2003-0239.md b/2003/CVE-2003-0239.md new file mode 100644 index 0000000000..e52c427fe8 --- /dev/null +++ b/2003/CVE-2003-0239.md @@ -0,0 +1,17 @@ +### [CVE-2003-0239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0239) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +icqateimg32.dll parsing/rendering library in Mirabilis ICQ Pro 2003a allows remote attackers to cause a denial of service via malformed GIF89a headers that do not contain a GCT (Global Color Table) or an LCT (Local Color Table) after an Image Descriptor. + +### POC + +#### Reference +- http://www.coresecurity.com/common/showdoc.php?idx=315&idxseccion=10 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2007/CVE-2007-1351.md b/2007/CVE-2007-1351.md new file mode 100644 index 0000000000..a707db951b --- /dev/null +++ b/2007/CVE-2007-1351.md @@ -0,0 +1,17 @@ +### [CVE-2007-1351](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow. + +### POC + +#### Reference +- http://sourceforge.net/project/shownotes.php?group_id=3157&release_id=498954 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2008/CVE-2008-3528.md b/2008/CVE-2008-3528.md index 252782c2b2..4cf60eabc4 100644 --- a/2008/CVE-2008-3528.md +++ b/2008/CVE-2008-3528.md @@ -10,6 +10,7 @@ The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and p ### POC #### Reference +- http://www.redhat.com/support/errata/RHSA-2009-0326.html - http://www.vmware.com/security/advisories/VMSA-2009-0016.html #### Github diff --git a/2008/CVE-2008-5700.md b/2008/CVE-2008-5700.md index 21cd459fca..c9b4129add 100644 --- a/2008/CVE-2008-5700.md +++ b/2008/CVE-2008-5700.md @@ -10,6 +10,7 @@ libata in the Linux kernel before 2.6.27.9 does not set minimum timeouts for SG_ ### POC #### Reference +- http://www.redhat.com/support/errata/RHSA-2009-0326.html - http://www.vmware.com/security/advisories/VMSA-2009-0016.html #### Github diff --git a/2009/CVE-2009-0028.md b/2009/CVE-2009-0028.md index c8d72daadf..ffed345664 100644 --- a/2009/CVE-2009-0028.md +++ b/2009/CVE-2009-0028.md @@ -10,6 +10,7 @@ The clone system call in the Linux kernel 2.6.28 and earlier allows local users ### POC #### Reference +- http://www.redhat.com/support/errata/RHSA-2009-0326.html - http://www.ubuntu.com/usn/usn-751-1 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html diff --git a/2009/CVE-2009-0269.md b/2009/CVE-2009-0269.md index d325e2fe42..05af8c9a6c 100644 --- a/2009/CVE-2009-0269.md +++ b/2009/CVE-2009-0269.md @@ -10,6 +10,7 @@ fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28. ### POC #### Reference +- http://www.redhat.com/support/errata/RHSA-2009-0326.html - http://www.ubuntu.com/usn/usn-751-1 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html diff --git a/2009/CVE-2009-0322.md b/2009/CVE-2009-0322.md index 380769cd15..a9acc2a373 100644 --- a/2009/CVE-2009-0322.md +++ b/2009/CVE-2009-0322.md @@ -10,6 +10,7 @@ drivers/firmware/dell_rbu.c in the Linux kernel before 2.6.27.13, and 2.6.28.x b ### POC #### Reference +- http://www.redhat.com/support/errata/RHSA-2009-0326.html - http://www.ubuntu.com/usn/usn-751-1 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html diff --git a/2009/CVE-2009-0675.md b/2009/CVE-2009-0675.md index f5620ae056..efa6f63a88 100644 --- a/2009/CVE-2009-0675.md +++ b/2009/CVE-2009-0675.md @@ -10,6 +10,7 @@ The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel before ### POC #### Reference +- http://www.redhat.com/support/errata/RHSA-2009-0326.html - http://www.ubuntu.com/usn/usn-751-1 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html diff --git a/2009/CVE-2009-0676.md b/2009/CVE-2009-0676.md index 2e2fc6aa6d..e050c5685a 100644 --- a/2009/CVE-2009-0676.md +++ b/2009/CVE-2009-0676.md @@ -10,6 +10,7 @@ The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.2 ### POC #### Reference +- http://www.redhat.com/support/errata/RHSA-2009-0326.html - http://www.ubuntu.com/usn/usn-751-1 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html diff --git a/2009/CVE-2009-0778.md b/2009/CVE-2009-0778.md index 4488f1e618..fd92709f77 100644 --- a/2009/CVE-2009-0778.md +++ b/2009/CVE-2009-0778.md @@ -10,6 +10,7 @@ The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, whe ### POC #### Reference +- http://www.redhat.com/support/errata/RHSA-2009-0326.html - http://www.vmware.com/security/advisories/VMSA-2009-0016.html #### Github diff --git a/2013/CVE-2013-2347.md b/2013/CVE-2013-2347.md index f9fd736ed2..ab46e50fd1 100644 --- a/2013/CVE-2013-2347.md +++ b/2013/CVE-2013-2347.md @@ -10,6 +10,7 @@ The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allow ### POC #### Reference +- http://ddilabs.blogspot.com/2014/02/fun-with-hp-data-protector-execbar.html - http://www.exploit-db.com/exploits/32164 #### Github diff --git a/2016/CVE-2016-15060.md b/2016/CVE-2016-15060.md new file mode 100644 index 0000000000..8c2cb94ca5 --- /dev/null +++ b/2016/CVE-2016-15060.md @@ -0,0 +1,25 @@ +### [CVE-2016-15060](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-15060) +![](https://img.shields.io/static/v1?label=Product&message=FTP%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Buffer%20Overflow&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. + +### POC + +#### Reference +- https://www.exploit-db.com/exploits/40714 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2016/CVE-2016-20099.md b/2016/CVE-2016-20099.md new file mode 100644 index 0000000000..0e6cd048f2 --- /dev/null +++ b/2016/CVE-2016-20099.md @@ -0,0 +1,18 @@ +### [CVE-2016-20099](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-20099) +![](https://img.shields.io/static/v1?label=Product&message=l-smash&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Loop%20with%20Unreachable%20Exit%20Condition%20('Infinite%20Loop')&color=brightgreen) + +### Description + +L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_probe() in importer/vc1_imp.c that allows attackers to hang applications via crafted input files. Attackers can supply a file consisting only of zero bytes, which lsmash_read_file() probes automatically, causing indefinite CPU consumption and denial of service. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/cve-2016-20099-2026-110599-l-smash-hevc-importer-double-free +- https://hackmd.io/@haind-pwn/l-smash-hevc-importer-double-free + +#### Github +No PoCs found on GitHub currently. + diff --git a/2020/CVE-2020-11656.md b/2020/CVE-2020-11656.md index 6b4277f4dc..d4825811ff 100644 --- a/2020/CVE-2020-11656.md +++ b/2020/CVE-2020-11656.md @@ -1,5 +1,6 @@ ### [CVE-2020-11656](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11656) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -10,6 +11,7 @@ In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, a ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpujul2020.html diff --git a/2020/CVE-2020-12062.md b/2020/CVE-2020-12062.md index b894b3e737..8cfbcd5ee7 100644 --- a/2020/CVE-2020-12062.md +++ b/2020/CVE-2020-12062.md @@ -1,5 +1,6 @@ ### [CVE-2020-12062](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12062) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-12243.md b/2020/CVE-2020-12243.md index 2aedde5f10..586a341d5d 100644 --- a/2020/CVE-2020-12243.md +++ b/2020/CVE-2020-12243.md @@ -1,5 +1,6 @@ ### [CVE-2020-12243](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12243) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-12723.md b/2020/CVE-2020-12723.md index 56d6bdc699..2187611169 100644 --- a/2020/CVE-2020-12723.md +++ b/2020/CVE-2020-12723.md @@ -1,5 +1,6 @@ ### [CVE-2020-12723](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12723) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-12762.md b/2020/CVE-2020-12762.md index 06cd39aad1..657a8820c2 100644 --- a/2020/CVE-2020-12762.md +++ b/2020/CVE-2020-12762.md @@ -1,5 +1,7 @@ ### [CVE-2020-12762](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12762) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-13434.md b/2020/CVE-2020-13434.md index 6232c83dd4..792eb5b8ca 100644 --- a/2020/CVE-2020-13434.md +++ b/2020/CVE-2020-13434.md @@ -1,5 +1,6 @@ ### [CVE-2020-13434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13434) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-13435.md b/2020/CVE-2020-13435.md index 6b9b44b933..77de3f6db7 100644 --- a/2020/CVE-2020-13435.md +++ b/2020/CVE-2020-13435.md @@ -1,5 +1,6 @@ ### [CVE-2020-13435](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13435) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-13529.md b/2020/CVE-2020-13529.md index c351be3ca4..b2aa16e6f8 100644 --- a/2020/CVE-2020-13529.md +++ b/2020/CVE-2020-13529.md @@ -1,6 +1,7 @@ ### [CVE-2020-13529](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13529) ![](https://img.shields.io/static/v1?label=Product&message=Systemd&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Canonical%20Ubuntu%2020.04%20LTS%2C%20Systemd%20245%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-290%3A%20Authentication%20Bypass%20by%20Spoofing&color=brightgreen) ### Description diff --git a/2020/CVE-2020-13630.md b/2020/CVE-2020-13630.md index f675e5543b..dba56370e8 100644 --- a/2020/CVE-2020-13630.md +++ b/2020/CVE-2020-13630.md @@ -1,5 +1,6 @@ ### [CVE-2020-13630](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13630) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -11,6 +12,7 @@ ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, #### Reference - http://seclists.org/fulldisclosure/2020/Nov/19 +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html diff --git a/2020/CVE-2020-13631.md b/2020/CVE-2020-13631.md index 45dfb52e16..3918a5b5db 100644 --- a/2020/CVE-2020-13631.md +++ b/2020/CVE-2020-13631.md @@ -1,5 +1,6 @@ ### [CVE-2020-13631](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13631) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -11,6 +12,7 @@ SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of #### Reference - http://seclists.org/fulldisclosure/2020/Nov/19 +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html diff --git a/2020/CVE-2020-13632.md b/2020/CVE-2020-13632.md index b2ece475e2..d8db2a3c23 100644 --- a/2020/CVE-2020-13632.md +++ b/2020/CVE-2020-13632.md @@ -1,5 +1,6 @@ ### [CVE-2020-13632](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13632) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -10,6 +11,7 @@ ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference v ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html diff --git a/2020/CVE-2020-13776.md b/2020/CVE-2020-13776.md index da19ef2e22..793a7ed4a7 100644 --- a/2020/CVE-2020-13776.md +++ b/2020/CVE-2020-13776.md @@ -1,5 +1,6 @@ ### [CVE-2020-13776](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13776) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-13777.md b/2020/CVE-2020-13777.md index d716e6baae..ee156d784a 100644 --- a/2020/CVE-2020-13777.md +++ b/2020/CVE-2020-13777.md @@ -1,5 +1,6 @@ ### [CVE-2020-13777](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13777) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-13871.md b/2020/CVE-2020-13871.md index a1a0b0f5e3..2b2cb16c35 100644 --- a/2020/CVE-2020-13871.md +++ b/2020/CVE-2020-13871.md @@ -1,5 +1,6 @@ ### [CVE-2020-13871](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13871) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -10,6 +11,7 @@ SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the p ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.sqlite.org/src/info/c8d3b9f0a750a529 diff --git a/2020/CVE-2020-14145.md b/2020/CVE-2020-14145.md index b558059d30..2b74ac9d9a 100644 --- a/2020/CVE-2020-14145.md +++ b/2020/CVE-2020-14145.md @@ -1,5 +1,6 @@ ### [CVE-2020-14145](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14145) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-14422.md b/2020/CVE-2020-14422.md index 828b8bb0cb..391a85620a 100644 --- a/2020/CVE-2020-14422.md +++ b/2020/CVE-2020-14422.md @@ -1,5 +1,6 @@ ### [CVE-2020-14422](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14422) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-15358.md b/2020/CVE-2020-15358.md index b63aec7aab..2380efa898 100644 --- a/2020/CVE-2020-15358.md +++ b/2020/CVE-2020-15358.md @@ -1,5 +1,6 @@ ### [CVE-2020-15358](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15358) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -11,6 +12,7 @@ In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leadi #### Reference - http://seclists.org/fulldisclosure/2020/Nov/19 +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://usn.ubuntu.com/4438-1/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html diff --git a/2020/CVE-2020-15523.md b/2020/CVE-2020-15523.md index f481cecccf..78c684bd57 100644 --- a/2020/CVE-2020-15523.md +++ b/2020/CVE-2020-15523.md @@ -1,5 +1,6 @@ ### [CVE-2020-15523](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15523) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-15778.md b/2020/CVE-2020-15778.md index a40ca49398..7cbe5b6bed 100644 --- a/2020/CVE-2020-15778.md +++ b/2020/CVE-2020-15778.md @@ -1,6 +1,7 @@ ### [CVE-2020-15778](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15778) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-15801.md b/2020/CVE-2020-15801.md index 500b9a2815..5fae7a78cd 100644 --- a/2020/CVE-2020-15801.md +++ b/2020/CVE-2020-15801.md @@ -1,5 +1,6 @@ ### [CVE-2020-15801](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15801) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-19185.md b/2020/CVE-2020-19185.md index a5da85fa62..2daf64b19b 100644 --- a/2020/CVE-2020-19185.md +++ b/2020/CVE-2020-19185.md @@ -1,5 +1,6 @@ ### [CVE-2020-19185](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19185) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-19186.md b/2020/CVE-2020-19186.md index 97ec155580..b25b9b31b4 100644 --- a/2020/CVE-2020-19186.md +++ b/2020/CVE-2020-19186.md @@ -1,5 +1,6 @@ ### [CVE-2020-19186](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19186) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-19187.md b/2020/CVE-2020-19187.md index 4396f07807..3f249690f8 100644 --- a/2020/CVE-2020-19187.md +++ b/2020/CVE-2020-19187.md @@ -1,5 +1,6 @@ ### [CVE-2020-19187](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19187) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-19188.md b/2020/CVE-2020-19188.md index c42aacf16b..a5b7413f42 100644 --- a/2020/CVE-2020-19188.md +++ b/2020/CVE-2020-19188.md @@ -1,5 +1,6 @@ ### [CVE-2020-19188](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19188) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-19189.md b/2020/CVE-2020-19189.md index 67365d6a97..b581314f11 100644 --- a/2020/CVE-2020-19189.md +++ b/2020/CVE-2020-19189.md @@ -1,5 +1,6 @@ ### [CVE-2020-19189](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19189) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-19190.md b/2020/CVE-2020-19190.md index ae6a273be8..afc51d2ae6 100644 --- a/2020/CVE-2020-19190.md +++ b/2020/CVE-2020-19190.md @@ -1,5 +1,6 @@ ### [CVE-2020-19190](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19190) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-19909.md b/2020/CVE-2020-19909.md index 589791fa04..173dd5dec9 100644 --- a/2020/CVE-2020-19909.md +++ b/2020/CVE-2020-19909.md @@ -1,5 +1,6 @@ ### [CVE-2020-19909](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-19909) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-21913.md b/2020/CVE-2020-21913.md index 69de5f6a77..00a11f0b35 100644 --- a/2020/CVE-2020-21913.md +++ b/2020/CVE-2020-21913.md @@ -1,5 +1,6 @@ ### [CVE-2020-21913](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-21913) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-24659.md b/2020/CVE-2020-24659.md index 81b20884bc..879ed06150 100644 --- a/2020/CVE-2020-24659.md +++ b/2020/CVE-2020-24659.md @@ -1,5 +1,6 @@ ### [CVE-2020-24659](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24659) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-24977.md b/2020/CVE-2020-24977.md index aec8039c73..38d5049698 100644 --- a/2020/CVE-2020-24977.md +++ b/2020/CVE-2020-24977.md @@ -1,5 +1,6 @@ ### [CVE-2020-24977](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-25692.md b/2020/CVE-2020-25692.md index 31ae73931f..debe734575 100644 --- a/2020/CVE-2020-25692.md +++ b/2020/CVE-2020-25692.md @@ -1,5 +1,6 @@ ### [CVE-2020-25692](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25692) ![](https://img.shields.io/static/v1?label=Product&message=openldap&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=openldap%202.4.55%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476&color=brightgreen) diff --git a/2020/CVE-2020-25709.md b/2020/CVE-2020-25709.md index d13d0f74ec..f4c4f95027 100644 --- a/2020/CVE-2020-25709.md +++ b/2020/CVE-2020-25709.md @@ -1,5 +1,6 @@ ### [CVE-2020-25709](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25709) ![](https://img.shields.io/static/v1?label=Product&message=OpenLDAP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=openldap%202.4.56%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Reachable%20Assertion&color=brightgreen) diff --git a/2020/CVE-2020-26116.md b/2020/CVE-2020-26116.md index fefe0ad3ce..5aa3d8cbc5 100644 --- a/2020/CVE-2020-26116.md +++ b/2020/CVE-2020-26116.md @@ -1,5 +1,6 @@ ### [CVE-2020-26116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26116) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-27618.md b/2020/CVE-2020-27618.md index b1d5937182..26213aa72b 100644 --- a/2020/CVE-2020-27618.md +++ b/2020/CVE-2020-27618.md @@ -1,5 +1,6 @@ ### [CVE-2020-27618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27618) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-28196.md b/2020/CVE-2020-28196.md index 41fc65620f..7766ce2146 100644 --- a/2020/CVE-2020-28196.md +++ b/2020/CVE-2020-28196.md @@ -1,5 +1,6 @@ ### [CVE-2020-28196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28196) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-29361.md b/2020/CVE-2020-29361.md index 5792a065a7..20773a4be7 100644 --- a/2020/CVE-2020-29361.md +++ b/2020/CVE-2020-29361.md @@ -1,5 +1,6 @@ ### [CVE-2020-29361](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29361) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-29363.md b/2020/CVE-2020-29363.md index 0f855921d3..2b929f55aa 100644 --- a/2020/CVE-2020-29363.md +++ b/2020/CVE-2020-29363.md @@ -1,5 +1,6 @@ ### [CVE-2020-29363](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29363) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-29562.md b/2020/CVE-2020-29562.md index 37c9e9b2fa..6ad0f0a5f1 100644 --- a/2020/CVE-2020-29562.md +++ b/2020/CVE-2020-29562.md @@ -1,5 +1,6 @@ ### [CVE-2020-29562](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29562) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-35525.md b/2020/CVE-2020-35525.md index cca635cb23..0434d6e5ba 100644 --- a/2020/CVE-2020-35525.md +++ b/2020/CVE-2020-35525.md @@ -1,5 +1,7 @@ ### [CVE-2020-35525](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35525) ![](https://img.shields.io/static/v1?label=Product&message=sqlite&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=sqlite%203.31.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476&color=brightgreen) diff --git a/2020/CVE-2020-35527.md b/2020/CVE-2020-35527.md index 50b9fd8661..730c246453 100644 --- a/2020/CVE-2020-35527.md +++ b/2020/CVE-2020-35527.md @@ -1,5 +1,6 @@ ### [CVE-2020-35527](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35527) ![](https://img.shields.io/static/v1?label=Product&message=sqlite&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=sqlite%203.31.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-119&color=brightgreen) diff --git a/2020/CVE-2020-36221.md b/2020/CVE-2020-36221.md index 7fe0c0a5ce..16e88fb2d8 100644 --- a/2020/CVE-2020-36221.md +++ b/2020/CVE-2020-36221.md @@ -1,5 +1,6 @@ ### [CVE-2020-36221](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36221) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-36222.md b/2020/CVE-2020-36222.md index cd5e94a969..73d6ee8340 100644 --- a/2020/CVE-2020-36222.md +++ b/2020/CVE-2020-36222.md @@ -1,5 +1,6 @@ ### [CVE-2020-36222](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36222) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-36223.md b/2020/CVE-2020-36223.md index 65a3dfc14f..e8321c13a7 100644 --- a/2020/CVE-2020-36223.md +++ b/2020/CVE-2020-36223.md @@ -1,5 +1,6 @@ ### [CVE-2020-36223](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36223) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-36224.md b/2020/CVE-2020-36224.md index e6bb59ec29..124d61b800 100644 --- a/2020/CVE-2020-36224.md +++ b/2020/CVE-2020-36224.md @@ -1,5 +1,6 @@ ### [CVE-2020-36224](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36224) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-36225.md b/2020/CVE-2020-36225.md index 4b952f43a8..766b756b41 100644 --- a/2020/CVE-2020-36225.md +++ b/2020/CVE-2020-36225.md @@ -1,5 +1,6 @@ ### [CVE-2020-36225](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36225) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-36226.md b/2020/CVE-2020-36226.md index 42f80333b8..bd8668dbcf 100644 --- a/2020/CVE-2020-36226.md +++ b/2020/CVE-2020-36226.md @@ -1,5 +1,6 @@ ### [CVE-2020-36226](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36226) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-36227.md b/2020/CVE-2020-36227.md index c051bf88e5..e4be627f24 100644 --- a/2020/CVE-2020-36227.md +++ b/2020/CVE-2020-36227.md @@ -1,5 +1,6 @@ ### [CVE-2020-36227](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36227) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-36228.md b/2020/CVE-2020-36228.md index b7fab9f41e..4b592398be 100644 --- a/2020/CVE-2020-36228.md +++ b/2020/CVE-2020-36228.md @@ -1,5 +1,6 @@ ### [CVE-2020-36228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36228) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-36229.md b/2020/CVE-2020-36229.md index 5ab0a6800f..b8d8dc4c99 100644 --- a/2020/CVE-2020-36229.md +++ b/2020/CVE-2020-36229.md @@ -1,5 +1,6 @@ ### [CVE-2020-36229](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36229) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2020/CVE-2020-36230.md b/2020/CVE-2020-36230.md index 95f9c109de..c64a3ff4fd 100644 --- a/2020/CVE-2020-36230.md +++ b/2020/CVE-2020-36230.md @@ -1,5 +1,6 @@ ### [CVE-2020-36230](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36230) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-20193.md b/2021/CVE-2021-20193.md index 28aefaa898..59c1114cc5 100644 --- a/2021/CVE-2021-20193.md +++ b/2021/CVE-2021-20193.md @@ -1,6 +1,7 @@ ### [CVE-2021-20193](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20193) ![](https://img.shields.io/static/v1?label=Product&message=tar&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=1.33%20and%20earlier%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-401-%3ECWE-125&color=brightgreen) ### Description diff --git a/2021/CVE-2021-20227.md b/2021/CVE-2021-20227.md index 6a77b52d80..d5314132e5 100644 --- a/2021/CVE-2021-20227.md +++ b/2021/CVE-2021-20227.md @@ -1,5 +1,6 @@ ### [CVE-2021-20227](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20227) ![](https://img.shields.io/static/v1?label=Product&message=sqlite&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=sqlite%203.34.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2021/CVE-2021-20231.md b/2021/CVE-2021-20231.md index 3db41b67f1..bffa5f45fd 100644 --- a/2021/CVE-2021-20231.md +++ b/2021/CVE-2021-20231.md @@ -1,5 +1,6 @@ ### [CVE-2021-20231](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20231) ![](https://img.shields.io/static/v1?label=Product&message=gnutls&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=gnutls%203.7.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2021/CVE-2021-20232.md b/2021/CVE-2021-20232.md index 0cbb38d8f0..9610a09ae8 100644 --- a/2021/CVE-2021-20232.md +++ b/2021/CVE-2021-20232.md @@ -1,5 +1,6 @@ ### [CVE-2021-20232](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20232) ![](https://img.shields.io/static/v1?label=Product&message=gnutls&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=gnutls%203.7.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2021/CVE-2021-20305.md b/2021/CVE-2021-20305.md index 6f7f569082..1614c6ab35 100644 --- a/2021/CVE-2021-20305.md +++ b/2021/CVE-2021-20305.md @@ -1,5 +1,6 @@ ### [CVE-2021-20305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20305) ![](https://img.shields.io/static/v1?label=Product&message=nettle&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=nettle%203.7.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-327&color=brightgreen) diff --git a/2021/CVE-2021-22876.md b/2021/CVE-2021-22876.md index 0a65bf0552..3ef4a13fd1 100644 --- a/2021/CVE-2021-22876.md +++ b/2021/CVE-2021-22876.md @@ -1,6 +1,7 @@ ### [CVE-2021-22876](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22876) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=7.1.1%20to%20and%20including%207.75.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Privacy%20Violation%20(CWE-359)&color=brightgreen) ### Description @@ -10,6 +11,7 @@ curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Pers ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com//security-alerts/cpujul2021.html #### Github diff --git a/2021/CVE-2021-22890.md b/2021/CVE-2021-22890.md index a54eb06f79..a7aff6db52 100644 --- a/2021/CVE-2021-22890.md +++ b/2021/CVE-2021-22890.md @@ -1,6 +1,7 @@ ### [CVE-2021-22890](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22890) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=7.63.0%20to%20and%20including%207.75.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Man-in-the-Middle%20(CWE-300)&color=brightgreen) ### Description @@ -10,6 +11,7 @@ curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicio ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com//security-alerts/cpujul2021.html #### Github diff --git a/2021/CVE-2021-22897.md b/2021/CVE-2021-22897.md index 7a07537d5d..50ab9b7e68 100644 --- a/2021/CVE-2021-22897.md +++ b/2021/CVE-2021-22897.md @@ -1,6 +1,7 @@ ### [CVE-2021-22897](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22897) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=7.61.0%20through%207.76.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Business%20Logic%20Errors%20(CWE-840)&color=brightgreen) ### Description @@ -10,6 +11,7 @@ curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong sessio ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujan2022.html diff --git a/2021/CVE-2021-22898.md b/2021/CVE-2021-22898.md index ba2533daad..aa020c94a2 100644 --- a/2021/CVE-2021-22898.md +++ b/2021/CVE-2021-22898.md @@ -1,6 +1,7 @@ ### [CVE-2021-22898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22898) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=7.7%20through%207.76.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Disclosure%20(CWE-200)&color=brightgreen) ### Description diff --git a/2021/CVE-2021-22901.md b/2021/CVE-2021-22901.md index dc5081deb1..20b99bbdfd 100644 --- a/2021/CVE-2021-22901.md +++ b/2021/CVE-2021-22901.md @@ -1,6 +1,7 @@ ### [CVE-2021-22901](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22901) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=7.75.0%20through%207.76.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20After%20Free%20(CWE-416)&color=brightgreen) ### Description @@ -10,6 +11,7 @@ curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujan2022.html diff --git a/2021/CVE-2021-22922.md b/2021/CVE-2021-22922.md index c4e5b906d7..aee4cc1d22 100644 --- a/2021/CVE-2021-22922.md +++ b/2021/CVE-2021-22922.md @@ -1,5 +1,6 @@ ### [CVE-2021-22922](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22922) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=curl%207.27.0%20%20to%20and%20including%207.77.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Business%20Logic%20Errors%20(CWE-840)&color=brightgreen) @@ -10,6 +11,7 @@ When curl is instructed to download content using the metalink feature, theconte ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpuoct2021.html #### Github diff --git a/2021/CVE-2021-22923.md b/2021/CVE-2021-22923.md index 1ade00c645..76b7fef72a 100644 --- a/2021/CVE-2021-22923.md +++ b/2021/CVE-2021-22923.md @@ -1,5 +1,6 @@ ### [CVE-2021-22923](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22923) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=curl%207.27.0%20to%20and%20including%207.77.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Cleartext%20Transmission%20of%20Sensitive%20Information%20(CWE-319)&color=brightgreen) @@ -10,6 +11,7 @@ When curl is instructed to get content using the metalink feature, and a user na ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpuoct2021.html #### Github diff --git a/2021/CVE-2021-22924.md b/2021/CVE-2021-22924.md index 760abcd089..8ee71b213b 100644 --- a/2021/CVE-2021-22924.md +++ b/2021/CVE-2021-22924.md @@ -1,5 +1,6 @@ ### [CVE-2021-22924](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22924) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=curl%207.10.4%20to%20and%20include%20curl%207.77.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Input%20Validation%20(CWE-20)&color=brightgreen) @@ -10,6 +11,7 @@ libcurl keeps previously used connections in a connection pool for subsequenttra ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuoct2021.html diff --git a/2021/CVE-2021-22925.md b/2021/CVE-2021-22925.md index c11ad863d3..72cc5a29e9 100644 --- a/2021/CVE-2021-22925.md +++ b/2021/CVE-2021-22925.md @@ -1,5 +1,6 @@ ### [CVE-2021-22925](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22925) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=curl%207.7%20to%20and%20including%207.77.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Disclosure%20(CWE-200)&color=brightgreen) @@ -11,6 +12,7 @@ curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in l #### Reference - http://seclists.org/fulldisclosure/2021/Sep/39 +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuoct2021.html diff --git a/2021/CVE-2021-22926.md b/2021/CVE-2021-22926.md index 6da7f5b1e7..928dc6cbb5 100644 --- a/2021/CVE-2021-22926.md +++ b/2021/CVE-2021-22926.md @@ -1,5 +1,6 @@ ### [CVE-2021-22926](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22926) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=curll%207.33.0%20to%20and%20include%207.77.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Business%20Logic%20Errors%20(CWE-840)&color=brightgreen) @@ -10,6 +11,7 @@ libcurl-using applications can ask for a specific client certificate to be used ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuoct2021.html diff --git a/2021/CVE-2021-22945.md b/2021/CVE-2021-22945.md index 38c86364ff..cbad8616bc 100644 --- a/2021/CVE-2021-22945.md +++ b/2021/CVE-2021-22945.md @@ -1,5 +1,6 @@ ### [CVE-2021-22945](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22945) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=curl%207.73.0%20to%20and%20including%207.78.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Double%20Free%20(CWE-415)&color=brightgreen) @@ -10,6 +11,7 @@ When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpuoct2021.html #### Github diff --git a/2021/CVE-2021-22946.md b/2021/CVE-2021-22946.md index 13ce84fb67..b911f08cce 100644 --- a/2021/CVE-2021-22946.md +++ b/2021/CVE-2021-22946.md @@ -1,5 +1,6 @@ ### [CVE-2021-22946](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22946) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=curl%207.20.0%20to%20and%20including%207.78.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Required%20Cryptographic%20Step%20(CWE-325)&color=brightgreen) @@ -10,6 +11,7 @@ A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpujul2022.html diff --git a/2021/CVE-2021-22947.md b/2021/CVE-2021-22947.md index 3eb55b9a9f..098201670c 100644 --- a/2021/CVE-2021-22947.md +++ b/2021/CVE-2021-22947.md @@ -1,5 +1,6 @@ ### [CVE-2021-22947](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22947) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=curl%207.20.0%20to%20and%20including%207.78.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Cryptographic%20Issues%20-%20Generic%20(CWE-310)&color=brightgreen) @@ -10,6 +11,7 @@ When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-389290.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpujul2022.html diff --git a/2021/CVE-2021-23336.md b/2021/CVE-2021-23336.md index dece00e2e0..62b583d800 100644 --- a/2021/CVE-2021-23336.md +++ b/2021/CVE-2021-23336.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.7.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.8.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=unspecified%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Web%20Cache%20Poisoning&color=brightgreen) diff --git a/2021/CVE-2021-27219.md b/2021/CVE-2021-27219.md index a9dc7cf14c..7adf6a82ae 100644 --- a/2021/CVE-2021-27219.md +++ b/2021/CVE-2021-27219.md @@ -1,5 +1,6 @@ ### [CVE-2021-27219](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27219) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-27645.md b/2021/CVE-2021-27645.md index 86f0deb921..296e43325a 100644 --- a/2021/CVE-2021-27645.md +++ b/2021/CVE-2021-27645.md @@ -1,5 +1,6 @@ ### [CVE-2021-27645](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27645) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-28041.md b/2021/CVE-2021-28041.md index 5f61752519..627e93c38c 100644 --- a/2021/CVE-2021-28041.md +++ b/2021/CVE-2021-28041.md @@ -1,5 +1,6 @@ ### [CVE-2021-28041](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28041) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-28153.md b/2021/CVE-2021-28153.md index a1ffda3b43..02adcd0044 100644 --- a/2021/CVE-2021-28153.md +++ b/2021/CVE-2021-28153.md @@ -1,5 +1,6 @@ ### [CVE-2021-28153](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28153) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-28363.md b/2021/CVE-2021-28363.md index 4e07ee6064..212c222c68 100644 --- a/2021/CVE-2021-28363.md +++ b/2021/CVE-2021-28363.md @@ -1,5 +1,6 @@ ### [CVE-2021-28363](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28363) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-28861.md b/2021/CVE-2021-28861.md index 25da52b18a..927e107a74 100644 --- a/2021/CVE-2021-28861.md +++ b/2021/CVE-2021-28861.md @@ -1,5 +1,6 @@ ### [CVE-2021-28861](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28861) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-31239.md b/2021/CVE-2021-31239.md index f22651255c..6769b21475 100644 --- a/2021/CVE-2021-31239.md +++ b/2021/CVE-2021-31239.md @@ -1,5 +1,7 @@ ### [CVE-2021-31239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31239) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-3177.md b/2021/CVE-2021-3177.md index 189ae0ade7..791462275b 100644 --- a/2021/CVE-2021-3177.md +++ b/2021/CVE-2021-3177.md @@ -1,5 +1,6 @@ ### [CVE-2021-3177](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3177) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-32292.md b/2021/CVE-2021-32292.md index c2bbc1284e..92b2eaba8f 100644 --- a/2021/CVE-2021-32292.md +++ b/2021/CVE-2021-32292.md @@ -1,5 +1,6 @@ ### [CVE-2021-32292](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32292) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-3326.md b/2021/CVE-2021-3326.md index 99527e1fca..4507c64915 100644 --- a/2021/CVE-2021-3326.md +++ b/2021/CVE-2021-3326.md @@ -1,5 +1,6 @@ ### [CVE-2021-3326](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3326) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-33294.md b/2021/CVE-2021-33294.md index da6b0443af..d6a4a8a571 100644 --- a/2021/CVE-2021-33294.md +++ b/2021/CVE-2021-33294.md @@ -1,5 +1,6 @@ ### [CVE-2021-33294](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33294) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-33560.md b/2021/CVE-2021-33560.md index 2205ada4f8..3f6cc93fdd 100644 --- a/2021/CVE-2021-33560.md +++ b/2021/CVE-2021-33560.md @@ -1,5 +1,6 @@ ### [CVE-2021-33560](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33560) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-33574.md b/2021/CVE-2021-33574.md index 12f84d5e2a..0f8fe17fb2 100644 --- a/2021/CVE-2021-33574.md +++ b/2021/CVE-2021-33574.md @@ -1,5 +1,6 @@ ### [CVE-2021-33574](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33574) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-33655.md b/2021/CVE-2021-33655.md index a5768a8854..4883c5caba 100644 --- a/2021/CVE-2021-33655.md +++ b/2021/CVE-2021-33655.md @@ -1,5 +1,6 @@ ### [CVE-2021-33655](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33655) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%205.19.0-rc1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%3A%20Out-of-bounds%20Write&color=brightgreen) diff --git a/2021/CVE-2021-33910.md b/2021/CVE-2021-33910.md index 71fb2c1301..000da513f3 100644 --- a/2021/CVE-2021-33910.md +++ b/2021/CVE-2021-33910.md @@ -1,5 +1,6 @@ ### [CVE-2021-33910](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33910) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-3426.md b/2021/CVE-2021-3426.md index 48e09c47fe..1cdeb42768 100644 --- a/2021/CVE-2021-3426.md +++ b/2021/CVE-2021-3426.md @@ -1,5 +1,6 @@ ### [CVE-2021-3426](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3426) ![](https://img.shields.io/static/v1?label=Product&message=python&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=python%203.8.9%2C%20python%203.9.3%2C%20python%203.10.0a7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200&color=brightgreen) diff --git a/2021/CVE-2021-3516.md b/2021/CVE-2021-3516.md index ff9fe759f5..7bed8eeb7c 100644 --- a/2021/CVE-2021-3516.md +++ b/2021/CVE-2021-3516.md @@ -1,5 +1,6 @@ ### [CVE-2021-3516](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3516) ![](https://img.shields.io/static/v1?label=Product&message=libxml2&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=libxml2%202.9.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2021/CVE-2021-3517.md b/2021/CVE-2021-3517.md index 61836c5d78..53c418d218 100644 --- a/2021/CVE-2021-3517.md +++ b/2021/CVE-2021-3517.md @@ -1,5 +1,6 @@ ### [CVE-2021-3517](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3517) ![](https://img.shields.io/static/v1?label=Product&message=libxml2&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=libxml2%202.9.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787&color=brightgreen) diff --git a/2021/CVE-2021-3518.md b/2021/CVE-2021-3518.md index 411a5eb06c..93da140be2 100644 --- a/2021/CVE-2021-3518.md +++ b/2021/CVE-2021-3518.md @@ -1,5 +1,6 @@ ### [CVE-2021-3518](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3518) ![](https://img.shields.io/static/v1?label=Product&message=libxml2&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=libxml2%202.9.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2021/CVE-2021-3520.md b/2021/CVE-2021-3520.md index fc8ad74af8..b84a3ac8bc 100644 --- a/2021/CVE-2021-3520.md +++ b/2021/CVE-2021-3520.md @@ -1,5 +1,6 @@ ### [CVE-2021-3520](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3520) ![](https://img.shields.io/static/v1?label=Product&message=lz4&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=lz4-1.8.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-190-%3ECWE-787&color=brightgreen) diff --git a/2021/CVE-2021-3537.md b/2021/CVE-2021-3537.md index 460ad6b6fd..6abee08d7a 100644 --- a/2021/CVE-2021-3537.md +++ b/2021/CVE-2021-3537.md @@ -1,5 +1,6 @@ ### [CVE-2021-3537](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3537) ![](https://img.shields.io/static/v1?label=Product&message=libxml2&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=libxml2%202.9.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476&color=brightgreen) diff --git a/2021/CVE-2021-3541.md b/2021/CVE-2021-3541.md index c835e18a0f..bb36a5a0d1 100644 --- a/2021/CVE-2021-3541.md +++ b/2021/CVE-2021-3541.md @@ -1,6 +1,7 @@ ### [CVE-2021-3541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3541) ![](https://img.shields.io/static/v1?label=Product&message=libxml2&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=2.9.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen) ### Description diff --git a/2021/CVE-2021-3580.md b/2021/CVE-2021-3580.md index ffaa9978ff..7ababb4f38 100644 --- a/2021/CVE-2021-3580.md +++ b/2021/CVE-2021-3580.md @@ -1,5 +1,6 @@ ### [CVE-2021-3580](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3580) ![](https://img.shields.io/static/v1?label=Product&message=nettle&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=nettle%203.7.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20&color=brightgreen) diff --git a/2021/CVE-2021-35942.md b/2021/CVE-2021-35942.md index a470d57dd5..2586a665e6 100644 --- a/2021/CVE-2021-35942.md +++ b/2021/CVE-2021-35942.md @@ -1,5 +1,6 @@ ### [CVE-2021-35942](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-36084.md b/2021/CVE-2021-36084.md index d77481194b..05b4e6d0c6 100644 --- a/2021/CVE-2021-36084.md +++ b/2021/CVE-2021-36084.md @@ -1,5 +1,7 @@ ### [CVE-2021-36084](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36084) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-36085.md b/2021/CVE-2021-36085.md index b67ec20e50..f124676069 100644 --- a/2021/CVE-2021-36085.md +++ b/2021/CVE-2021-36085.md @@ -1,5 +1,7 @@ ### [CVE-2021-36085](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36085) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-36086.md b/2021/CVE-2021-36086.md index 2259397109..5d00a07fc6 100644 --- a/2021/CVE-2021-36086.md +++ b/2021/CVE-2021-36086.md @@ -1,5 +1,7 @@ ### [CVE-2021-36086](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36086) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-36087.md b/2021/CVE-2021-36087.md index d2feee4e82..907db39e7a 100644 --- a/2021/CVE-2021-36087.md +++ b/2021/CVE-2021-36087.md @@ -1,5 +1,7 @@ ### [CVE-2021-36087](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36087) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-36222.md b/2021/CVE-2021-36222.md index 9ef8e3ebcd..df7fa98ee2 100644 --- a/2021/CVE-2021-36222.md +++ b/2021/CVE-2021-36222.md @@ -1,5 +1,6 @@ ### [CVE-2021-36222](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-36690.md b/2021/CVE-2021-36690.md index 8ec81dcd4a..a241c0061d 100644 --- a/2021/CVE-2021-36690.md +++ b/2021/CVE-2021-36690.md @@ -1,5 +1,6 @@ ### [CVE-2021-36690](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36690) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-3733.md b/2021/CVE-2021-3733.md index 8004ed36ed..0ba988fcde 100644 --- a/2021/CVE-2021-3733.md +++ b/2021/CVE-2021-3733.md @@ -1,6 +1,7 @@ ### [CVE-2021-3733](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3733) ![](https://img.shields.io/static/v1?label=Product&message=python&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20python%20v3.6.14%2C%20python%20v3.7.11%2C%20python%20v3.8.10%2C%20python%20v3.9.5.%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%20-%20Uncontrolled%20Resource%20Consumption&color=brightgreen) ### Description diff --git a/2021/CVE-2021-3737.md b/2021/CVE-2021-3737.md index 5217c9fabb..2c5efe3ac3 100644 --- a/2021/CVE-2021-3737.md +++ b/2021/CVE-2021-3737.md @@ -1,6 +1,7 @@ ### [CVE-2021-3737](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737) ![](https://img.shields.io/static/v1?label=Product&message=python&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20python%20v3.6.14%2C%20python%20v3.7.11%2C%20python%20v3.8.11%2C%20python%20v3.9.6%2C%20python%20v3.10.0b2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-835%20-%20Loop%20with%20Unreachable%20Exit%20Condition%20('Infinite%20Loop')%2C%20CWE-400%20-%20Uncontrolled%20Resource%20Consumption&color=brightgreen) ### Description diff --git a/2021/CVE-2021-3759.md b/2021/CVE-2021-3759.md index 48432094c3..d1e778d442 100644 --- a/2021/CVE-2021-3759.md +++ b/2021/CVE-2021-3759.md @@ -1,5 +1,6 @@ ### [CVE-2021-3759](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3759) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20Linux%20kernel%205.15-rc1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%20-%20Uncontrolled%20Resource%20Consumption&color=brightgreen) diff --git a/2021/CVE-2021-37600.md b/2021/CVE-2021-37600.md index f75542cb64..b331bb41a2 100644 --- a/2021/CVE-2021-37600.md +++ b/2021/CVE-2021-37600.md @@ -1,5 +1,6 @@ ### [CVE-2021-37600](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37600) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-37750.md b/2021/CVE-2021-37750.md index 223ea3c232..e08b5a1743 100644 --- a/2021/CVE-2021-37750.md +++ b/2021/CVE-2021-37750.md @@ -1,5 +1,6 @@ ### [CVE-2021-37750](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37750) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-3826.md b/2021/CVE-2021-3826.md index 03fbf71588..91d0fd04ae 100644 --- a/2021/CVE-2021-3826.md +++ b/2021/CVE-2021-3826.md @@ -1,5 +1,6 @@ ### [CVE-2021-3826](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3826) ![](https://img.shields.io/static/v1?label=Product&message=gcc&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=gcc%2011.2.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-119&color=brightgreen) diff --git a/2021/CVE-2021-38604.md b/2021/CVE-2021-38604.md index feed250fa9..986753830b 100644 --- a/2021/CVE-2021-38604.md +++ b/2021/CVE-2021-38604.md @@ -1,5 +1,6 @@ ### [CVE-2021-38604](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-3997.md b/2021/CVE-2021-3997.md index c2a1ee8864..5a43f1589a 100644 --- a/2021/CVE-2021-3997.md +++ b/2021/CVE-2021-3997.md @@ -1,6 +1,7 @@ ### [CVE-2021-3997](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3997) ![](https://img.shields.io/static/v1?label=Product&message=systemd&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20v251-rc1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-674%20-%20Uncontrolled%20Recursion&color=brightgreen) ### Description diff --git a/2021/CVE-2021-3998.md b/2021/CVE-2021-3998.md index b639754849..d96a5d6420 100644 --- a/2021/CVE-2021-3998.md +++ b/2021/CVE-2021-3998.md @@ -1,6 +1,7 @@ ### [CVE-2021-3998](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3998) ![](https://img.shields.io/static/v1?label=Product&message=glibc&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Affects%20glibc%20v2.33%20and%20above.%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%20-%20Out-of-bounds%20Read&color=brightgreen) ### Description diff --git a/2021/CVE-2021-3999.md b/2021/CVE-2021-3999.md index 0af861a14b..6d64687fb6 100644 --- a/2021/CVE-2021-3999.md +++ b/2021/CVE-2021-3999.md @@ -1,6 +1,7 @@ ### [CVE-2021-3999](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3999) ![](https://img.shields.io/static/v1?label=Product&message=glibc&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20glibc%20v2.31%20and%20above.%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-193%20-%20Off-by-one%20Error&color=brightgreen) ### Description diff --git a/2021/CVE-2021-4037.md b/2021/CVE-2021-4037.md index c6db279af1..012efb5d3d 100644 --- a/2021/CVE-2021-4037.md +++ b/2021/CVE-2021-4037.md @@ -7,6 +7,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Control&color=brightgreen) diff --git a/2021/CVE-2021-41617.md b/2021/CVE-2021-41617.md index f5cc643411..04f8f5dbe0 100644 --- a/2021/CVE-2021-41617.md +++ b/2021/CVE-2021-41617.md @@ -2,6 +2,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -14,6 +15,7 @@ sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurati #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://www.tenable.com/plugins/nessus/154174 diff --git a/2021/CVE-2021-4189.md b/2021/CVE-2021-4189.md index 47f9f5e6d8..0cc703b90d 100644 --- a/2021/CVE-2021-4189.md +++ b/2021/CVE-2021-4189.md @@ -1,6 +1,7 @@ ### [CVE-2021-4189](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4189) ![](https://img.shields.io/static/v1?label=Product&message=python&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20python%203.6.14%2C%20python%203.7.11%2C%20python%203.8.9%2C%20python%203.9.3%2C%20python%203.10.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Not-Known&color=brightgreen) ### Description diff --git a/2021/CVE-2021-4209.md b/2021/CVE-2021-4209.md index 63e84f3bf2..bb6c9442f1 100644 --- a/2021/CVE-2021-4209.md +++ b/2021/CVE-2021-4209.md @@ -1,6 +1,7 @@ ### [CVE-2021-4209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4209) ![](https://img.shields.io/static/v1?label=Product&message=GnuTLS&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20gnutls%20v3.7.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476%20-%20NULL%20Pointer%20Dereference&color=brightgreen) ### Description diff --git a/2021/CVE-2021-43396.md b/2021/CVE-2021-43396.md index a2b7d2e2f1..38a3fc4758 100644 --- a/2021/CVE-2021-43396.md +++ b/2021/CVE-2021-43396.md @@ -1,5 +1,6 @@ ### [CVE-2021-43396](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43396) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-43618.md b/2021/CVE-2021-43618.md index 5ca1390d2f..209cc38672 100644 --- a/2021/CVE-2021-43618.md +++ b/2021/CVE-2021-43618.md @@ -1,5 +1,6 @@ ### [CVE-2021-43618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43618) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-44879.md b/2021/CVE-2021-44879.md index 2d89f7723c..e88309caf5 100644 --- a/2021/CVE-2021-44879.md +++ b/2021/CVE-2021-44879.md @@ -1,5 +1,8 @@ ### [CVE-2021-44879](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44879) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -11,6 +14,7 @@ In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special fi #### Reference - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3 +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9056d6489f5a41cfbb67f719d2c0ce61ead72d9f #### Github diff --git a/2021/CVE-2021-45960.md b/2021/CVE-2021-45960.md index 60cb6f7280..d989f75404 100644 --- a/2021/CVE-2021-45960.md +++ b/2021/CVE-2021-45960.md @@ -1,5 +1,6 @@ ### [CVE-2021-45960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45960) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-46143.md b/2021/CVE-2021-46143.md index 757e817250..84ca48c7aa 100644 --- a/2021/CVE-2021-46143.md +++ b/2021/CVE-2021-46143.md @@ -1,5 +1,6 @@ ### [CVE-2021-46143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46143) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-46195.md b/2021/CVE-2021-46195.md index b26968224d..814110c74b 100644 --- a/2021/CVE-2021-46195.md +++ b/2021/CVE-2021-46195.md @@ -1,5 +1,6 @@ ### [CVE-2021-46195](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46195) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-46828.md b/2021/CVE-2021-46828.md index d764a9612e..620763a223 100644 --- a/2021/CVE-2021-46828.md +++ b/2021/CVE-2021-46828.md @@ -1,5 +1,6 @@ ### [CVE-2021-46828](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46828) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2021/CVE-2021-46848.md b/2021/CVE-2021-46848.md index 4eec5f76b2..0bc2883d2f 100644 --- a/2021/CVE-2021-46848.md +++ b/2021/CVE-2021-46848.md @@ -1,5 +1,6 @@ ### [CVE-2021-46848](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46848) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-0171.md b/2022/CVE-2022-0171.md index 08c7acc100..f808a8d570 100644 --- a/2022/CVE-2022-0171.md +++ b/2022/CVE-2022-0171.md @@ -1,5 +1,6 @@ ### [CVE-2022-0171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0171) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20kernel%205.18-rc4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-459%20-%20Incomplete%20Cleanup.&color=brightgreen) diff --git a/2022/CVE-2022-0391.md b/2022/CVE-2022-0391.md index ed3d4caf2f..014aa9011e 100644 --- a/2022/CVE-2022-0391.md +++ b/2022/CVE-2022-0391.md @@ -1,5 +1,6 @@ ### [CVE-2022-0391](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0391) ![](https://img.shields.io/static/v1?label=Product&message=python&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=python%203.10.0b1%2C%20python%203.9.5%2C%20python%203.8.11%2C%20python%203.7.11%2C%20python%203.6.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-74&color=brightgreen) diff --git a/2022/CVE-2022-0563.md b/2022/CVE-2022-0563.md index c2a0b20d81..e840bc0bc6 100644 --- a/2022/CVE-2022-0563.md +++ b/2022/CVE-2022-0563.md @@ -1,5 +1,6 @@ ### [CVE-2022-0563](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0563) ![](https://img.shields.io/static/v1?label=Product&message=util-linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=util-linux%202.37.4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-209&color=brightgreen) diff --git a/2022/CVE-2022-0778.md b/2022/CVE-2022-0778.md index 552416a857..9e75e3c355 100644 --- a/2022/CVE-2022-0778.md +++ b/2022/CVE-2022-0778.md @@ -1,17 +1,6 @@ ### [CVE-2022-0778](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0778) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20%3C%20V1.7%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20%3C%20V1.9%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20%3C%20V17%20Update%205%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20%3C%20V18%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20%3C%20V2.0%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20%3C%20V2.0.1%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20%3C%20V2.3.1%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20%3C%20V3.3%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20%3C%20V4.0.1%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20%3C%20V6.5%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20only%20when%20running%20on%20ROX%20II%20%3C%20V2.15.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%201.0.2zd%20(Affected%201.0.2-1.0.2zc)%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%201.1.1n%20(Affected%201.1.1-1.1.1m)%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%203.0.2%20(Affected%203.0.0%2C3.0.1)%20&color=brightgreen) diff --git a/2022/CVE-2022-1012.md b/2022/CVE-2022-1012.md index ddf27710b0..2bf2978836 100644 --- a/2022/CVE-2022-1012.md +++ b/2022/CVE-2022-1012.md @@ -1,5 +1,6 @@ ### [CVE-2022-1012](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1012) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Linux%20kernel%20version%20prior%20to%205.18-rc6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-401&color=brightgreen) diff --git a/2022/CVE-2022-1015.md b/2022/CVE-2022-1015.md index 7bbccdb643..64118eb7bc 100644 --- a/2022/CVE-2022-1015.md +++ b/2022/CVE-2022-1015.md @@ -1,5 +1,6 @@ ### [CVE-2022-1015](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1015) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Kernel%205.16.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787&color=brightgreen) diff --git a/2022/CVE-2022-1271.md b/2022/CVE-2022-1271.md index 9a5c398da6..abc9846df8 100644 --- a/2022/CVE-2022-1271.md +++ b/2022/CVE-2022-1271.md @@ -1,6 +1,8 @@ ### [CVE-2022-1271](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1271) ![](https://img.shields.io/static/v1?label=Product&message=gzip%2C%20xz-utils&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20gzip%201.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-179%20-%20Incorrect%20Behavior%20Order%3A%20Early%20Validation%2C%20CWE-1173%20Improper%20Use%20of%20Validation%20Framework&color=brightgreen) ### Description diff --git a/2022/CVE-2022-1292.md b/2022/CVE-2022-1292.md index 8e6d3ac3f4..66108b093e 100644 --- a/2022/CVE-2022-1292.md +++ b/2022/CVE-2022-1292.md @@ -1,8 +1,10 @@ ### [CVE-2022-1292](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1292) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%201.0.2ze%20(Affected%201.0.2-1.0.2zd)%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%201.1.1o%20(Affected%201.1.1-1.1.1n)%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%203.0.3%20(Affected%203.0.0%2C3.0.1%2C3.0.2)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20injection&color=brightgreen) ### Description diff --git a/2022/CVE-2022-1304.md b/2022/CVE-2022-1304.md index ef547aa871..f7bf26e8d7 100644 --- a/2022/CVE-2022-1304.md +++ b/2022/CVE-2022-1304.md @@ -1,5 +1,6 @@ ### [CVE-2022-1304](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1304) ![](https://img.shields.io/static/v1?label=Product&message=e2fsprogs&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e2fsprogs%201.46.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=(CWE-125%7CCWE-787)&color=brightgreen) diff --git a/2022/CVE-2022-1343.md b/2022/CVE-2022-1343.md index c9c5585176..3ce5dc323d 100644 --- a/2022/CVE-2022-1343.md +++ b/2022/CVE-2022-1343.md @@ -1,6 +1,8 @@ ### [CVE-2022-1343](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1343) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%203.0.3%20(Affected%203.0.0%2C3.0.1%2C3.0.2)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20signature%20verfication&color=brightgreen) ### Description diff --git a/2022/CVE-2022-1434.md b/2022/CVE-2022-1434.md index b647d4b94c..6fcedb3b60 100644 --- a/2022/CVE-2022-1434.md +++ b/2022/CVE-2022-1434.md @@ -1,6 +1,8 @@ ### [CVE-2022-1434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1434) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%203.0.3%20(Affected%203.0.0%2C3.0.1%2C3.0.2)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20MAC%20key&color=brightgreen) ### Description diff --git a/2022/CVE-2022-1462.md b/2022/CVE-2022-1462.md index f7c336b628..529600bcab 100644 --- a/2022/CVE-2022-1462.md +++ b/2022/CVE-2022-1462.md @@ -1,5 +1,6 @@ ### [CVE-2022-1462](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1462) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=no%20information%20yet%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-362&color=brightgreen) diff --git a/2022/CVE-2022-1473.md b/2022/CVE-2022-1473.md index 81f4d79272..4a65b15794 100644 --- a/2022/CVE-2022-1473.md +++ b/2022/CVE-2022-1473.md @@ -1,6 +1,8 @@ ### [CVE-2022-1473](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1473) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%203.0.3%20(Affected%203.0.0%2C3.0.1%2C3.0.2)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen) ### Description diff --git a/2022/CVE-2022-1679.md b/2022/CVE-2022-1679.md index 5bb383c42d..7601c6ebbb 100644 --- a/2022/CVE-2022-1679.md +++ b/2022/CVE-2022-1679.md @@ -1,5 +1,6 @@ ### [CVE-2022-1679](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1679) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Linux%20kernel%205.18-rc7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2022/CVE-2022-1852.md b/2022/CVE-2022-1852.md index 17c389588d..f9ea94d0b9 100644 --- a/2022/CVE-2022-1852.md +++ b/2022/CVE-2022-1852.md @@ -1,5 +1,6 @@ ### [CVE-2022-1852](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1852) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=kernel%205.19%20rc1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476&color=brightgreen) diff --git a/2022/CVE-2022-1882.md b/2022/CVE-2022-1882.md index df1b35d689..c83617c7b5 100644 --- a/2022/CVE-2022-1882.md +++ b/2022/CVE-2022-1882.md @@ -1,5 +1,6 @@ ### [CVE-2022-1882](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1882) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Linux%20kernel%205.18-rc8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2022/CVE-2022-20421.md b/2022/CVE-2022-20421.md index b5e2103590..ca73fdd58c 100644 --- a/2022/CVE-2022-20421.md +++ b/2022/CVE-2022-20421.md @@ -1,5 +1,6 @@ ### [CVE-2022-20421](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20421) ![](https://img.shields.io/static/v1?label=Product&message=Android&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Android%20kernel%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Elevation%20of%20privilege&color=brightgreen) diff --git a/2022/CVE-2022-20422.md b/2022/CVE-2022-20422.md index 267225fcf4..e631195152 100644 --- a/2022/CVE-2022-20422.md +++ b/2022/CVE-2022-20422.md @@ -1,5 +1,6 @@ ### [CVE-2022-20422](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20422) ![](https://img.shields.io/static/v1?label=Product&message=Android&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Android%20kernel%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Elevation%20of%20privilege&color=brightgreen) diff --git a/2022/CVE-2022-20566.md b/2022/CVE-2022-20566.md index 5b6716bd8d..843be084d9 100644 --- a/2022/CVE-2022-20566.md +++ b/2022/CVE-2022-20566.md @@ -1,5 +1,6 @@ ### [CVE-2022-20566](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20566) ![](https://img.shields.io/static/v1?label=Product&message=Android&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Android%20kernel%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Elevation%20of%20privilege&color=brightgreen) diff --git a/2022/CVE-2022-2068.md b/2022/CVE-2022-2068.md index fa8e3c5db7..6325b993a8 100644 --- a/2022/CVE-2022-2068.md +++ b/2022/CVE-2022-2068.md @@ -1,8 +1,10 @@ ### [CVE-2022-2068](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2068) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%201.0.2zf%20(Affected%201.0.2-1.0.2ze)%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%201.1.1p%20(Affected%201.1.1-1.1.1o)%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%203.0.4%20(Affected%203.0.0%2C3.0.1%2C3.0.2%2C3.0.3)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20injection&color=brightgreen) ### Description diff --git a/2022/CVE-2022-2078.md b/2022/CVE-2022-2078.md index 9de8836000..bf937e2531 100644 --- a/2022/CVE-2022-2078.md +++ b/2022/CVE-2022-2078.md @@ -1,5 +1,6 @@ ### [CVE-2022-2078](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2078) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=kernel%205.19%20rc1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-121&color=brightgreen) diff --git a/2022/CVE-2022-2097.md b/2022/CVE-2022-2097.md index a9963a2cee..50a652fb9c 100644 --- a/2022/CVE-2022-2097.md +++ b/2022/CVE-2022-2097.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=36%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%201.1.1q%20(Affected%201.1.1-1.1.1p)%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20OpenSSL%203.0.5%20(Affected%203.0.0-3.0.4)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=h300s%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=h410c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=h410s%20&color=brightgreen) diff --git a/2022/CVE-2022-21123.md b/2022/CVE-2022-21123.md index 8f9aa3daee..625bf21633 100644 --- a/2022/CVE-2022-21123.md +++ b/2022/CVE-2022-21123.md @@ -1,5 +1,6 @@ ### [CVE-2022-21123](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21123) ![](https://img.shields.io/static/v1?label=Product&message=Intel(R)%20Processors&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=See%20references%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=%20information%20disclosure%20&color=brightgreen) diff --git a/2022/CVE-2022-21125.md b/2022/CVE-2022-21125.md index 08916eb842..1bb5193357 100644 --- a/2022/CVE-2022-21125.md +++ b/2022/CVE-2022-21125.md @@ -1,5 +1,6 @@ ### [CVE-2022-21125](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21125) ![](https://img.shields.io/static/v1?label=Product&message=Intel(R)%20Processors&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=See%20references%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=%20information%20disclosure%20&color=brightgreen) diff --git a/2022/CVE-2022-21166.md b/2022/CVE-2022-21166.md index cb020ad512..cb280306ce 100644 --- a/2022/CVE-2022-21166.md +++ b/2022/CVE-2022-21166.md @@ -1,5 +1,6 @@ ### [CVE-2022-21166](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21166) ![](https://img.shields.io/static/v1?label=Product&message=Intel(R)%20Processors&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=See%20references%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=%20information%20disclosure%20&color=brightgreen) diff --git a/2022/CVE-2022-21505.md b/2022/CVE-2022-21505.md index be0d891cc2..4f5553e70b 100644 --- a/2022/CVE-2022-21505.md +++ b/2022/CVE-2022-21505.md @@ -1,5 +1,6 @@ ### [CVE-2022-21505](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21505) ![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Oracle%20Linux%3A%207%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Oracle%20Linux%3A%208%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Oracle%20Linux%3A%209%20&color=brightgreen) diff --git a/2022/CVE-2022-2153.md b/2022/CVE-2022-2153.md index 12a7e8534b..763057ec01 100644 --- a/2022/CVE-2022-2153.md +++ b/2022/CVE-2022-2153.md @@ -1,5 +1,6 @@ ### [CVE-2022-2153](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2153) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=kernel%205.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476&color=brightgreen) diff --git a/2022/CVE-2022-22576.md b/2022/CVE-2022-22576.md index b1b58116c4..4d4d1118db 100644 --- a/2022/CVE-2022-22576.md +++ b/2022/CVE-2022-22576.md @@ -1,6 +1,7 @@ ### [CVE-2022-22576](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22576) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20curl%207.83.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication%20-%20Generic%20(CWE-287)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-2274.md b/2022/CVE-2022-2274.md index 6e05d4dbda..1dcc421da0 100644 --- a/2022/CVE-2022-2274.md +++ b/2022/CVE-2022-2274.md @@ -1,6 +1,8 @@ ### [CVE-2022-2274](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2274) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Affects%20OpenSSL%203.0.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) ### Description diff --git a/2022/CVE-2022-22822.md b/2022/CVE-2022-22822.md index d57d4dc178..21c049df50 100644 --- a/2022/CVE-2022-22822.md +++ b/2022/CVE-2022-22822.md @@ -1,5 +1,6 @@ ### [CVE-2022-22822](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22822) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-22823.md b/2022/CVE-2022-22823.md index e5f19dbb15..497516d501 100644 --- a/2022/CVE-2022-22823.md +++ b/2022/CVE-2022-22823.md @@ -1,5 +1,6 @@ ### [CVE-2022-22823](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22823) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-22824.md b/2022/CVE-2022-22824.md index cac3739f5a..6f3f5f26e8 100644 --- a/2022/CVE-2022-22824.md +++ b/2022/CVE-2022-22824.md @@ -1,5 +1,6 @@ ### [CVE-2022-22824](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22824) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-22825.md b/2022/CVE-2022-22825.md index 99d158305a..18bdb6aabd 100644 --- a/2022/CVE-2022-22825.md +++ b/2022/CVE-2022-22825.md @@ -1,5 +1,6 @@ ### [CVE-2022-22825](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22825) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-22826.md b/2022/CVE-2022-22826.md index f1fb452a87..480a79b251 100644 --- a/2022/CVE-2022-22826.md +++ b/2022/CVE-2022-22826.md @@ -1,5 +1,6 @@ ### [CVE-2022-22826](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22826) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-22827.md b/2022/CVE-2022-22827.md index e28353e684..e02a903279 100644 --- a/2022/CVE-2022-22827.md +++ b/2022/CVE-2022-22827.md @@ -1,5 +1,6 @@ ### [CVE-2022-22827](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22827) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-23218.md b/2022/CVE-2022-23218.md index c4cd95909c..66f59061af 100644 --- a/2022/CVE-2022-23218.md +++ b/2022/CVE-2022-23218.md @@ -1,5 +1,6 @@ ### [CVE-2022-23218](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23218) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-23219.md b/2022/CVE-2022-23219.md index 87f764d114..3ff454fcf4 100644 --- a/2022/CVE-2022-23219.md +++ b/2022/CVE-2022-23219.md @@ -1,5 +1,6 @@ ### [CVE-2022-23219](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23219) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-23308.md b/2022/CVE-2022-23308.md index 21bf7164ea..8fedf9c1b7 100644 --- a/2022/CVE-2022-23308.md +++ b/2022/CVE-2022-23308.md @@ -1,5 +1,7 @@ ### [CVE-2022-23308](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23308) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-23852.md b/2022/CVE-2022-23852.md index 4a350221c2..57aa7ce34f 100644 --- a/2022/CVE-2022-23852.md +++ b/2022/CVE-2022-23852.md @@ -1,5 +1,6 @@ ### [CVE-2022-23852](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23852) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-23990.md b/2022/CVE-2022-23990.md index 9afc06b66e..c40f99ecc0 100644 --- a/2022/CVE-2022-23990.md +++ b/2022/CVE-2022-23990.md @@ -1,5 +1,6 @@ ### [CVE-2022-23990](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23990) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-24407.md b/2022/CVE-2022-24407.md index 31ce1d8dee..b339a06f3f 100644 --- a/2022/CVE-2022-24407.md +++ b/2022/CVE-2022-24407.md @@ -1,5 +1,6 @@ ### [CVE-2022-24407](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24407) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-2503.md b/2022/CVE-2022-2503.md index 192a0e4ca3..85eb37a928 100644 --- a/2022/CVE-2022-2503.md +++ b/2022/CVE-2022-2503.md @@ -1,5 +1,6 @@ ### [CVE-2022-2503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2503) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=unspecified%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-302%20Authentication%20Bypass%20by%20Assumed-Immutable%20Data&color=brightgreen) diff --git a/2022/CVE-2022-2509.md b/2022/CVE-2022-2509.md index 24efdd6c89..9e05177083 100644 --- a/2022/CVE-2022-2509.md +++ b/2022/CVE-2022-2509.md @@ -1,5 +1,6 @@ ### [CVE-2022-2509](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2509) ![](https://img.shields.io/static/v1?label=Product&message=GnuTLS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=gnutls%203.7.7(Fixed)%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Double%20Free&color=brightgreen) diff --git a/2022/CVE-2022-25235.md b/2022/CVE-2022-25235.md index 2fe76f8744..afe53f5470 100644 --- a/2022/CVE-2022-25235.md +++ b/2022/CVE-2022-25235.md @@ -1,5 +1,6 @@ ### [CVE-2022-25235](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25235) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-25236.md b/2022/CVE-2022-25236.md index b7dde53e97..749c3f58b9 100644 --- a/2022/CVE-2022-25236.md +++ b/2022/CVE-2022-25236.md @@ -1,5 +1,6 @@ ### [CVE-2022-25236](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25236) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-25313.md b/2022/CVE-2022-25313.md index 37b37e155a..b49ac746f2 100644 --- a/2022/CVE-2022-25313.md +++ b/2022/CVE-2022-25313.md @@ -1,5 +1,6 @@ ### [CVE-2022-25313](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25313) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-25314.md b/2022/CVE-2022-25314.md index 9601e5d3d0..540d1cf764 100644 --- a/2022/CVE-2022-25314.md +++ b/2022/CVE-2022-25314.md @@ -1,5 +1,6 @@ ### [CVE-2022-25314](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25314) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-25315.md b/2022/CVE-2022-25315.md index b86021cf33..7ae479068a 100644 --- a/2022/CVE-2022-25315.md +++ b/2022/CVE-2022-25315.md @@ -1,5 +1,6 @@ ### [CVE-2022-25315](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25315) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-26373.md b/2022/CVE-2022-26373.md index 907907f075..4acc4dd433 100644 --- a/2022/CVE-2022-26373.md +++ b/2022/CVE-2022-26373.md @@ -1,5 +1,6 @@ ### [CVE-2022-26373](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26373) ![](https://img.shields.io/static/v1?label=Product&message=Intel(R)%20Processors&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=See%20references%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=information%20disclosure&color=brightgreen) diff --git a/2022/CVE-2022-26488.md b/2022/CVE-2022-26488.md index c0be8ea6ee..7eb4799e1a 100644 --- a/2022/CVE-2022-26488.md +++ b/2022/CVE-2022-26488.md @@ -1,5 +1,6 @@ ### [CVE-2022-26488](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26488) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-2663.md b/2022/CVE-2022-2663.md index 77f9f03761..e72112adad 100644 --- a/2022/CVE-2022-2663.md +++ b/2022/CVE-2022-2663.md @@ -1,5 +1,6 @@ ### [CVE-2022-2663](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2663) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=unknown%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-923&color=brightgreen) diff --git a/2022/CVE-2022-27774.md b/2022/CVE-2022-27774.md index 195f3983ca..0eb89d9550 100644 --- a/2022/CVE-2022-27774.md +++ b/2022/CVE-2022-27774.md @@ -1,5 +1,6 @@ ### [CVE-2022-27774](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27774) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=curl%204.9%20to%20and%20include%20curl%207.82.0%20are%20affected%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficiently%20Protected%20Credentials%20(CWE-522)&color=brightgreen) diff --git a/2022/CVE-2022-27775.md b/2022/CVE-2022-27775.md index 4dfd287b31..07d6221058 100644 --- a/2022/CVE-2022-27775.md +++ b/2022/CVE-2022-27775.md @@ -1,5 +1,6 @@ ### [CVE-2022-27775](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27775) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=curl%207.65.0%20to%207.82.0%20are%20vulnerable%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Disclosure%20(CWE-200)&color=brightgreen) diff --git a/2022/CVE-2022-27776.md b/2022/CVE-2022-27776.md index e5ef2c0ae7..802f623b60 100644 --- a/2022/CVE-2022-27776.md +++ b/2022/CVE-2022-27776.md @@ -1,5 +1,6 @@ ### [CVE-2022-27776](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27776) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fixed%20in%20curl%207.83.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficiently%20Protected%20Credentials%20(CWE-522)&color=brightgreen) diff --git a/2022/CVE-2022-27778.md b/2022/CVE-2022-27778.md index 1b386b3a9b..549a5e6616 100644 --- a/2022/CVE-2022-27778.md +++ b/2022/CVE-2022-27778.md @@ -1,5 +1,6 @@ ### [CVE-2022-27778](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27778) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fixed%20in%207.83.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20Incorrectly-Resolved%20Name%20or%20Reference%20(CWE-706)&color=brightgreen) diff --git a/2022/CVE-2022-27779.md b/2022/CVE-2022-27779.md index a3d9385ce7..4243056e90 100644 --- a/2022/CVE-2022-27779.md +++ b/2022/CVE-2022-27779.md @@ -1,6 +1,7 @@ ### [CVE-2022-27779](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27779) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.83.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Exposure%20Through%20Sent%20Data%20(CWE-201)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-27780.md b/2022/CVE-2022-27780.md index ca7514945f..739d81f20a 100644 --- a/2022/CVE-2022-27780.md +++ b/2022/CVE-2022-27780.md @@ -2,6 +2,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.83.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=h300s%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=h410s%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=h500s%20&color=brightgreen) diff --git a/2022/CVE-2022-27781.md b/2022/CVE-2022-27781.md index 7154d344a3..bef4822b8b 100644 --- a/2022/CVE-2022-27781.md +++ b/2022/CVE-2022-27781.md @@ -1,6 +1,7 @@ ### [CVE-2022-27781](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27781) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.83.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service%20(CWE-400)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-27782.md b/2022/CVE-2022-27782.md index e9b301cda9..da2e8ff801 100644 --- a/2022/CVE-2022-27782.md +++ b/2022/CVE-2022-27782.md @@ -1,6 +1,7 @@ ### [CVE-2022-27782](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27782) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.83.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Business%20Logic%20Errors%20(CWE-840)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-27943.md b/2022/CVE-2022-27943.md index 3a59c84433..87390f48b3 100644 --- a/2022/CVE-2022-27943.md +++ b/2022/CVE-2022-27943.md @@ -1,5 +1,6 @@ ### [CVE-2022-27943](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27943) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-28321.md b/2022/CVE-2022-28321.md index 324719c01e..e92c8638ae 100644 --- a/2022/CVE-2022-28321.md +++ b/2022/CVE-2022-28321.md @@ -1,5 +1,6 @@ ### [CVE-2022-28321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28321) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-29155.md b/2022/CVE-2022-29155.md index a5c241bfac..d222127fbd 100644 --- a/2022/CVE-2022-29155.md +++ b/2022/CVE-2022-29155.md @@ -1,5 +1,6 @@ ### [CVE-2022-29155](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29155) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-2959.md b/2022/CVE-2022-2959.md index 728c91b0df..d9a0396449 100644 --- a/2022/CVE-2022-2959.md +++ b/2022/CVE-2022-2959.md @@ -1,5 +1,6 @@ ### [CVE-2022-2959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2959) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20kernel%205.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-667&color=brightgreen) diff --git a/2022/CVE-2022-2978.md b/2022/CVE-2022-2978.md index 09ce9099d2..923677692d 100644 --- a/2022/CVE-2022-2978.md +++ b/2022/CVE-2022-2978.md @@ -1,5 +1,6 @@ ### [CVE-2022-2978](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2978) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Linux%20kernel%206.0-rc3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2022/CVE-2022-29824.md b/2022/CVE-2022-29824.md index f7bbdcc523..ad4fdc8bb7 100644 --- a/2022/CVE-2022-29824.md +++ b/2022/CVE-2022-29824.md @@ -1,5 +1,6 @@ ### [CVE-2022-29824](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29824) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-30115.md b/2022/CVE-2022-30115.md index f2670f5766..adac3c8015 100644 --- a/2022/CVE-2022-30115.md +++ b/2022/CVE-2022-30115.md @@ -1,6 +1,7 @@ ### [CVE-2022-30115](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30115) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.83.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Required%20Cryptographic%20Step%20(CWE-325)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-3028.md b/2022/CVE-2022-3028.md index 37fa2a2d01..6d992d709f 100644 --- a/2022/CVE-2022-3028.md +++ b/2022/CVE-2022-3028.md @@ -1,5 +1,6 @@ ### [CVE-2022-3028](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3028) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20kernel%206.0-rc3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-667%2C%20CWE-362%2C%20CWE-125%2C%20CWE-787&color=brightgreen) diff --git a/2022/CVE-2022-3104.md b/2022/CVE-2022-3104.md index 6374149b15..ea7ecab06f 100644 --- a/2022/CVE-2022-3104.md +++ b/2022/CVE-2022-3104.md @@ -1,5 +1,6 @@ ### [CVE-2022-3104](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3104) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Linux%205.16-rc6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476&color=brightgreen) diff --git a/2022/CVE-2022-3115.md b/2022/CVE-2022-3115.md index e9bf614f45..a553c935ca 100644 --- a/2022/CVE-2022-3115.md +++ b/2022/CVE-2022-3115.md @@ -1,5 +1,6 @@ ### [CVE-2022-3115](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3115) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Linux%205.16-rc6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476&color=brightgreen) diff --git a/2022/CVE-2022-3169.md b/2022/CVE-2022-3169.md index 8ace89bc56..b9bf2c26ca 100644 --- a/2022/CVE-2022-3169.md +++ b/2022/CVE-2022-3169.md @@ -1,5 +1,6 @@ ### [CVE-2022-3169](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3169) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20&color=brightgreen) diff --git a/2022/CVE-2022-32205.md b/2022/CVE-2022-32205.md index 533d16c914..775b1f3ceb 100644 --- a/2022/CVE-2022-32205.md +++ b/2022/CVE-2022-32205.md @@ -1,6 +1,8 @@ ### [CVE-2022-32205](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32205) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.84.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling%20(CWE-770)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-32206.md b/2022/CVE-2022-32206.md index 0cf7b29181..0abf1823d0 100644 --- a/2022/CVE-2022-32206.md +++ b/2022/CVE-2022-32206.md @@ -1,6 +1,8 @@ ### [CVE-2022-32206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32206) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.84.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling%20(CWE-770)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-32207.md b/2022/CVE-2022-32207.md index b7efc22691..819ab3fd67 100644 --- a/2022/CVE-2022-32207.md +++ b/2022/CVE-2022-32207.md @@ -1,6 +1,8 @@ ### [CVE-2022-32207](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32207) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.84.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Business%20Logic%20Errors%20(CWE-840)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-32208.md b/2022/CVE-2022-32208.md index 4b2b65d81b..4f53ff540c 100644 --- a/2022/CVE-2022-32208.md +++ b/2022/CVE-2022-32208.md @@ -1,6 +1,8 @@ ### [CVE-2022-32208](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32208) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.84.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Business%20Logic%20Errors%20(CWE-840)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-32221.md b/2022/CVE-2022-32221.md index 3c659b6dcb..840bd9bb41 100644 --- a/2022/CVE-2022-32221.md +++ b/2022/CVE-2022-32221.md @@ -1,6 +1,7 @@ ### [CVE-2022-32221](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32221) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.86.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Disclosure%20(CWE-200)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-32250.md b/2022/CVE-2022-32250.md index 73e9f461c5..305e052565 100644 --- a/2022/CVE-2022-32250.md +++ b/2022/CVE-2022-32250.md @@ -1,5 +1,6 @@ ### [CVE-2022-32250](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32250) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-32296.md b/2022/CVE-2022-32296.md index b3f81a90de..79e3a80b5d 100644 --- a/2022/CVE-2022-32296.md +++ b/2022/CVE-2022-32296.md @@ -1,5 +1,6 @@ ### [CVE-2022-32296](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32296) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-3303.md b/2022/CVE-2022-3303.md index fccec8e171..9109b44c23 100644 --- a/2022/CVE-2022-3303.md +++ b/2022/CVE-2022-3303.md @@ -1,5 +1,6 @@ ### [CVE-2022-3303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3303) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20kernel%206.0-rc5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-667-%3ECWE-362-%3ECWE-476&color=brightgreen) diff --git a/2022/CVE-2022-34918.md b/2022/CVE-2022-34918.md index 9bfc31958f..eb7241d877 100644 --- a/2022/CVE-2022-34918.md +++ b/2022/CVE-2022-34918.md @@ -1,5 +1,6 @@ ### [CVE-2022-34918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34918) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-3521.md b/2022/CVE-2022-3521.md index 305c5d7480..5eec98e15c 100644 --- a/2022/CVE-2022-3521.md +++ b/2022/CVE-2022-3521.md @@ -1,5 +1,6 @@ ### [CVE-2022-3521](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3521) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-362%20Race%20Condition&color=brightgreen) diff --git a/2022/CVE-2022-3524.md b/2022/CVE-2022-3524.md index 2af187d376..e811eb6b62 100644 --- a/2022/CVE-2022-3524.md +++ b/2022/CVE-2022-3524.md @@ -1,5 +1,6 @@ ### [CVE-2022-3524](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3524) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-404%20Denial%20of%20Service%20-%3E%20CWE-401%20Memory%20Leak&color=brightgreen) diff --git a/2022/CVE-2022-35252.md b/2022/CVE-2022-35252.md index 274502f76c..b99b358881 100644 --- a/2022/CVE-2022-35252.md +++ b/2022/CVE-2022-35252.md @@ -1,6 +1,8 @@ ### [CVE-2022-35252](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35252) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20curl%207.85.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Input%20Validation%20(CWE-20)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-35260.md b/2022/CVE-2022-35260.md index 965670c756..c1773a10a6 100644 --- a/2022/CVE-2022-35260.md +++ b/2022/CVE-2022-35260.md @@ -1,6 +1,7 @@ ### [CVE-2022-35260](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35260) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.86.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read%20(CWE-125)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-3534.md b/2022/CVE-2022-3534.md index 08bd5f9ae8..82c92fe954 100644 --- a/2022/CVE-2022-3534.md +++ b/2022/CVE-2022-3534.md @@ -1,6 +1,7 @@ ### [CVE-2022-3534](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3534) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.10.162%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.15.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.15.1%20&color=brightgreen) diff --git a/2022/CVE-2022-3545.md b/2022/CVE-2022-3545.md index 8e91e54baf..69f8334449 100644 --- a/2022/CVE-2022-3545.md +++ b/2022/CVE-2022-3545.md @@ -1,5 +1,6 @@ ### [CVE-2022-3545](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3545) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-119%20Memory%20Corruption%20-%3E%20CWE-416%20Use%20After%20Free&color=brightgreen) diff --git a/2022/CVE-2022-3564.md b/2022/CVE-2022-3564.md index 7f8b065d77..54fec3d84f 100644 --- a/2022/CVE-2022-3564.md +++ b/2022/CVE-2022-3564.md @@ -1,5 +1,6 @@ ### [CVE-2022-3564](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3564) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-119%20Memory%20Corruption%20-%3E%20CWE-416%20Use%20After%20Free&color=brightgreen) diff --git a/2022/CVE-2022-3565.md b/2022/CVE-2022-3565.md index 531db18317..7cfae7ff0b 100644 --- a/2022/CVE-2022-3565.md +++ b/2022/CVE-2022-3565.md @@ -1,5 +1,6 @@ ### [CVE-2022-3565](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3565) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-119%20Memory%20Corruption%20-%3E%20CWE-416%20Use%20After%20Free&color=brightgreen) diff --git a/2022/CVE-2022-35737.md b/2022/CVE-2022-35737.md index 7e6a7b6e3f..1062917118 100644 --- a/2022/CVE-2022-35737.md +++ b/2022/CVE-2022-35737.md @@ -1,5 +1,6 @@ ### [CVE-2022-35737](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35737) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-3586.md b/2022/CVE-2022-3586.md index 404b53d033..78c3138d43 100644 --- a/2022/CVE-2022-3586.md +++ b/2022/CVE-2022-3586.md @@ -1,5 +1,6 @@ ### [CVE-2022-3586](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3586) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20kernel%20v6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2022/CVE-2022-3606.md b/2022/CVE-2022-3606.md index 4b37e60bd8..08d36077b8 100644 --- a/2022/CVE-2022-3606.md +++ b/2022/CVE-2022-3606.md @@ -1,5 +1,6 @@ ### [CVE-2022-3606](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3606) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-404%20Denial%20of%20Service%20-%3E%20CWE-476%20NULL%20Pointer%20Dereference&color=brightgreen) diff --git a/2022/CVE-2022-36123.md b/2022/CVE-2022-36123.md index f8e248ca8b..7a8ab18697 100644 --- a/2022/CVE-2022-36123.md +++ b/2022/CVE-2022-36123.md @@ -1,5 +1,6 @@ ### [CVE-2022-36123](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36123) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-3628.md b/2022/CVE-2022-3628.md index 5cd3acf3aa..b5d3a1f5cd 100644 --- a/2022/CVE-2022-3628.md +++ b/2022/CVE-2022-3628.md @@ -1,5 +1,6 @@ ### [CVE-2022-3628](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3628) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Linux%20kernel%206.1-rc5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-119&color=brightgreen) diff --git a/2022/CVE-2022-36280.md b/2022/CVE-2022-36280.md index dc754eec1b..8a6a258c62 100644 --- a/2022/CVE-2022-36280.md +++ b/2022/CVE-2022-36280.md @@ -1,5 +1,6 @@ ### [CVE-2022-36280](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36280) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=v3.2-rc1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-120%20Buffer%20Overflow&color=brightgreen) diff --git a/2022/CVE-2022-3649.md b/2022/CVE-2022-3649.md index 7e948f5c11..10ae600b9d 100644 --- a/2022/CVE-2022-3649.md +++ b/2022/CVE-2022-3649.md @@ -1,5 +1,6 @@ ### [CVE-2022-3649](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3649) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-119%20Memory%20Corruption%20-%3E%20CWE-416%20Use%20After%20Free&color=brightgreen) diff --git a/2022/CVE-2022-36879.md b/2022/CVE-2022-36879.md index 3148329a94..abb092c396 100644 --- a/2022/CVE-2022-36879.md +++ b/2022/CVE-2022-36879.md @@ -1,5 +1,6 @@ ### [CVE-2022-36879](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36879) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-36946.md b/2022/CVE-2022-36946.md index 1e373460d2..c91f1b3956 100644 --- a/2022/CVE-2022-36946.md +++ b/2022/CVE-2022-36946.md @@ -1,5 +1,6 @@ ### [CVE-2022-36946](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36946) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-3715.md b/2022/CVE-2022-3715.md index 5d8265ed5d..0ae193ebce 100644 --- a/2022/CVE-2022-3715.md +++ b/2022/CVE-2022-3715.md @@ -1,5 +1,6 @@ ### [CVE-2022-3715](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3715) ![](https://img.shields.io/static/v1?label=Product&message=bash&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bash%205.1.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-119&color=brightgreen) diff --git a/2022/CVE-2022-37454.md b/2022/CVE-2022-37454.md index c97cb0bb81..ab7de1002a 100644 --- a/2022/CVE-2022-37454.md +++ b/2022/CVE-2022-37454.md @@ -1,6 +1,8 @@ ### [CVE-2022-37454](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37454) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) ### Description diff --git a/2022/CVE-2022-3821.md b/2022/CVE-2022-3821.md index 96ffdeb2c3..5eeeed837d 100644 --- a/2022/CVE-2022-3821.md +++ b/2022/CVE-2022-3821.md @@ -1,6 +1,7 @@ ### [CVE-2022-3821](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3821) ![](https://img.shields.io/static/v1?label=Product&message=systemd&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20systemd%20v252-rc1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-193%20-%20Off-by-one%20Error&color=brightgreen) ### Description diff --git a/2022/CVE-2022-39188.md b/2022/CVE-2022-39188.md index db007bbbe8..c64e4157fc 100644 --- a/2022/CVE-2022-39188.md +++ b/2022/CVE-2022-39188.md @@ -1,5 +1,6 @@ ### [CVE-2022-39188](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39188) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-39190.md b/2022/CVE-2022-39190.md index d257febdf6..ae74869e66 100644 --- a/2022/CVE-2022-39190.md +++ b/2022/CVE-2022-39190.md @@ -1,5 +1,6 @@ ### [CVE-2022-39190](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39190) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-40303.md b/2022/CVE-2022-40303.md index 54b0a4756f..7dec1cf66b 100644 --- a/2022/CVE-2022-40303.md +++ b/2022/CVE-2022-40303.md @@ -1,5 +1,6 @@ ### [CVE-2022-40303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40303) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-40304.md b/2022/CVE-2022-40304.md index a95f6ca5b5..5dcabfa6e1 100644 --- a/2022/CVE-2022-40304.md +++ b/2022/CVE-2022-40304.md @@ -1,5 +1,6 @@ ### [CVE-2022-40304](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-40307.md b/2022/CVE-2022-40307.md index 2944b9f0c5..4e549f62e0 100644 --- a/2022/CVE-2022-40307.md +++ b/2022/CVE-2022-40307.md @@ -1,5 +1,6 @@ ### [CVE-2022-40307](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40307) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-40674.md b/2022/CVE-2022-40674.md index 35294c0046..5c230e0c74 100644 --- a/2022/CVE-2022-40674.md +++ b/2022/CVE-2022-40674.md @@ -1,5 +1,6 @@ ### [CVE-2022-40674](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40674) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-4095.md b/2022/CVE-2022-4095.md index f0631d7a0c..5dc5db05b0 100644 --- a/2022/CVE-2022-4095.md +++ b/2022/CVE-2022-4095.md @@ -1,5 +1,6 @@ ### [CVE-2022-4095](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4095) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Linux%20Kernel%20prior%20to%20kernel%206.0%20rc4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2022/CVE-2022-41218.md b/2022/CVE-2022-41218.md index 546ccb29cf..140e379526 100644 --- a/2022/CVE-2022-41218.md +++ b/2022/CVE-2022-41218.md @@ -1,5 +1,6 @@ ### [CVE-2022-41218](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41218) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-41222.md b/2022/CVE-2022-41222.md index aca84eddbe..87ef09f09a 100644 --- a/2022/CVE-2022-41222.md +++ b/2022/CVE-2022-41222.md @@ -1,5 +1,6 @@ ### [CVE-2022-41222](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41222) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-4129.md b/2022/CVE-2022-4129.md index 7fb5008477..333eeb2f38 100644 --- a/2022/CVE-2022-4129.md +++ b/2022/CVE-2022-4129.md @@ -1,5 +1,6 @@ ### [CVE-2022-4129](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4129) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20kernel%20(l2tp)&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=up%20to%20v6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-667-%3ECWE-362-%3ECWE-476&color=brightgreen) diff --git a/2022/CVE-2022-4139.md b/2022/CVE-2022-4139.md index 9783335898..6a58a9147e 100644 --- a/2022/CVE-2022-4139.md +++ b/2022/CVE-2022-4139.md @@ -1,5 +1,6 @@ ### [CVE-2022-4139](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4139) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=kernel%206.1-rc7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-281&color=brightgreen) diff --git a/2022/CVE-2022-41674.md b/2022/CVE-2022-41674.md index c4931eff80..0e0fdb6275 100644 --- a/2022/CVE-2022-41674.md +++ b/2022/CVE-2022-41674.md @@ -1,5 +1,6 @@ ### [CVE-2022-41674](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41674) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-41849.md b/2022/CVE-2022-41849.md index c137cb9140..e8af29f413 100644 --- a/2022/CVE-2022-41849.md +++ b/2022/CVE-2022-41849.md @@ -1,5 +1,6 @@ ### [CVE-2022-41849](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41849) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-41850.md b/2022/CVE-2022-41850.md index 9263ebf99b..3e1f8ddbe8 100644 --- a/2022/CVE-2022-41850.md +++ b/2022/CVE-2022-41850.md @@ -1,5 +1,6 @@ ### [CVE-2022-41850](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41850) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-4269.md b/2022/CVE-2022-4269.md index d24b393272..c90e9d953a 100644 --- a/2022/CVE-2022-4269.md +++ b/2022/CVE-2022-4269.md @@ -1,5 +1,6 @@ ### [CVE-2022-4269](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4269) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20kernel%20(TC%20subsystem)&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Since%20upstream%20commit%2053592b3%20(v4.10-rc1)%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-833&color=brightgreen) diff --git a/2022/CVE-2022-42703.md b/2022/CVE-2022-42703.md index 30f2e559ec..93f26d5a4e 100644 --- a/2022/CVE-2022-42703.md +++ b/2022/CVE-2022-42703.md @@ -1,5 +1,6 @@ ### [CVE-2022-42703](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42703) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-42719.md b/2022/CVE-2022-42719.md index 3f1d95bc4c..8786966dd9 100644 --- a/2022/CVE-2022-42719.md +++ b/2022/CVE-2022-42719.md @@ -1,5 +1,6 @@ ### [CVE-2022-42719](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42719) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-42720.md b/2022/CVE-2022-42720.md index 360979758a..f5dec72bf7 100644 --- a/2022/CVE-2022-42720.md +++ b/2022/CVE-2022-42720.md @@ -1,5 +1,6 @@ ### [CVE-2022-42720](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42720) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-42721.md b/2022/CVE-2022-42721.md index 6b2d7ebf74..1a119ac569 100644 --- a/2022/CVE-2022-42721.md +++ b/2022/CVE-2022-42721.md @@ -1,5 +1,6 @@ ### [CVE-2022-42721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42721) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-42722.md b/2022/CVE-2022-42722.md index 8f16bce908..9e78223bac 100644 --- a/2022/CVE-2022-42722.md +++ b/2022/CVE-2022-42722.md @@ -1,5 +1,6 @@ ### [CVE-2022-42722](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42722) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-42895.md b/2022/CVE-2022-42895.md index 731fb87f0b..a7a36eb893 100644 --- a/2022/CVE-2022-42895.md +++ b/2022/CVE-2022-42895.md @@ -1,5 +1,6 @@ ### [CVE-2022-42895](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42895) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-824%20Access%20of%20Uninitialized%20Pointer&color=brightgreen) diff --git a/2022/CVE-2022-42896.md b/2022/CVE-2022-42896.md index 4f4340447f..a72de59176 100644 --- a/2022/CVE-2022-42896.md +++ b/2022/CVE-2022-42896.md @@ -1,5 +1,6 @@ ### [CVE-2022-42896](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42896) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%20Use%20After%20Free&color=brightgreen) diff --git a/2022/CVE-2022-42898.md b/2022/CVE-2022-42898.md index ca75977612..104abb0df0 100644 --- a/2022/CVE-2022-42898.md +++ b/2022/CVE-2022-42898.md @@ -1,5 +1,6 @@ ### [CVE-2022-42898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42898) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-42915.md b/2022/CVE-2022-42915.md index 1282d445fe..a62d7ff549 100644 --- a/2022/CVE-2022-42915.md +++ b/2022/CVE-2022-42915.md @@ -1,5 +1,6 @@ ### [CVE-2022-42915](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42915) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-42916.md b/2022/CVE-2022-42916.md index f6b258452b..08a97e474b 100644 --- a/2022/CVE-2022-42916.md +++ b/2022/CVE-2022-42916.md @@ -1,5 +1,6 @@ ### [CVE-2022-42916](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42916) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-4304.md b/2022/CVE-2022-4304.md index 42b8180915..b84221ca4d 100644 --- a/2022/CVE-2022-4304.md +++ b/2022/CVE-2022-4304.md @@ -1,8 +1,10 @@ ### [CVE-2022-4304](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4304) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.0.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=timing%20based%20side%20channel%20attack&color=brightgreen) ### Description diff --git a/2022/CVE-2022-43551.md b/2022/CVE-2022-43551.md index 2c0c5db1d1..5deca0224b 100644 --- a/2022/CVE-2022-43551.md +++ b/2022/CVE-2022-43551.md @@ -1,6 +1,7 @@ ### [CVE-2022-43551](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43551) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20curl%207.87.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Cleartext%20Transmission%20of%20Sensitive%20Information%20(CWE-319)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-43552.md b/2022/CVE-2022-43552.md index 3285fea0ea..dc0abacfc4 100644 --- a/2022/CVE-2022-43552.md +++ b/2022/CVE-2022-43552.md @@ -1,6 +1,7 @@ ### [CVE-2022-43552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43552) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%20curl%207.87.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20After%20Free%20(CWE-416)&color=brightgreen) ### Description diff --git a/2022/CVE-2022-43680.md b/2022/CVE-2022-43680.md index ef8c536a9c..55656ddf71 100644 --- a/2022/CVE-2022-43680.md +++ b/2022/CVE-2022-43680.md @@ -1,5 +1,6 @@ ### [CVE-2022-43680](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43680) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-43750.md b/2022/CVE-2022-43750.md index 7065649abe..739469d9ee 100644 --- a/2022/CVE-2022-43750.md +++ b/2022/CVE-2022-43750.md @@ -1,5 +1,6 @@ ### [CVE-2022-43750](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43750) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-4450.md b/2022/CVE-2022-4450.md index 65a4c0f0c8..c77777a410 100644 --- a/2022/CVE-2022-4450.md +++ b/2022/CVE-2022-4450.md @@ -1,7 +1,9 @@ ### [CVE-2022-4450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4450) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=double-free&color=brightgreen) ### Description diff --git a/2022/CVE-2022-45061.md b/2022/CVE-2022-45061.md index 11dc367759..8fee764c7a 100644 --- a/2022/CVE-2022-45061.md +++ b/2022/CVE-2022-45061.md @@ -1,5 +1,6 @@ ### [CVE-2022-45061](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45061) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-46908.md b/2022/CVE-2022-46908.md index 8f0431460b..6978a36685 100644 --- a/2022/CVE-2022-46908.md +++ b/2022/CVE-2022-46908.md @@ -1,5 +1,6 @@ ### [CVE-2022-46908](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46908) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-47929.md b/2022/CVE-2022-47929.md index 05991a277f..85b974a5a4 100644 --- a/2022/CVE-2022-47929.md +++ b/2022/CVE-2022-47929.md @@ -1,5 +1,6 @@ ### [CVE-2022-47929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-47929) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-48303.md b/2022/CVE-2022-48303.md index 39b1b77c71..21f8585b95 100644 --- a/2022/CVE-2022-48303.md +++ b/2022/CVE-2022-48303.md @@ -1,5 +1,6 @@ ### [CVE-2022-48303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48303) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-48522.md b/2022/CVE-2022-48522.md index 3a270a7d4a..a3cd5ffeaf 100644 --- a/2022/CVE-2022-48522.md +++ b/2022/CVE-2022-48522.md @@ -1,5 +1,6 @@ ### [CVE-2022-48522](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48522) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2022/CVE-2022-48560.md b/2022/CVE-2022-48560.md index c29345fb08..2b13cf6211 100644 --- a/2022/CVE-2022-48560.md +++ b/2022/CVE-2022-48560.md @@ -1,5 +1,6 @@ ### [CVE-2022-48560](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48560) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-0215.md b/2023/CVE-2023-0215.md index 3b9ac0d691..b7d962132c 100644 --- a/2023/CVE-2023-0215.md +++ b/2023/CVE-2023-0215.md @@ -1,8 +1,10 @@ ### [CVE-2023-0215](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0215) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.0.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=use-after-free&color=brightgreen) ### Description diff --git a/2023/CVE-2023-0286.md b/2023/CVE-2023-0286.md index 8db2638457..2f8a019ace 100644 --- a/2023/CVE-2023-0286.md +++ b/2023/CVE-2023-0286.md @@ -1,8 +1,10 @@ ### [CVE-2023-0286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0286) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.0.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=type%20confusion%20vulnerability&color=brightgreen) ### Description diff --git a/2023/CVE-2023-0361.md b/2023/CVE-2023-0361.md index 6a2bc622a9..74e749314e 100644 --- a/2023/CVE-2023-0361.md +++ b/2023/CVE-2023-0361.md @@ -1,5 +1,6 @@ ### [CVE-2023-0361](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0361) ![](https://img.shields.io/static/v1?label=Product&message=gnutls&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=gnutls-3.7.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=side-channel&color=brightgreen) diff --git a/2023/CVE-2023-0464.md b/2023/CVE-2023-0464.md index 850bbd17da..5adcc1c780 100644 --- a/2023/CVE-2023-0464.md +++ b/2023/CVE-2023-0464.md @@ -1,9 +1,11 @@ ### [CVE-2023-0464](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0464) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.0.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=inefficient%20algorithmic%20complexity&color=brightgreen) ### Description diff --git a/2023/CVE-2023-0465.md b/2023/CVE-2023-0465.md index a004280ac9..36f03c85aa 100644 --- a/2023/CVE-2023-0465.md +++ b/2023/CVE-2023-0465.md @@ -1,9 +1,11 @@ ### [CVE-2023-0465](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0465) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.0.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=improper%20certificate%20validation&color=brightgreen) ### Description diff --git a/2023/CVE-2023-0466.md b/2023/CVE-2023-0466.md index b6af4e4f46..4b404b7cb1 100644 --- a/2023/CVE-2023-0466.md +++ b/2023/CVE-2023-0466.md @@ -1,9 +1,11 @@ ### [CVE-2023-0466](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0466) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.0.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=improper%20certificate%20validation&color=brightgreen) ### Description diff --git a/2023/CVE-2023-0590.md b/2023/CVE-2023-0590.md index def6cc2745..64541906bc 100644 --- a/2023/CVE-2023-0590.md +++ b/2023/CVE-2023-0590.md @@ -1,5 +1,6 @@ ### [CVE-2023-0590](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0590) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Linux%20kernel%206.1-rc2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2023/CVE-2023-1077.md b/2023/CVE-2023-1077.md index eefecb801a..d808ae55b7 100644 --- a/2023/CVE-2023-1077.md +++ b/2023/CVE-2023-1077.md @@ -1,5 +1,7 @@ ### [CVE-2023-1077](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1077) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=unknown%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-843&color=brightgreen) diff --git a/2023/CVE-2023-23454.md b/2023/CVE-2023-23454.md index 19e48e907f..58480f0c7d 100644 --- a/2023/CVE-2023-23454.md +++ b/2023/CVE-2023-23454.md @@ -1,5 +1,6 @@ ### [CVE-2023-23454](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23454) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-23455.md b/2023/CVE-2023-23455.md index 31f0674fc3..a225037d54 100644 --- a/2023/CVE-2023-23455.md +++ b/2023/CVE-2023-23455.md @@ -1,5 +1,6 @@ ### [CVE-2023-23455](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23455) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-23559.md b/2023/CVE-2023-23559.md index 6bfef3120c..3000b9fcde 100644 --- a/2023/CVE-2023-23559.md +++ b/2023/CVE-2023-23559.md @@ -1,5 +1,6 @@ ### [CVE-2023-23559](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23559) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-23914.md b/2023/CVE-2023-23914.md index 1b6eb960fa..3e2c8a5c2a 100644 --- a/2023/CVE-2023-23914.md +++ b/2023/CVE-2023-23914.md @@ -1,6 +1,7 @@ ### [CVE-2023-23914](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23914) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.88.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Cleartext%20Transmission%20of%20Sensitive%20Information%20(CWE-319)&color=brightgreen) ### Description diff --git a/2023/CVE-2023-23915.md b/2023/CVE-2023-23915.md index 01181eefab..4d5685088a 100644 --- a/2023/CVE-2023-23915.md +++ b/2023/CVE-2023-23915.md @@ -1,6 +1,7 @@ ### [CVE-2023-23915](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23915) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.88.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Cleartext%20Transmission%20of%20Sensitive%20Information%20(CWE-319)&color=brightgreen) ### Description diff --git a/2023/CVE-2023-23916.md b/2023/CVE-2023-23916.md index 93d0cf7253..55583e56c1 100644 --- a/2023/CVE-2023-23916.md +++ b/2023/CVE-2023-23916.md @@ -1,6 +1,7 @@ ### [CVE-2023-23916](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23916) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%207.88.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling%20(CWE-770)&color=brightgreen) ### Description diff --git a/2023/CVE-2023-24329.md b/2023/CVE-2023-24329.md index 51deebd373..15712c659b 100644 --- a/2023/CVE-2023-24329.md +++ b/2023/CVE-2023-24329.md @@ -1,5 +1,6 @@ ### [CVE-2023-24329](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24329) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-25136.md b/2023/CVE-2023-25136.md index a7db0a2373..8ae5736232 100644 --- a/2023/CVE-2023-25136.md +++ b/2023/CVE-2023-25136.md @@ -1,5 +1,6 @@ ### [CVE-2023-25136](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25136) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-25139.md b/2023/CVE-2023-25139.md index 129d34134b..44aee67046 100644 --- a/2023/CVE-2023-25139.md +++ b/2023/CVE-2023-25139.md @@ -1,5 +1,6 @@ ### [CVE-2023-25139](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25139) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-2650.md b/2023/CVE-2023-2650.md index 105dffb312..d5925a0b68 100644 --- a/2023/CVE-2023-2650.md +++ b/2023/CVE-2023-2650.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=inefficient%20algorithmic%20complexity&color=brightgreen) ### Description diff --git a/2023/CVE-2023-26604.md b/2023/CVE-2023-26604.md index b8362d36e0..82ece6cdef 100644 --- a/2023/CVE-2023-26604.md +++ b/2023/CVE-2023-26604.md @@ -1,5 +1,6 @@ ### [CVE-2023-26604](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26604) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-26607.md b/2023/CVE-2023-26607.md index 1ade6d3a4c..85dce54bbd 100644 --- a/2023/CVE-2023-26607.md +++ b/2023/CVE-2023-26607.md @@ -1,5 +1,6 @@ ### [CVE-2023-26607](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26607) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-27533.md b/2023/CVE-2023-27533.md index fbd988f141..e6ed78bf81 100644 --- a/2023/CVE-2023-27533.md +++ b/2023/CVE-2023-27533.md @@ -1,6 +1,7 @@ ### [CVE-2023-27533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27533) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%208.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Failure%20to%20Sanitize%20Special%20Elements%20into%20a%20Different%20Plane%20(Special%20Element%20Injection)%20(CWE-75)&color=brightgreen) ### Description diff --git a/2023/CVE-2023-27534.md b/2023/CVE-2023-27534.md index 17276d0d53..322516652b 100644 --- a/2023/CVE-2023-27534.md +++ b/2023/CVE-2023-27534.md @@ -1,6 +1,7 @@ ### [CVE-2023-27534](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27534) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%208.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal%20(CWE-22)&color=brightgreen) ### Description diff --git a/2023/CVE-2023-27535.md b/2023/CVE-2023-27535.md index 2be6730dba..ce7029078a 100644 --- a/2023/CVE-2023-27535.md +++ b/2023/CVE-2023-27535.md @@ -1,6 +1,7 @@ ### [CVE-2023-27535](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27535) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%208.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Authentication%20Bypass%20by%20Primary%20Weakness%20(CWE-305)&color=brightgreen) ### Description diff --git a/2023/CVE-2023-27536.md b/2023/CVE-2023-27536.md index 3514428923..e4a53b78e4 100644 --- a/2023/CVE-2023-27536.md +++ b/2023/CVE-2023-27536.md @@ -1,6 +1,7 @@ ### [CVE-2023-27536](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27536) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%208.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Authentication%20Bypass%20by%20Primary%20Weakness%20(CWE-305)&color=brightgreen) ### Description diff --git a/2023/CVE-2023-27537.md b/2023/CVE-2023-27537.md index 594878d95d..e351e0f547 100644 --- a/2023/CVE-2023-27537.md +++ b/2023/CVE-2023-27537.md @@ -1,6 +1,7 @@ ### [CVE-2023-27537](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27537) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%208.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Double%20Free%20(CWE-415)&color=brightgreen) ### Description diff --git a/2023/CVE-2023-27538.md b/2023/CVE-2023-27538.md index 1f50df7bbd..a440ef2b8f 100644 --- a/2023/CVE-2023-27538.md +++ b/2023/CVE-2023-27538.md @@ -1,6 +1,7 @@ ### [CVE-2023-27538](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27538) ![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%208.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Authentication%20Bypass%20by%20Primary%20Weakness%20(CWE-305)&color=brightgreen) ### Description diff --git a/2023/CVE-2023-28531.md b/2023/CVE-2023-28531.md index 0173a745a7..7b8cecb88e 100644 --- a/2023/CVE-2023-28531.md +++ b/2023/CVE-2023-28531.md @@ -2,6 +2,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -14,6 +15,7 @@ ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the inten #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/Certifiedhustler-Swaba/VulnerableGPT diff --git a/2023/CVE-2023-29383.md b/2023/CVE-2023-29383.md index c19568b02d..2c11988287 100644 --- a/2023/CVE-2023-29383.md +++ b/2023/CVE-2023-29383.md @@ -1,5 +1,7 @@ ### [CVE-2023-29383](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29383) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-29469.md b/2023/CVE-2023-29469.md index b30bc088ea..a5539241ec 100644 --- a/2023/CVE-2023-29469.md +++ b/2023/CVE-2023-29469.md @@ -1,5 +1,6 @@ ### [CVE-2023-29469](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-29491.md b/2023/CVE-2023-29491.md index 26d9107ffb..bffe80bc35 100644 --- a/2023/CVE-2023-29491.md +++ b/2023/CVE-2023-29491.md @@ -1,5 +1,7 @@ ### [CVE-2023-29491](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29491) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-29499.md b/2023/CVE-2023-29499.md index 4988c59478..4b0d5702e2 100644 --- a/2023/CVE-2023-29499.md +++ b/2023/CVE-2023-29499.md @@ -7,7 +7,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=glib2&color=blue) -![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Uncontrolled%20Resource%20Consumption&color=brightgreen) ### Description diff --git a/2023/CVE-2023-2953.md b/2023/CVE-2023-2953.md index 20d09f821f..c8be2317d8 100644 --- a/2023/CVE-2023-2953.md +++ b/2023/CVE-2023-2953.md @@ -1,5 +1,6 @@ ### [CVE-2023-2953](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2953) ![](https://img.shields.io/static/v1?label=Product&message=openldap&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=openldap-2.4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476&color=brightgreen) diff --git a/2023/CVE-2023-3141.md b/2023/CVE-2023-3141.md index ad7b67275b..62c9dfc84c 100644 --- a/2023/CVE-2023-3141.md +++ b/2023/CVE-2023-3141.md @@ -1,5 +1,6 @@ ### [CVE-2023-3141](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3141) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=Kenrel%20version%20prior%20to%20Kernel%206.4-rc1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416&color=brightgreen) diff --git a/2023/CVE-2023-31436.md b/2023/CVE-2023-31436.md index c3456bf3b0..6cc1a361b4 100644 --- a/2023/CVE-2023-31436.md +++ b/2023/CVE-2023-31436.md @@ -1,5 +1,6 @@ ### [CVE-2023-31436](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31436) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-32233.md b/2023/CVE-2023-32233.md index be335bf5db..e8940e50b9 100644 --- a/2023/CVE-2023-32233.md +++ b/2023/CVE-2023-32233.md @@ -1,5 +1,6 @@ ### [CVE-2023-32233](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32233) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-32611.md b/2023/CVE-2023-32611.md index 6063047b24..73e4120fb2 100644 --- a/2023/CVE-2023-32611.md +++ b/2023/CVE-2023-32611.md @@ -7,7 +7,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=glib2&color=blue) -![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Uncontrolled%20Resource%20Consumption&color=brightgreen) ### Description diff --git a/2023/CVE-2023-32636.md b/2023/CVE-2023-32636.md index 910f8eabf9..4698d9c746 100644 --- a/2023/CVE-2023-32636.md +++ b/2023/CVE-2023-32636.md @@ -1,6 +1,7 @@ ### [CVE-2023-32636](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32636) ![](https://img.shields.io/static/v1?label=Product&message=glib&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=2.75.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400&color=brightgreen) ### Description diff --git a/2023/CVE-2023-32643.md b/2023/CVE-2023-32643.md index 9ccc351202..7dddb35cd7 100644 --- a/2023/CVE-2023-32643.md +++ b/2023/CVE-2023-32643.md @@ -1,6 +1,7 @@ ### [CVE-2023-32643](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32643) ![](https://img.shields.io/static/v1?label=Product&message=glib&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-122&color=brightgreen) ### Description diff --git a/2023/CVE-2023-32665.md b/2023/CVE-2023-32665.md index 2dc9e72236..cdee626a20 100644 --- a/2023/CVE-2023-32665.md +++ b/2023/CVE-2023-32665.md @@ -8,7 +8,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=glib2&color=blue) -![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Uncontrolled%20Resource%20Consumption&color=brightgreen) ### Description diff --git a/2023/CVE-2023-3268.md b/2023/CVE-2023-3268.md index ef0ed8575f..2961401336 100644 --- a/2023/CVE-2023-3268.md +++ b/2023/CVE-2023-3268.md @@ -1,5 +1,6 @@ ### [CVE-2023-3268](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3268) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.22%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.20%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.11%20&color=brightgreen) diff --git a/2023/CVE-2023-3338.md b/2023/CVE-2023-3338.md index f0a35bbbee..fb74044885 100644 --- a/2023/CVE-2023-3338.md +++ b/2023/CVE-2023-3338.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=kernel&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=NULL%20Pointer%20Dereference&color=brightgreen) ### Description diff --git a/2023/CVE-2023-3389.md b/2023/CVE-2023-3389.md index 4972a0a4cc..132863ac5b 100644 --- a/2023/CVE-2023-3389.md +++ b/2023/CVE-2023-3389.md @@ -1,5 +1,6 @@ ### [CVE-2023-3389](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3389) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.10.162%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%20Use%20After%20Free&color=brightgreen) diff --git a/2023/CVE-2023-34319.md b/2023/CVE-2023-34319.md index 581bbafce1..85861c0360 100644 --- a/2023/CVE-2023-34319.md +++ b/2023/CVE-2023-34319.md @@ -1,6 +1,7 @@ ### [CVE-2023-34319](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34319) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2023/CVE-2023-3446.md b/2023/CVE-2023-3446.md index 7ff7a16be4..900c8a5458 100644 --- a/2023/CVE-2023-3446.md +++ b/2023/CVE-2023-3446.md @@ -1,9 +1,11 @@ ### [CVE-2023-3446](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3446) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.0.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-606%20Unchecked%20Input%20for%20Loop%20Condition&color=brightgreen) ### Description diff --git a/2023/CVE-2023-34969.md b/2023/CVE-2023-34969.md index 70f3413129..5e8c55e61a 100644 --- a/2023/CVE-2023-34969.md +++ b/2023/CVE-2023-34969.md @@ -1,5 +1,6 @@ ### [CVE-2023-34969](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34969) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-35001.md b/2023/CVE-2023-35001.md index 3eeded6116..e90d098426 100644 --- a/2023/CVE-2023-35001.md +++ b/2023/CVE-2023-35001.md @@ -1,5 +1,7 @@ ### [CVE-2023-35001](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35001) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=v3.13-rc1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787&color=brightgreen) diff --git a/2023/CVE-2023-35827.md b/2023/CVE-2023-35827.md index 6e59793456..e80ee393bd 100644 --- a/2023/CVE-2023-35827.md +++ b/2023/CVE-2023-35827.md @@ -1,5 +1,7 @@ ### [CVE-2023-35827](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35827) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -10,7 +12,7 @@ An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github - https://github.com/shakyaraj9569/Documentation diff --git a/2023/CVE-2023-35945.md b/2023/CVE-2023-35945.md index 6e8793d141..d252e3999d 100644 --- a/2023/CVE-2023-35945.md +++ b/2023/CVE-2023-35945.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.24.0%2C%20%3C%201.24.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.25.0%2C%20%3C%201.25.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.26.0%2C%20%3C%201.26.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) ### Description diff --git a/2023/CVE-2023-3609.md b/2023/CVE-2023-3609.md index c16947b4e2..a7f44bb398 100644 --- a/2023/CVE-2023-3609.md +++ b/2023/CVE-2023-3609.md @@ -1,6 +1,7 @@ ### [CVE-2023-3609](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3609) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.14.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.15.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.20.0%20&color=brightgreen) @@ -8,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.16.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.5.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%20Use%20After%20Free&color=brightgreen) ### Description diff --git a/2023/CVE-2023-3610.md b/2023/CVE-2023-3610.md index a1d25c93fe..c6fd0635ef 100644 --- a/2023/CVE-2023-3610.md +++ b/2023/CVE-2023-3610.md @@ -1,5 +1,6 @@ ### [CVE-2023-3610](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3610) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%20Use%20After%20Free&color=brightgreen) diff --git a/2023/CVE-2023-3772.md b/2023/CVE-2023-3772.md index 496055cbef..8ab74110dd 100644 --- a/2023/CVE-2023-3772.md +++ b/2023/CVE-2023-3772.md @@ -7,6 +7,8 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Virtualization%204%20for%20Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=NULL%20Pointer%20Dereference&color=brightgreen) ### Description diff --git a/2023/CVE-2023-3773.md b/2023/CVE-2023-3773.md index 4e4a3f5d0a..e1432cae46 100644 --- a/2023/CVE-2023-3773.md +++ b/2023/CVE-2023-3773.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) ### Description diff --git a/2023/CVE-2023-3777.md b/2023/CVE-2023-3777.md index f36f2f1858..b20595bf77 100644 --- a/2023/CVE-2023-3777.md +++ b/2023/CVE-2023-3777.md @@ -1,5 +1,6 @@ ### [CVE-2023-3777](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3777) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%20Use%20After%20Free&color=brightgreen) diff --git a/2023/CVE-2023-3817.md b/2023/CVE-2023-3817.md index 2e71644afb..71acb80b4a 100644 --- a/2023/CVE-2023-3817.md +++ b/2023/CVE-2023-3817.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-606%20Unchecked%20Input%20for%20Loop%20Condition&color=brightgreen) ### Description diff --git a/2023/CVE-2023-38408.md b/2023/CVE-2023-38408.md index bbf9ad38e3..36559b9ab8 100644 --- a/2023/CVE-2023-38408.md +++ b/2023/CVE-2023-38408.md @@ -1,5 +1,6 @@ ### [CVE-2023-38408](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38408) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-39194.md b/2023/CVE-2023-39194.md index ec9052aaa3..b270aa5efc 100644 --- a/2023/CVE-2023-39194.md +++ b/2023/CVE-2023-39194.md @@ -4,6 +4,8 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) ### Description diff --git a/2023/CVE-2023-39615.md b/2023/CVE-2023-39615.md index 2a83fafa43..563824d0e3 100644 --- a/2023/CVE-2023-39615.md +++ b/2023/CVE-2023-39615.md @@ -1,5 +1,7 @@ ### [CVE-2023-39615](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39615) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-4004.md b/2023/CVE-2023-4004.md index 71a33d2c18..b12362a9dd 100644 --- a/2023/CVE-2023-4004.md +++ b/2023/CVE-2023-4004.md @@ -13,6 +13,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.0%20Extended%20Update%20Support&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Virtualization%204%20for%20Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20After%20Free&color=brightgreen) ### Description diff --git a/2023/CVE-2023-4016.md b/2023/CVE-2023-4016.md index de52ed8eff..7d4dd12558 100644 --- a/2023/CVE-2023-4016.md +++ b/2023/CVE-2023-4016.md @@ -1,6 +1,7 @@ ### [CVE-2023-4016](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4016) ![](https://img.shields.io/static/v1?label=Product&message=Linux%20Kernal&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=3.3.0%20(might%20be%20earlier)%20-%20latest%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-122%3A%20Heap-based%20Buffer%20Overflow&color=brightgreen) ### Description diff --git a/2023/CVE-2023-40283.md b/2023/CVE-2023-40283.md index 9388a66475..55501dafcd 100644 --- a/2023/CVE-2023-40283.md +++ b/2023/CVE-2023-40283.md @@ -1,5 +1,6 @@ ### [CVE-2023-40283](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40283) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-40299.md b/2023/CVE-2023-40299.md new file mode 100644 index 0000000000..16142f066f --- /dev/null +++ b/2023/CVE-2023-40299.md @@ -0,0 +1,18 @@ +### [CVE-2023-40299](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40299) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using the DYLD_INSERT_LIBRARIES environment variable. + +### POC + +#### Reference +- https://github.com/Kong/insomnia/releases + +#### Github +No PoCs found on GitHub currently. + diff --git a/2023/CVE-2023-4039.md b/2023/CVE-2023-4039.md index 55c1742010..f3af3e352b 100644 --- a/2023/CVE-2023-4039.md +++ b/2023/CVE-2023-4039.md @@ -1,8 +1,10 @@ ### [CVE-2023-4039](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4039) ![](https://img.shields.io/static/v1?label=Product&message=Arm%20GNU%20Toolchain&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=GCC&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20of%20GCC%20that%20target%20AArch64%20when%20option%20-fstack-protector%20is%20used%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20where%20option%20-fstack-protector%20is%20used%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-693%20Protection%20Mechanism%20Failure&color=brightgreen) ### Description diff --git a/2023/CVE-2023-4273.md b/2023/CVE-2023-4273.md index 82f094e127..9dc964e13d 100644 --- a/2023/CVE-2023-4273.md +++ b/2023/CVE-2023-4273.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) ### Description diff --git a/2023/CVE-2023-42753.md b/2023/CVE-2023-42753.md index 552e662a33..8fb16a05a6 100644 --- a/2023/CVE-2023-42753.md +++ b/2023/CVE-2023-42753.md @@ -16,6 +16,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.2%20Extended%20Update%20Support&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Virtualization%204%20for%20Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Write&color=brightgreen) ### Description diff --git a/2023/CVE-2023-42754.md b/2023/CVE-2023-42754.md index f389b05b0f..126ce723e6 100644 --- a/2023/CVE-2023-42754.md +++ b/2023/CVE-2023-42754.md @@ -4,6 +4,8 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=NULL%20Pointer%20Dereference&color=brightgreen) ### Description diff --git a/2023/CVE-2023-42755.md b/2023/CVE-2023-42755.md index e435c446ab..fba42999b0 100644 --- a/2023/CVE-2023-42755.md +++ b/2023/CVE-2023-42755.md @@ -4,6 +4,8 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) ### Description diff --git a/2023/CVE-2023-45322.md b/2023/CVE-2023-45322.md index 294382dcf1..df59d23da5 100644 --- a/2023/CVE-2023-45322.md +++ b/2023/CVE-2023-45322.md @@ -1,5 +1,6 @@ ### [CVE-2023-45322](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45322) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-45863.md b/2023/CVE-2023-45863.md index e6fe096a64..992b612a5c 100644 --- a/2023/CVE-2023-45863.md +++ b/2023/CVE-2023-45863.md @@ -1,5 +1,7 @@ ### [CVE-2023-45863](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45863) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -11,6 +13,7 @@ An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With #### Reference - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.3 +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github No PoCs found on GitHub currently. diff --git a/2023/CVE-2023-45871.md b/2023/CVE-2023-45871.md index c1897fb2c9..3c23c76487 100644 --- a/2023/CVE-2023-45871.md +++ b/2023/CVE-2023-45871.md @@ -1,5 +1,7 @@ ### [CVE-2023-45871](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45871) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-4623.md b/2023/CVE-2023-4623.md index 2c2f508a00..13d97bf27d 100644 --- a/2023/CVE-2023-4623.md +++ b/2023/CVE-2023-4623.md @@ -1,6 +1,8 @@ ### [CVE-2023-4623](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4623) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%20Use%20After%20Free&color=brightgreen) ### Description diff --git a/2023/CVE-2023-46862.md b/2023/CVE-2023-46862.md index a997894efc..fae4968f58 100644 --- a/2023/CVE-2023-46862.md +++ b/2023/CVE-2023-46862.md @@ -1,5 +1,6 @@ ### [CVE-2023-46862](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46862) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-4807.md b/2023/CVE-2023-4807.md index 77e290f321..dc3bc565c9 100644 --- a/2023/CVE-2023-4807.md +++ b/2023/CVE-2023-4807.md @@ -1,8 +1,10 @@ ### [CVE-2023-4807](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4807) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-440%20Expected%20Behavior%20Violation&color=brightgreen) ### Description diff --git a/2023/CVE-2023-4813.md b/2023/CVE-2023-4813.md index cb84e5bc16..b3556e2b4e 100644 --- a/2023/CVE-2023-4813.md +++ b/2023/CVE-2023-4813.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Virtualization%204%20for%20Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20After%20Free&color=brightgreen) ### Description diff --git a/2023/CVE-2023-4911.md b/2023/CVE-2023-4911.md index 82ae197820..14d94352ee 100644 --- a/2023/CVE-2023-4911.md +++ b/2023/CVE-2023-4911.md @@ -8,6 +8,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Virtualization%204%20for%20Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.34%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Heap-based%20Buffer%20Overflow&color=brightgreen) diff --git a/2023/CVE-2023-50495.md b/2023/CVE-2023-50495.md index b243b3a8f1..5c05b26601 100644 --- a/2023/CVE-2023-50495.md +++ b/2023/CVE-2023-50495.md @@ -1,5 +1,6 @@ ### [CVE-2023-50495](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50495) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-51384.md b/2023/CVE-2023-51384.md index 6906cc69b8..2efc019eab 100644 --- a/2023/CVE-2023-51384.md +++ b/2023/CVE-2023-51384.md @@ -1,7 +1,9 @@ ### [CVE-2023-51384](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51384) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) @@ -14,6 +16,7 @@ In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incom #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/GitHubForSnap/openssh-server-gael diff --git a/2023/CVE-2023-51385.md b/2023/CVE-2023-51385.md index 700245aa21..119b8b7e42 100644 --- a/2023/CVE-2023-51385.md +++ b/2023/CVE-2023-51385.md @@ -1,5 +1,6 @@ ### [CVE-2023-51385](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51385) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-5156.md b/2023/CVE-2023-5156.md index 1389d2b112..bac4902b0c 100644 --- a/2023/CVE-2023-5156.md +++ b/2023/CVE-2023-5156.md @@ -3,7 +3,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) -![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Release%20of%20Memory%20after%20Effective%20Lifetime&color=brightgreen) ### Description diff --git a/2023/CVE-2023-51767.md b/2023/CVE-2023-51767.md index 95f0227153..5353704442 100644 --- a/2023/CVE-2023-51767.md +++ b/2023/CVE-2023-51767.md @@ -1,5 +1,6 @@ ### [CVE-2023-51767](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51767) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-5178.md b/2023/CVE-2023-5178.md index f92e1200fb..9092bd81a2 100644 --- a/2023/CVE-2023-5178.md +++ b/2023/CVE-2023-5178.md @@ -15,6 +15,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.2%20Extended%20Update%20Support&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Virtualization%204%20for%20Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20After%20Free&color=brightgreen) ### Description @@ -24,7 +25,7 @@ A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2023/CVE-2023-5197.md b/2023/CVE-2023-5197.md index a12952e48d..02a8483696 100644 --- a/2023/CVE-2023-5197.md +++ b/2023/CVE-2023-5197.md @@ -1,5 +1,6 @@ ### [CVE-2023-5197](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5197) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%20Use%20After%20Free&color=brightgreen) diff --git a/2023/CVE-2023-52425.md b/2023/CVE-2023-52425.md index b6900f3eb2..7a00084765 100644 --- a/2023/CVE-2023-52425.md +++ b/2023/CVE-2023-52425.md @@ -1,6 +1,7 @@ ### [CVE-2023-52425](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52425) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-52426.md b/2023/CVE-2023-52426.md index 35038e2d18..298869a962 100644 --- a/2023/CVE-2023-52426.md +++ b/2023/CVE-2023-52426.md @@ -1,5 +1,7 @@ ### [CVE-2023-52426](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52426) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2023/CVE-2023-52444.md b/2023/CVE-2023-52444.md index 7bc5ea6021..268f0eae99 100644 --- a/2023/CVE-2023-52444.md +++ b/2023/CVE-2023-52444.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7e01e7ad746bc8198a8b46163ddc73a1c7d22339%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2023/CVE-2023-52464.md b/2023/CVE-2023-52464.md index 6decee1575..11bbb2f51d 100644 --- a/2023/CVE-2023-52464.md +++ b/2023/CVE-2023-52464.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=41003396f932d7f027725c7acebb6a7caa41dc3e%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2023/CVE-2023-52612.md b/2023/CVE-2023-52612.md index eaefc4ddd8..77f07447b3 100644 --- a/2023/CVE-2023-52612.md +++ b/2023/CVE-2023-52612.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1ab53a77b772bf7369464a0e4fa6fd6499acf8f1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2023/CVE-2023-52622.md b/2023/CVE-2023-52622.md index b35857c9fa..87c7854d9f 100644 --- a/2023/CVE-2023-52622.md +++ b/2023/CVE-2023-52622.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=28c7bac0091687e6116ebd6c179e154ae4053c90%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: avoid o ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2023/CVE-2023-52699.md b/2023/CVE-2023-52699.md index f632b5957c..f71cbf40d8 100644 --- a/2023/CVE-2023-52699.md +++ b/2023/CVE-2023-52699.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2023/CVE-2023-52927.md b/2023/CVE-2023-52927.md index 7ca6ef464c..9cb69529d0 100644 --- a/2023/CVE-2023-52927.md +++ b/2023/CVE-2023-52927.md @@ -1,10 +1,12 @@ ### [CVE-2023-52927](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52927) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1bc91a5ddf3eaea0e0ea957cccf3abdcfcace00e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: al #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html - https://seadragnol.github.io/posts/CVE-2023-52927/ #### Github diff --git a/2023/CVE-2023-53292.md b/2023/CVE-2023-53292.md index a323e75b3e..35b0ce9380 100644 --- a/2023/CVE-2023-53292.md +++ b/2023/CVE-2023-53292.md @@ -1,9 +1,11 @@ ### [CVE-2023-53292](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-53292) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5fd7a84a09e640016fe106dd3e992f5210e23dc7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:blk-mq: fix N #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2023/CVE-2023-54271.md b/2023/CVE-2023-54271.md new file mode 100644 index 0000000000..6a5f3f0bc9 --- /dev/null +++ b/2023/CVE-2023-54271.md @@ -0,0 +1,20 @@ +### [CVE-2023-54271](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-54271) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9d179b865449b351ad5cb76dbea480c9170d4a27%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before initblk-iocost sometimes causes the following crash: BUG: kernel NULL pointer dereference, address: 00000000000000e0 ... RIP: 0010:_raw_spin_lock+0x17/0x30 Code: be 01 02 00 00 e8 79 38 39 ff 31 d2 89 d0 5d c3 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 65 ff 05 48 d0 34 7e b9 01 00 00 00 31 c0 0f b1 0f 75 02 5d c3 89 c6 e8 ea 04 00 00 5d c3 0f 1f 84 00 00 RSP: 0018:ffffc900023b3d40 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 00000000000000e0 RCX: 0000000000000001 RDX: ffffc900023b3d20 RSI: ffffc900023b3cf0 RDI: 00000000000000e0 RBP: ffffc900023b3d40 R08: ffffc900023b3c10 R09: 0000000000000003 R10: 0000000000000064 R11: 000000000000000a R12: ffff888102337000 R13: fffffffffffffff2 R14: ffff88810af408c8 R15: ffff8881070c3600 FS: 00007faaaf364fc0(0000) GS:ffff88842fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000e0 CR3: 00000001097b1000 CR4: 0000000000350ea0 Call Trace: ioc_weight_write+0x13d/0x410 cgroup_file_write+0x7a/0x130 kernfs_fop_write_iter+0xf5/0x170 vfs_write+0x298/0x370 ksys_write+0x5f/0xb0 __x64_sys_write+0x1b/0x20 do_syscall_64+0x3d/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0This happens because iocg->ioc is NULL. The field is initialized byioc_pd_init() and never cleared. The NULL deref is caused byblkcg_activate_policy() installing blkg_policy_data before initializing it.blkcg_activate_policy() was doing the following:1. Allocate pd's for all existing blkg's and install them in blkg->pd[].2. Initialize all pd's.3. Online all pd's.blkcg_activate_policy() only grabs the queue_lock and may release andre-acquire the lock as allocation may need to sleep. ioc_weight_write()grabs blkcg->lock and iterates all its blkg's. The two can race and ifioc_weight_write() runs during #1 or between #1 and #2, it can encounter apd which is not initialized yet, leading to crash.The crash can be reproduced with the following script: #!/bin/bash echo +io > /sys/fs/cgroup/cgroup.subtree_control systemd-run --unit touch-sda --scope dd if=/dev/sda of=/dev/null bs=1M count=1 iflag=direct echo 100 > /sys/fs/cgroup/system.slice/io.weight bash -c "echo '8:0 enable=1' > /sys/fs/cgroup/io.cost.qos" & sleep .2 echo 100 > /sys/fs/cgroup/system.slice/io.weightwith the following patch applied:> diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c> index fc49be622e05..38d671d5e10c 100644> --- a/block/blk-cgroup.c> +++ b/block/blk-cgroup.c> @@ -1553,6 +1553,12 @@ int blkcg_activate_policy(struct gendisk *disk, const struct blkcg_policy *pol)> pd->online = false;> }>> + if (system_state == SYSTEM_RUNNING) {> + spin_unlock_irq(&q->queue_lock);> + ssleep(1);> + spin_lock_irq(&q->queue_lock);> + }> +> /* all allocated, init in the same order */> if (pol->pd_init_fn)> list_for_each_entry_reverse(blkg, &q->blkg_list, q_node)I don't see a reason why all pd's should be allocated, initialized andonlined together. The only ordering requirement is that parent blkgs to beinitialized and onlined before children, which is guaranteed from thewalking order. Let's fix the bug by allocating, initializing and onlining pdfor each blkg and holding blkcg->lock over initialization and onlining. Thisensures that an installed blkg is always fully initialized and onlinedremoving the the race window. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2023/CVE-2023-5717.md b/2023/CVE-2023-5717.md index 1c6a9655a8..c3c30394a6 100644 --- a/2023/CVE-2023-5717.md +++ b/2023/CVE-2023-5717.md @@ -1,6 +1,9 @@ ### [CVE-2023-5717](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5717) ![](https://img.shields.io/static/v1?label=Product&message=Kernel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%20Out-of-bounds%20Write&color=brightgreen) ### Description @@ -10,7 +13,7 @@ A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Perf ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github - https://github.com/nomi-sec/PoC-in-GitHub diff --git a/2023/CVE-2023-5981.md b/2023/CVE-2023-5981.md index 41bad14bfa..4ef0b0de3f 100644 --- a/2023/CVE-2023-5981.md +++ b/2023/CVE-2023-5981.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.2%20Extended%20Update%20Support&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Observable%20Timing%20Discrepancy&color=brightgreen) ### Description diff --git a/2023/CVE-2023-6606.md b/2023/CVE-2023-6606.md index 2bfc56262d..b9a6f139f6 100644 --- a/2023/CVE-2023-6606.md +++ b/2023/CVE-2023-6606.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.2%20Extended%20Update%20Support&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Virtualization%204%20for%20Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) ### Description @@ -18,7 +19,7 @@ An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/ne ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github - https://github.com/NaInSec/CVE-LIST diff --git a/2023/CVE-2023-7008.md b/2023/CVE-2023-7008.md index 1b3393732f..f62e5e1338 100644 --- a/2023/CVE-2023-7008.md +++ b/2023/CVE-2023-7008.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Channel%20Accessible%20by%20Non-Endpoint&color=brightgreen) ### Description diff --git a/2023/CVE-2023-7104.md b/2023/CVE-2023-7104.md index 650b459fb2..c0110486b8 100644 --- a/2023/CVE-2023-7104.md +++ b/2023/CVE-2023-7104.md @@ -1,5 +1,6 @@ ### [CVE-2023-7104](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7104) ![](https://img.shields.io/static/v1?label=Product&message=SQLite3&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.10%20&color=brightgreen) diff --git a/2024/CVE-2024-0553.md b/2024/CVE-2024-0553.md index fab156b388..9025922802 100644 --- a/2024/CVE-2024-0553.md +++ b/2024/CVE-2024-0553.md @@ -10,6 +10,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.2%20Extended%20Update%20Support&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.8.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Observable%20Discrepancy&color=brightgreen) diff --git a/2024/CVE-2024-0567.md b/2024/CVE-2024-0567.md index 9a90bc52eb..72363b83d1 100644 --- a/2024/CVE-2024-0567.md +++ b/2024/CVE-2024-0567.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%203.11&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.8.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Verification%20of%20Cryptographic%20Signature&color=brightgreen) diff --git a/2024/CVE-2024-0684.md b/2024/CVE-2024-0684.md index cea0771b12..f670944e5f 100644 --- a/2024/CVE-2024-0684.md +++ b/2024/CVE-2024-0684.md @@ -1,6 +1,7 @@ ### [CVE-2024-0684](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0684) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=v9.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=v9.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=v9.4%20&color=brightgreen) diff --git a/2024/CVE-2024-11053.md b/2024/CVE-2024-11053.md index c8e1b0db3d..8480ba0030 100644 --- a/2024/CVE-2024-11053.md +++ b/2024/CVE-2024-11053.md @@ -1,5 +1,6 @@ ### [CVE-2024-11053](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053) ![](https://img.shields.io/static/v1?label=Product&message=curl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.5.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.5.2%20&color=brightgreen) @@ -197,6 +198,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8.8.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.9.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.9.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) ### Description diff --git a/2024/CVE-2024-2004.md b/2024/CVE-2024-2004.md index e288ec7a11..240d270865 100644 --- a/2024/CVE-2024-2004.md +++ b/2024/CVE-2024-2004.md @@ -1,5 +1,6 @@ ### [CVE-2024-2004](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2004) ![](https://img.shields.io/static/v1?label=Product&message=curl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.85.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.86.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.87.0%20&color=brightgreen) @@ -16,6 +17,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8.4.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.5.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-115%20Misinterpretation%20of%20Input&color=brightgreen) ### Description diff --git a/2024/CVE-2024-2236.md b/2024/CVE-2024-2236.md index 1de7a7e4aa..ae76c88b5a 100644 --- a/2024/CVE-2024-2236.md +++ b/2024/CVE-2024-2236.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Covert%20Timing%20Channel&color=brightgreen) ### Description diff --git a/2024/CVE-2024-23173.md b/2024/CVE-2024-23173.md new file mode 100644 index 0000000000..4746562622 --- /dev/null +++ b/2024/CVE-2024-23173.md @@ -0,0 +1,17 @@ +### [CVE-2024-23173](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23173) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php. + +### POC + +#### Reference +- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/965214 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-2379.md b/2024/CVE-2024-2379.md index 4325b6f1e8..9cbbb8f6e8 100644 --- a/2024/CVE-2024-2379.md +++ b/2024/CVE-2024-2379.md @@ -1,6 +1,8 @@ ### [CVE-2024-2379](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2379) ![](https://img.shields.io/static/v1?label=Product&message=curl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-295%20Improper%20Certificate%20Validation&color=brightgreen) ### Description diff --git a/2024/CVE-2024-2398.md b/2024/CVE-2024-2398.md index c389cc2725..aa006f1c76 100644 --- a/2024/CVE-2024-2398.md +++ b/2024/CVE-2024-2398.md @@ -1,5 +1,6 @@ ### [CVE-2024-2398](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2398) ![](https://img.shields.io/static/v1?label=Product&message=curl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.44.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.45.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.46.0%20&color=brightgreen) @@ -77,6 +78,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8.4.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.5.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-772%20Missing%20Release%20of%20Resource%20after%20Effective%20Lifetime&color=brightgreen) ### Description diff --git a/2024/CVE-2024-2466.md b/2024/CVE-2024-2466.md index 203449d142..786e94dc88 100644 --- a/2024/CVE-2024-2466.md +++ b/2024/CVE-2024-2466.md @@ -1,7 +1,9 @@ ### [CVE-2024-2466](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2466) ![](https://img.shields.io/static/v1?label=Product&message=curl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.5.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-297%20Improper%20Validation%20of%20Certificate%20with%20Host%20Mismatch&color=brightgreen) ### Description diff --git a/2024/CVE-2024-25062.md b/2024/CVE-2024-25062.md index 74cd34e703..26f9c7ceb8 100644 --- a/2024/CVE-2024-25062.md +++ b/2024/CVE-2024-25062.md @@ -1,5 +1,6 @@ ### [CVE-2024-25062](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2024/CVE-2024-26645.md b/2024/CVE-2024-26645.md index 692b230aeb..ca78133803 100644 --- a/2024/CVE-2024-26645.md +++ b/2024/CVE-2024-26645.md @@ -2,6 +2,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c193707dde77ace92a649cd59a17e105e2fbeaef%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:tracing: Ensu ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-26671.md b/2024/CVE-2024-26671.md new file mode 100644 index 0000000000..94d61f6501 --- /dev/null +++ b/2024/CVE-2024-26671.md @@ -0,0 +1,20 @@ +### [CVE-2024-26671](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26671) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=da55f2cc78418dee88400aafbbaed19d7ac8188e%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:blk-mq: fix IO hang from sbitmap wakeup raceIn blk_mq_mark_tag_wait(), __add_wait_queue() may be re-orderedwith the following blk_mq_get_driver_tag() in case of getting drivertag failure.Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observethe added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantimeblk_mq_mark_tag_wait() can't get driver tag successfully.This issue can be reproduced by running the following test in loop, andfio hang can be observed in < 30min when running it on my test VMin laptop. modprobe -r scsi_debug modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ --runtime=100 --numjobs=40 --time_based --name=test \ --ioengine=libaioFix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), whichis just fine in case of running out of tag. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-26679.md b/2024/CVE-2024-26679.md new file mode 100644 index 0000000000..a3237c014d --- /dev/null +++ b/2024/CVE-2024-26679.md @@ -0,0 +1,22 @@ +### [CVE-2024-26679](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26679) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.17.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=433337f9c00cac447d020922f59237273f5d92be%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f4713a3dfad045d46afcb9c2a7d0bba288920ed4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:inet: read sk->sk_family once in inet_recv_error()inet_recv_error() is called without holding the socket lock.IPv6 socket could mutate to IPv4 with IPV6_ADDRFORMsocket option and trigger a KCSAN warning. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-26772.md b/2024/CVE-2024-26772.md new file mode 100644 index 0000000000..4508f9d0f1 --- /dev/null +++ b/2024/CVE-2024-26772.md @@ -0,0 +1,20 @@ +### [CVE-2024-26772](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26772) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=163a203ddb36c36d4a1c942aececda0cc8d06aa7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()Places the logic for checking if the group's block bitmap is corrupt underthe protection of the group lock to avoid allocating blocks from the groupwith a corrupted block bitmap. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-26773.md b/2024/CVE-2024-26773.md index 4e3d8e67ff..daed09a4da 100644 --- a/2024/CVE-2024-26773.md +++ b/2024/CVE-2024-26773.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=163a203ddb36c36d4a1c942aececda0cc8d06aa7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -12,6 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: avoid a ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html - https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d #### Github diff --git a/2024/CVE-2024-26777.md b/2024/CVE-2024-26777.md index 0e7293476f..38097e0b11 100644 --- a/2024/CVE-2024-26777.md +++ b/2024/CVE-2024-26777.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:fbdev: sis: E ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-26783.md b/2024/CVE-2024-26783.md index 1c4b2fd10a..1d56f666b3 100644 --- a/2024/CVE-2024-26783.md +++ b/2024/CVE-2024-26783.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c574bbe917036c8968b984c82c7b13194fe5ce98%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:mm/vmscan: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-26805.md b/2024/CVE-2024-26805.md index b0f5ba3940..bbf8bb7d38 100644 --- a/2024/CVE-2024-26805.md +++ b/2024/CVE-2024-26805.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=65d48c630ff80a19c39751a4a6d3315f4c3c0280%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=85aec6328f3346b0718211faad564a3ffa64f60e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=92994a5f49d0a81c8643452d5c0a6e8b31d85a61%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d38200098e3203ba30ba06ed3f345ec6ca75234c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -22,7 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:netlink: Fix ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2024/CVE-2024-26835.md b/2024/CVE-2024-26835.md new file mode 100644 index 0000000000..6f346fb036 --- /dev/null +++ b/2024/CVE-2024-26835.md @@ -0,0 +1,25 @@ +### [CVE-2024-26835](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26835) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=179d9ba5559a756f4322583388b3213fe4e391b0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.202%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.262%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=bf8083bbf8fa202e6e5316bbd99759ab82bfe7a3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d9c4da8cb74e8ee6e58a064a3573aa37acf6c935%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e10f661adc556c4969c70ddaddf238bffdaf1e87%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: set dormant flag on hook register failureWe need to set the dormant flag again if we fail to registerthe hooks.During memory pressure hook registration can fail and we end upwith a table marked as active but no registered hooks.On table/base chain deletion, nf_tables will attempt to unregisterthe hook again which yields a warn splat from the nftables core. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-26982.md b/2024/CVE-2024-26982.md index e68174a16e..02d798b331 100644 --- a/2024/CVE-2024-26982.md +++ b/2024/CVE-2024-26982.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:Squashfs: che #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/runwhen-contrib/helm-charts diff --git a/2024/CVE-2024-27056.md b/2024/CVE-2024-27056.md index 43d7551489..2e39133c97 100644 --- a/2024/CVE-2024-27056.md +++ b/2024/CVE-2024-27056.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ba7136f3f9e849e5776429317bf45ac3d4cfa3f7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:wifi: iwlwifi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-28182.md b/2024/CVE-2024-28182.md index fe4b638e9e..55c8be1ec2 100644 --- a/2024/CVE-2024-28182.md +++ b/2024/CVE-2024-28182.md @@ -2,6 +2,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=nghttp2&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=%3C%201.61.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen) ### Description diff --git a/2024/CVE-2024-28757.md b/2024/CVE-2024-28757.md index 7923d40efe..740aa93098 100644 --- a/2024/CVE-2024-28757.md +++ b/2024/CVE-2024-28757.md @@ -1,5 +1,7 @@ ### [CVE-2024-28757](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28757) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2024/CVE-2024-28834.md b/2024/CVE-2024-28834.md index 40ccfb96ad..250a6f7e5d 100644 --- a/2024/CVE-2024-28834.md +++ b/2024/CVE-2024-28834.md @@ -10,6 +10,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.7.6-23%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20a%20Broken%20or%20Risky%20Cryptographic%20Algorithm&color=brightgreen) ### Description diff --git a/2024/CVE-2024-28835.md b/2024/CVE-2024-28835.md index 69561523bd..24203d2c01 100644 --- a/2024/CVE-2024-28835.md +++ b/2024/CVE-2024-28835.md @@ -8,6 +8,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.8.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Uncaught%20Exception&color=brightgreen) ### Description diff --git a/2024/CVE-2024-28956.md b/2024/CVE-2024-28956.md index ebc7ca3711..548f932619 100644 --- a/2024/CVE-2024-28956.md +++ b/2024/CVE-2024-28956.md @@ -2,6 +2,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Intel(R)%20Processors&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=See%20references%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Exposure%20of%20Sensitive%20Information%20in%20Shared%20Microarchitectural%20Structures%20during%20Transient%20Execution&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Disclosure&color=brightgreen) @@ -13,6 +14,7 @@ Exposure of Sensitive Information in Shared Microarchitectural Structures during #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2024/CVE-2024-34459.md b/2024/CVE-2024-34459.md index e3ff48b16e..3703860267 100644 --- a/2024/CVE-2024-34459.md +++ b/2024/CVE-2024-34459.md @@ -2,6 +2,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.12.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2024/CVE-2024-36017.md b/2024/CVE-2024-36017.md index 592bf9d32d..d835c26495 100644 --- a/2024/CVE-2024-36017.md +++ b/2024/CVE-2024-36017.md @@ -1,8 +1,10 @@ ### [CVE-2024-36017](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36017) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=79aab093a0b5370d7fc4e99df75996f4744dc03f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -12,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:rtnetlink: Co ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-36903.md b/2024/CVE-2024-36903.md index b8213c9950..42472f8b28 100644 --- a/2024/CVE-2024-36903.md +++ b/2024/CVE-2024-36903.md @@ -15,6 +15,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=605b056d63302ae84eb136e88d4df49124bd5e0d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d65ff2fe877c471aa6e79efa7bd8ff66e147c317%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ea30388baebcce37fd594d425a65037ca35e59e8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f394f690a30a5ec0413c62777a058eaf3d6e10d5%20&color=brightgreen) @@ -28,6 +29,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: Fix pot #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-36922.md b/2024/CVE-2024-36922.md new file mode 100644 index 0000000000..d16cb613af --- /dev/null +++ b/2024/CVE-2024-36922.md @@ -0,0 +1,20 @@ +### [CVE-2024-36922](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36922) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7b3e42ea2eadd41cc9d6363a9813b8ba8ab6f0e6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: iwlwifi: read txq->read_ptr under lockIf we read txq->read_ptr without lock, we can read the samevalue twice, then obtain the lock, and reclaim from thereto two different places, but crucially reclaim the sameentry twice, resulting in the WARN_ONCE() a little later.Fix that by reading txq->read_ptr under lock. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-36927.md b/2024/CVE-2024-36927.md index cdfc91caea..5705edf2bb 100644 --- a/2024/CVE-2024-36927.md +++ b/2024/CVE-2024-36927.md @@ -17,6 +17,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=99e5acae193e369b71217efe6f1dad42f3f18815%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9e3c96aed8fe32907e0a4bca05aad457629a820c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a54ec573d9b81b05d368f8e6edc1b3e49f688658%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=dc4e3bb0710178c8d03fc43064e0a71fe7440cdd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fc60067260c20da8cddcf968bec47416f3e2cde2%20&color=brightgreen) @@ -30,6 +31,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv4: Fix uni #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-36934.md b/2024/CVE-2024-36934.md new file mode 100644 index 0000000000..8d2cf3a147 --- /dev/null +++ b/2024/CVE-2024-36934.md @@ -0,0 +1,21 @@ +### [CVE-2024-36934](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36934) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7afc5dbde09104b023ce04465ba71aaba0fc4346%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:bna: ensure the copied buf is NUL terminatedCurrently, we allocate a nbytes-sized kernel buffer and copy nbytes fromuserspace to that buffer. Later, we use sscanf on this buffer but we don'tensure that the string is terminated inside the buffer, this can lead toOOB read when using sscanf. Fix this issue by using memdup_user_nulinstead of memdup_user. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-39292.md b/2024/CVE-2024-39292.md index 8a72cbb0ec..28b3b12357 100644 --- a/2024/CVE-2024-39292.md +++ b/2024/CVE-2024-39292.md @@ -1,8 +1,10 @@ ### [CVE-2024-39292](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39292) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.23%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=42a359e31a0e438b5b978a8f0fecdbd3c86bb033%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -12,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:um: Add winch ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-39469.md b/2024/CVE-2024-39469.md index 7ffd45aa48..8beb831bbe 100644 --- a/2024/CVE-2024-39469.md +++ b/2024/CVE-2024-39469.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.30%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2ba466d74ed74f073257f86e61519cb8f8f46184%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-39487.md b/2024/CVE-2024-39487.md index 892d29d25d..926e7382e6 100644 --- a/2024/CVE-2024-39487.md +++ b/2024/CVE-2024-39487.md @@ -1,7 +1,9 @@ ### [CVE-2024-39487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39487) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f9de11a165943a55e0fbda714caf60eaeb276a42%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:bonding: Fix ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html #### Github - https://github.com/takaaki-fukunaga/cvechecker diff --git a/2024/CVE-2024-40945.md b/2024/CVE-2024-40945.md index 34aa9cac85..eba45013be 100644 --- a/2024/CVE-2024-40945.md +++ b/2024/CVE-2024-40945.md @@ -16,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:iommu: Return - https://cert-portal.siemens.com/productcert/html/ssa-265688.html - https://cert-portal.siemens.com/productcert/html/ssa-355557.html - https://cert-portal.siemens.com/productcert/html/ssa-613116.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-41046.md b/2024/CVE-2024-41046.md new file mode 100644 index 0000000000..d7e16ddb9a --- /dev/null +++ b/2024/CVE-2024-41046.md @@ -0,0 +1,21 @@ +### [CVE-2024-41046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41046) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=504d4721ee8e432af4b5f196a08af38bc4dac5fe%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: ethernet: lantiq_etop: fix double free in detachThe number of the currently released descriptor is never incrementedwhich results in the same skb being released multiple times. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-42079.md b/2024/CVE-2024-42079.md index cdbc094b23..36edbd8caf 100644 --- a/2024/CVE-2024-42079.md +++ b/2024/CVE-2024-42079.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=82218943058d5e3fe692a38b5a549479738dab33%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:gfs2: Fix NUL #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-42106.md b/2024/CVE-2024-42106.md new file mode 100644 index 0000000000..e237ba6434 --- /dev/null +++ b/2024/CVE-2024-42106.md @@ -0,0 +1,21 @@ +### [CVE-2024-42106](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42106) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=432490f9d455fb842d70219f22d9d2c812371676%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:inet_diag: Initialize pad field in struct inet_diag_req_v2KMSAN reported uninit-value access in raw_lookup() [1]. Diag for rawsockets uses the pad field in struct inet_diag_req_v2 for theunderlying protocol. This field corresponds to the sdiag_raw_protocolfield in struct inet_diag_req_raw.inet_diag_get_exact_compat() converts inet_diag_req toinet_diag_req_v2, but leaves the pad field uninitialized. So the issueoccurs when raw_lookup() accesses the sdiag_raw_protocol field.Fix this by initializing the pad field ininet_diag_get_exact_compat(). Also, do the same fix ininet_diag_dump_compat() to avoid the similar issue in the future.[1]BUG: KMSAN: uninit-value in raw_lookup net/ipv4/raw_diag.c:49 [inline]BUG: KMSAN: uninit-value in raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71 raw_lookup net/ipv4/raw_diag.c:49 [inline] raw_sock_get+0x657/0x800 net/ipv4/raw_diag.c:71 raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99 inet_diag_cmd_exact+0x7d9/0x980 inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline] inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564 sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x332/0x3d0 net/socket.c:745 ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639 __sys_sendmsg net/socket.c:2668 [inline] __do_sys_sendmsg net/socket.c:2677 [inline] __se_sys_sendmsg net/socket.c:2675 [inline] __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675 x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fUninit was stored to memory at: raw_sock_get+0x650/0x800 net/ipv4/raw_diag.c:71 raw_diag_dump_one+0xa1/0x660 net/ipv4/raw_diag.c:99 inet_diag_cmd_exact+0x7d9/0x980 inet_diag_get_exact_compat net/ipv4/inet_diag.c:1404 [inline] inet_diag_rcv_msg_compat+0x469/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282 netlink_rcv_skb+0x537/0x670 net/netlink/af_netlink.c:2564 sock_diag_rcv+0x35/0x40 net/core/sock_diag.c:297 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0xe74/0x1240 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x10c6/0x1260 net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x332/0x3d0 net/socket.c:745 ____sys_sendmsg+0x7f0/0xb70 net/socket.c:2585 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2639 __sys_sendmsg net/socket.c:2668 [inline] __do_sys_sendmsg net/socket.c:2677 [inline] __se_sys_sendmsg net/socket.c:2675 [inline] __x64_sys_sendmsg+0x27e/0x4a0 net/socket.c:2675 x64_sys_call+0x135e/0x3ce0 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fLocal variable req.i created at: inet_diag_get_exact_compat net/ipv4/inet_diag.c:1396 [inline] inet_diag_rcv_msg_compat+0x2a6/0x530 net/ipv4/inet_diag.c:1426 sock_diag_rcv_msg+0x23d/0x740 net/core/sock_diag.c:282CPU: 1 PID: 8888 Comm: syz-executor.6 Not tainted 6.10.0-rc4-00217-g35bb670d65fc #32Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-42131.md b/2024/CVE-2024-42131.md new file mode 100644 index 0000000000..d01d7abc24 --- /dev/null +++ b/2024/CVE-2024-42131.md @@ -0,0 +1,21 @@ +### [CVE-2024-42131](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42131) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.29%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2da02997e08d3efe8174c7a47696e6f7cbe69ba9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:mm: avoid overflows in dirty throttling logicThe dirty throttling logic is interspersed with assumptions that dirtylimits in PAGE_SIZE units fit into 32-bit (so that various multiplicationsfit into 64-bits). If limits end up being larger, we will hit overflows,possible divisions by 0 etc. Fix these problems by never allowing solarge dirty limits as they have dubious practical value anyway. Fordirty_bytes / dirty_background_bytes interfaces we can just refuse to setso large limits. For dirty_ratio / dirty_background_ratio it isn't sosimple as the dirty limit is computed from the amount of available memorywhich can change due to memory hotplug etc. So when converting dirtylimits from ratios to numbers of pages, we just don't allow the result toexceed UINT_MAX.This is root-only triggerable problem which occurs when the operatorsets dirty limits to >16 TB. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-42154.md b/2024/CVE-2024-42154.md new file mode 100644 index 0000000000..d5f6abe29d --- /dev/null +++ b/2024/CVE-2024-42154.md @@ -0,0 +1,21 @@ +### [CVE-2024-42154](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42154) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3e7013ddf55af7bc191792b8aea0c2b94fb0fef5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:tcp_metrics: validate source addr lengthI don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4is at least 4 bytes long, and the policy doesn't have an entryfor this attribute at all (neither does it for IPv6 but v6 ismanually validated). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-613116.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-46786.md b/2024/CVE-2024-46786.md index b3da41db39..abb099206c 100644 --- a/2024/CVE-2024-46786.md +++ b/2024/CVE-2024-46786.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=12bb21a29c19aae50cfad4e2bb5c943108f34a7d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:fscache: dele #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/bygregonline/devsec-fastapi-report diff --git a/2024/CVE-2024-47736.md b/2024/CVE-2024-47736.md index 47f6c484cb..208d6d4bf0 100644 --- a/2024/CVE-2024-47736.md +++ b/2024/CVE-2024-47736.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8e6c8fa9f2e95c88a642521a5da19a8e31748846%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:erofs: handle #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-47809.md b/2024/CVE-2024-47809.md index 0ebde01501..44003d511a 100644 --- a/2024/CVE-2024-47809.md +++ b/2024/CVE-2024-47809.md @@ -1,10 +1,12 @@ ### [CVE-2024-47809](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47809) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.30%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=43279e5376017c40b4be9af5bc79cbb4ef6f53d7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:dlm: fix poss #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2024/CVE-2024-48881.md b/2024/CVE-2024-48881.md index 516e671ad2..24c3897f57 100644 --- a/2024/CVE-2024-48881.md +++ b/2024/CVE-2024-48881.md @@ -1,6 +1,7 @@ ### [CVE-2024-48881](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-48881) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=028ddcac477b691dd9205c92f991cc15259d033e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0729029e647234fa1a94376b6edffec5c2cd75f6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0cabf9e164660e8d66c4810396046383a1110a69%20&color=brightgreen) @@ -13,6 +14,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=68118c339c6e1e16ae017bef160dbe28a27ae9c8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=991e9c186a8ac6ab272a86e0ddc6f9733c38b867%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=db9439cef0b5efccf8021fe89f4953e0f901e85b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fe75e8a0c20127a8dc95704f1a7ad6b82c9a0ef8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) diff --git a/2024/CVE-2024-49881.md b/2024/CVE-2024-49881.md index e0327fbb42..82dc193221 100644 --- a/2024/CVE-2024-49881.md +++ b/2024/CVE-2024-49881.md @@ -1,8 +1,10 @@ ### [CVE-2024-49881](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49881) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=10809df84a4d868db61af621bae3658494165279%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-49884.md b/2024/CVE-2024-49884.md index 95d357091b..a03a893d06 100644 --- a/2024/CVE-2024-49884.md +++ b/2024/CVE-2024-49884.md @@ -1,7 +1,9 @@ ### [CVE-2024-49884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49884) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=dfe5080939ea4686b3414b5d970a9b26733c57a4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) diff --git a/2024/CVE-2024-49968.md b/2024/CVE-2024-49968.md index 6722f29eeb..1a191ba31b 100644 --- a/2024/CVE-2024-49968.md +++ b/2024/CVE-2024-49968.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=471fbbea7ff7061b2d6474665cb5a2ceb4fd6500%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: filesys #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2024/CVE-2024-49982.md b/2024/CVE-2024-49982.md index 3321aebf1c..b9a9b06601 100644 --- a/2024/CVE-2024-49982.md +++ b/2024/CVE-2024-49982.md @@ -1,6 +1,7 @@ ### [CVE-2024-49982](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49982) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=079cba4f4e307c69878226fdf5228c20aa1c969c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1a54aa506b3b2f31496731039e49778f54eee881%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.19.311%20&color=brightgreen) @@ -14,6 +15,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=74ca3ef68d2f449bc848c0a814cefc487bf755fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a16fbb80064634b254520a46395e36b87ca4731e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ad80c34944d7175fa1f5c7a55066020002921a99%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=eb48680b0255a9e8a9bdc93d6a55b11c31262e62%20&color=brightgreen) diff --git a/2024/CVE-2024-49994.md b/2024/CVE-2024-49994.md index ed30574d36..d1b599528e 100644 --- a/2024/CVE-2024-49994.md +++ b/2024/CVE-2024-49994.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=44abff2c0b970ae3d310b97617525dc01f248d7c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:block: fix in #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-49998.md b/2024/CVE-2024-49998.md index 15dea46c1d..cce26c6672 100644 --- a/2024/CVE-2024-49998.md +++ b/2024/CVE-2024-49998.md @@ -1,12 +1,14 @@ ### [CVE-2024-49998](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49998) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.15.155%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.16.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=89b60402d43cdab4387dbbf24afebda5cf092ae7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ee534378f00561207656663d93907583958339ae%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ff45899e732e57088985e3a497b1d9100571c0f5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -20,6 +22,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: dsa: imp #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2024/CVE-2024-50014.md b/2024/CVE-2024-50014.md index 0b2dc12ed5..7e9ac1ab6d 100644 --- a/2024/CVE-2024-50014.md +++ b/2024/CVE-2024-50014.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=01efe93a5aa20a19b390426718dc214898a7c2ec%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: fix acc #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-50063.md b/2024/CVE-2024-50063.md index b40b279d5e..18cee7a3e7 100644 --- a/2024/CVE-2024-50063.md +++ b/2024/CVE-2024-50063.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Prevent #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/bygregonline/devsec-fastapi-report diff --git a/2024/CVE-2024-50164.md b/2024/CVE-2024-50164.md index f725dbfd36..02ba5caba0 100644 --- a/2024/CVE-2024-50164.md +++ b/2024/CVE-2024-50164.md @@ -11,6 +11,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=717c39718dbc4f7ebcbb7b625fb11851cd9007fe%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=97e6d7dab1ca4648821c790a2b7913d6d5d549db%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a08d942ecbf46e23a192093f6983cb1d779f4fa8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bfe25df63048edd4ceaf78a2fc755d5e2befc978%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -23,6 +24,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Fix over #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/bygregonline/devsec-fastapi-report diff --git a/2024/CVE-2024-50298.md b/2024/CVE-2024-50298.md index 7e1ec07e7b..f2e6b558f5 100644 --- a/2024/CVE-2024-50298.md +++ b/2024/CVE-2024-50298.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d4fd0404c1c95b17880f254ebfee3485693fa8ba%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: enetc: a #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2024/CVE-2024-50602.md b/2024/CVE-2024-50602.md index d6f3d8fcca..ec0b0a7725 100644 --- a/2024/CVE-2024-50602.md +++ b/2024/CVE-2024-50602.md @@ -1,6 +1,7 @@ ### [CVE-2024-50602](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50602) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2024/CVE-2024-52332.md b/2024/CVE-2024-52332.md index 28a63ca26d..b8b0b6a2f4 100644 --- a/2024/CVE-2024-52332.md +++ b/2024/CVE-2024-52332.md @@ -1,7 +1,9 @@ ### [CVE-2024-52332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52332) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.29%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bbd98fe48a43464b4a044bc4cbeefad284d6aa80%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) diff --git a/2024/CVE-2024-52533.md b/2024/CVE-2024-52533.md index dacd3644b5..2f8f6d4093 100644 --- a/2024/CVE-2024-52533.md +++ b/2024/CVE-2024-52533.md @@ -1,6 +1,7 @@ ### [CVE-2024-52533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52533) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2024/CVE-2024-53124.md b/2024/CVE-2024-53124.md index 655f19b7ef..2cd048604b 100644 --- a/2024/CVE-2024-53124.md +++ b/2024/CVE-2024-53124.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e994b2f0fb9229aeff5eea9541320bd7b2ca8714%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -17,6 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: fix data #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2024/CVE-2024-53140.md b/2024/CVE-2024-53140.md index 1561014e75..0ec48c1a3d 100644 --- a/2024/CVE-2024-53140.md +++ b/2024/CVE-2024-53140.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.4.38%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.8.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=baaf0c65bc8ea9c7a404b09bc8cc3b8a1e4f18df%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ed5d7788a934a4b6d6d025e948ed4da496b4f12e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) diff --git a/2024/CVE-2024-53164.md b/2024/CVE-2024-53164.md index 3244b2ae38..8cbd1fdc08 100644 --- a/2024/CVE-2024-53164.md +++ b/2024/CVE-2024-53164.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=959466588aa7f84ccf79ae36a1d89542eaf9aaec%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-53165.md b/2024/CVE-2024-53165.md index 55b42ade99..f7cf3ff20f 100644 --- a/2024/CVE-2024-53165.md +++ b/2024/CVE-2024-53165.md @@ -1,8 +1,10 @@ ### [CVE-2024-53165](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53165) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.30%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2dcec7a988a1895540460a0bf5603bab63d5a3ed%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-53166.md b/2024/CVE-2024-53166.md index e01adc9be1..4ab12c5a0c 100644 --- a/2024/CVE-2024-53166.md +++ b/2024/CVE-2024-53166.md @@ -1,6 +1,7 @@ ### [CVE-2024-53166](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53166) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=76f1df88bbc2f984eb0418cc90de0a8384e63604%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:block, bfq: f #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/bygregonline/devsec-fastapi-report diff --git a/2024/CVE-2024-53170.md b/2024/CVE-2024-53170.md index ef49e98aba..8b26c30414 100644 --- a/2024/CVE-2024-53170.md +++ b/2024/CVE-2024-53170.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6cfeadbff3f8905f2854735ebb88e581402c16c4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:block: fix ua #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/bygregonline/devsec-fastapi-report diff --git a/2024/CVE-2024-53217.md b/2024/CVE-2024-53217.md index 0b1c7488d5..616e1c705b 100644 --- a/2024/CVE-2024-53217.md +++ b/2024/CVE-2024-53217.md @@ -2,6 +2,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.38%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=dcbeaa68dbbdacbbb330a86c7fc95a28473fc209%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) diff --git a/2024/CVE-2024-54458.md b/2024/CVE-2024-54458.md index a71d3d1069..34d0867446 100644 --- a/2024/CVE-2024-54458.md +++ b/2024/CVE-2024-54458.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.20%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=df032bf27a414acf61c957ec2fad22a57d903b39%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:scsi: ufs: bs #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-56433.md b/2024/CVE-2024-56433.md index 91ad66e83f..8c46ab6a07 100644 --- a/2024/CVE-2024-56433.md +++ b/2024/CVE-2024-56433.md @@ -1,6 +1,7 @@ ### [CVE-2024-56433](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56433) ![](https://img.shields.io/static/v1?label=Product&message=shadow-utils&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=4.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1188%20Initialization%20of%20a%20Resource%20with%20an%20Insecure%20Default&color=brightgreen) ### Description diff --git a/2024/CVE-2024-56569.md b/2024/CVE-2024-56569.md index e20947ad57..681385674f 100644 --- a/2024/CVE-2024-56569.md +++ b/2024/CVE-2024-56569.md @@ -1,8 +1,10 @@ ### [CVE-2024-56569](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56569) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=04ec7bb642b77374b53731b795b5654b5aff1c00%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-56570.md b/2024/CVE-2024-56570.md index 2fa06dbccb..0711f0b3dc 100644 --- a/2024/CVE-2024-56570.md +++ b/2024/CVE-2024-56570.md @@ -1,7 +1,9 @@ ### [CVE-2024-56570](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56570) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e9be9d5e76e34872f0c37d72e25bc27fe9e2c54c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) diff --git a/2024/CVE-2024-56600.md b/2024/CVE-2024-56600.md index 6d4b1d7f60..4011cc7165 100644 --- a/2024/CVE-2024-56600.md +++ b/2024/CVE-2024-56600.md @@ -1,8 +1,10 @@ ### [CVE-2024-56600](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56600) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-56601.md b/2024/CVE-2024-56601.md index a960443d88..cffefc3548 100644 --- a/2024/CVE-2024-56601.md +++ b/2024/CVE-2024-56601.md @@ -1,8 +1,10 @@ ### [CVE-2024-56601](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56601) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-56606.md b/2024/CVE-2024-56606.md index 1fd6d46d15..9dba346a52 100644 --- a/2024/CVE-2024-56606.md +++ b/2024/CVE-2024-56606.md @@ -1,7 +1,9 @@ ### [CVE-2024-56606](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56606) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b013840810c221f2b0cf641d01531526052dc1fb%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) diff --git a/2024/CVE-2024-56631.md b/2024/CVE-2024-56631.md index ae27e27724..6e67845b75 100644 --- a/2024/CVE-2024-56631.md +++ b/2024/CVE-2024-56631.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3a27c0defb0315760100f8b1adc7c4acbe04c884%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cc833acbee9db5ca8c6162b015b4c93863c6f821%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:scsi: sg: Fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/bygregonline/devsec-fastapi-report diff --git a/2024/CVE-2024-56644.md b/2024/CVE-2024-56644.md index 8965603747..2b255f7f47 100644 --- a/2024/CVE-2024-56644.md +++ b/2024/CVE-2024-56644.md @@ -1,10 +1,12 @@ ### [CVE-2024-56644](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56644) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.33.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.34%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=54c1a859efd9fd6cda05bc700315ba2519c14eba%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9c93e9c757c7d3d96027a06b9b4c4e37ca87ded7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-56647.md b/2024/CVE-2024-56647.md index 2781e42d71..3c55d17071 100644 --- a/2024/CVE-2024-56647.md +++ b/2024/CVE-2024-56647.md @@ -1,6 +1,7 @@ ### [CVE-2024-56647](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56647) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.25%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8b7817f3a959ed99d7443afc12f78a7e1fcc2063%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: Fix icmp ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/cku-heise/euvd-api-doc diff --git a/2024/CVE-2024-56650.md b/2024/CVE-2024-56650.md index 62786faf7c..7545f56565 100644 --- a/2024/CVE-2024-56650.md +++ b/2024/CVE-2024-56650.md @@ -1,8 +1,10 @@ ### [CVE-2024-56650](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56650) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.30%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=268cb38e1802db560c73167e643f14a3dcb4b07c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-56657.md b/2024/CVE-2024-56657.md index f1e5cbc4de..d67e40bed5 100644 --- a/2024/CVE-2024-56657.md +++ b/2024/CVE-2024-56657.md @@ -1,6 +1,7 @@ ### [CVE-2024-56657](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56657) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a135dfb5de1501327895729b4f513370d2555b4d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:ALSA: control ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/cku-heise/euvd-api-doc diff --git a/2024/CVE-2024-56703.md b/2024/CVE-2024-56703.md index 9a93eaf1a2..829cbb95bd 100644 --- a/2024/CVE-2024-56703.md +++ b/2024/CVE-2024-56703.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=66f5d6ce53e665477d2a33e8f539d4fa4ca81c83%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: Fix sof #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/cku-heise/euvd-api-doc diff --git a/2024/CVE-2024-56719.md b/2024/CVE-2024-56719.md index 579c7bfabf..807cf220f4 100644 --- a/2024/CVE-2024-56719.md +++ b/2024/CVE-2024-56719.md @@ -1,6 +1,7 @@ ### [CVE-2024-56719](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56719) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=07c9c26e37542486e34d767505e842f48f29c3f6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.15.171%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=58d23d835eb498336716cca55b5714191a309286%20&color=brightgreen) @@ -11,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=66600fac7a984dea4ae095411f644770b2561ede%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a3ff23f7c3f0e13f718900803e090fd3997d6bc9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ece593fc9c00741b682869d3f3dc584d37b7c9df%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -24,6 +26,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: stmmac: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/cku-heise/euvd-api-doc diff --git a/2024/CVE-2024-56770.md b/2024/CVE-2024-56770.md index 1c1517019d..c7771ea395 100644 --- a/2024/CVE-2024-56770.md +++ b/2024/CVE-2024-56770.md @@ -1,8 +1,10 @@ ### [CVE-2024-56770](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56770) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=50612537e9ab29693122fab20fc1eed235054ffe%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-56779.md b/2024/CVE-2024-56779.md index 3971ee1ceb..7fca6fd114 100644 --- a/2024/CVE-2024-56779.md +++ b/2024/CVE-2024-56779.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3234975f477f746c22d076ea178a79ea104b2ca7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-56780.md b/2024/CVE-2024-56780.md index 6fe5117ce8..26b39d9244 100644 --- a/2024/CVE-2024-56780.md +++ b/2024/CVE-2024-56780.md @@ -1,6 +1,7 @@ ### [CVE-2024-56780](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56780) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3027e200dd58d5b437f16634dbbd355b29ffe0a6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=31bed65eecbc5ce57592cfe31947eaa64e3d678e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.19.295%20&color=brightgreen) @@ -14,6 +15,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=86d89987f0998c98f57d641e308b40452a994045%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=89602de9a2d7080b7a4029d5c1bf8f78d295ff5f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=903fc5d8cb48b0d2de7095ef40e39fd32bb27bd0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d40c192e119892799dd4ddf94f5cea6fa93775ef%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=dabc8b20756601b9e1cc85a81d47d3f98ed4d13a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f3e9a2bbdeb8987508dd6bb2b701dea911d4daec%20&color=brightgreen) diff --git a/2024/CVE-2024-5742.md b/2024/CVE-2024-5742.md index 8b14069860..99185429b7 100644 --- a/2024/CVE-2024-5742.md +++ b/2024/CVE-2024-5742.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Link%20Resolution%20Before%20File%20Access%20('Link%20Following')&color=brightgreen) ### Description diff --git a/2024/CVE-2024-57884.md b/2024/CVE-2024-57884.md index 3cfe9011f8..02a841acb4 100644 --- a/2024/CVE-2024-57884.md +++ b/2024/CVE-2024-57884.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5a1c84b404a7176b8b36e2a0041b6f0adb3151a3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description diff --git a/2024/CVE-2024-57917.md b/2024/CVE-2024-57917.md index 7fcf4ddb8a..0fd878ea99 100644 --- a/2024/CVE-2024-57917.md +++ b/2024/CVE-2024-57917.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bb9ec13d156e85dfd6a8afd0bb61ccf5736ed257%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:topology: Kee #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/oogasawa/Utility-security diff --git a/2024/CVE-2024-57924.md b/2024/CVE-2024-57924.md index 01842ce5a4..ebf6a9f3f7 100644 --- a/2024/CVE-2024-57924.md +++ b/2024/CVE-2024-57924.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=be77196b809cdce8603a5aadd5e3cfabd3cbef96%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -17,6 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs: relax ass #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2024/CVE-2024-57973.md b/2024/CVE-2024-57973.md index e5b5403ad1..7f5de17e28 100644 --- a/2024/CVE-2024-57973.md +++ b/2024/CVE-2024-57973.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1cab775c3e75f1250c965feafd061d696df36e53%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:rdma/cxgb4: P #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-57977.md b/2024/CVE-2024-57977.md index e7d48f3ed5..9ebc7c2457 100644 --- a/2024/CVE-2024-57977.md +++ b/2024/CVE-2024-57977.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=9cbb78bb314360a860a8b23723971cb6fcb54176%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -18,6 +19,8 @@ In the Linux kernel, the following vulnerability has been resolved:memcg: fix so - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-57979.md b/2024/CVE-2024-57979.md index 7da3e332d7..01b92583ad 100644 --- a/2024/CVE-2024-57979.md +++ b/2024/CVE-2024-57979.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=49626fbb0360332e40fd76a48cb2ba876d6134ad%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=77327a71f9841b7dfa708195d1cb133d4ef4a989%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cd59fb14918a6b20c1ac8be121fa6397b97b00cb%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d953e0e837e65ecc1ddaa4f9560f7925878a0de6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -22,6 +23,8 @@ In the Linux kernel, the following vulnerability has been resolved:pps: Fix a us #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-57980.md b/2024/CVE-2024-57980.md index bc2d53465f..bfe8bf797f 100644 --- a/2024/CVE-2024-57980.md +++ b/2024/CVE-2024-57980.md @@ -1,6 +1,7 @@ ### [CVE-2024-57980](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57980) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.28%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a31a4055473bf0a7b2b06cb2262347200d0711e1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:media: uvcvid ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/runwhen-contrib/helm-charts diff --git a/2024/CVE-2024-57981.md b/2024/CVE-2024-57981.md index 1b343e2571..7fd24f8caf 100644 --- a/2024/CVE-2024-57981.md +++ b/2024/CVE-2024-57981.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:usb: xhci: Fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-57986.md b/2024/CVE-2024-57986.md index 1e18ff7f71..ee6abae443 100644 --- a/2024/CVE-2024-57986.md +++ b/2024/CVE-2024-57986.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:HID: core: Fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-57993.md b/2024/CVE-2024-57993.md index 2910816d4d..04f0496628 100644 --- a/2024/CVE-2024-57993.md +++ b/2024/CVE-2024-57993.md @@ -1,6 +1,7 @@ ### [CVE-2024-57993](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57993) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c49c33637802a2c6957a78119eb8be3b055dd9e9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:HID: hid-thru ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-57996.md b/2024/CVE-2024-57996.md index 43fd094dd6..08f0bf48ff 100644 --- a/2024/CVE-2024-57996.md +++ b/2024/CVE-2024-57996.md @@ -1,6 +1,7 @@ ### [CVE-2024-57996](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57996) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net_sched: sc #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58002.md b/2024/CVE-2024-58002.md index 2a948f2315..1ffe14b870 100644 --- a/2024/CVE-2024-58002.md +++ b/2024/CVE-2024-58002.md @@ -1,6 +1,7 @@ ### [CVE-2024-58002](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58002) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e5225c820c057537dc780244760e2e24c7d27366%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:media: uvcvid ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-58005.md b/2024/CVE-2024-58005.md index b745b392c8..09cd8169e3 100644 --- a/2024/CVE-2024-58005.md +++ b/2024/CVE-2024-58005.md @@ -16,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:tpm: Change t #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58009.md b/2024/CVE-2024-58009.md index a4b2fa654b..12190b1f31 100644 --- a/2024/CVE-2024-58009.md +++ b/2024/CVE-2024-58009.md @@ -26,6 +26,7 @@ In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2 #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58011.md b/2024/CVE-2024-58011.md index dd99ceb2ab..64d0a435ca 100644 --- a/2024/CVE-2024-58011.md +++ b/2024/CVE-2024-58011.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5de691bffe57fd0fc2b4dcdcf13815c56d11db10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:platform/x86: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-58013.md b/2024/CVE-2024-58013.md index 64e75d3e35..61e91de3a3 100644 --- a/2024/CVE-2024-58013.md +++ b/2024/CVE-2024-58013.md @@ -1,6 +1,7 @@ ### [CVE-2024-58013](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58013) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7cf5c2978f23fdbb2dd7b4e8b07e362ae2d8211c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:Bluetooth: MG ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58014.md b/2024/CVE-2024-58014.md index 8ad2a6aae1..a61b96c919 100644 --- a/2024/CVE-2024-58014.md +++ b/2024/CVE-2024-58014.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:wifi: brcmsma #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58016.md b/2024/CVE-2024-58016.md index d9e8a4b724..afa0a7bd11 100644 --- a/2024/CVE-2024-58016.md +++ b/2024/CVE-2024-58016.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=aeca4e2ca65c1aeacfbe520684e6421719d99417%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:safesetid: ch #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58017.md b/2024/CVE-2024-58017.md index 5d0a6fad51..a971341c64 100644 --- a/2024/CVE-2024-58017.md +++ b/2024/CVE-2024-58017.md @@ -22,6 +22,7 @@ In the Linux kernel, the following vulnerability has been resolved:printk: Fix s #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-58020.md b/2024/CVE-2024-58020.md index 53ae4193b6..033e9d2799 100644 --- a/2024/CVE-2024-58020.md +++ b/2024/CVE-2024-58020.md @@ -17,6 +17,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.5.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ac0d389402a6ff9ad92cea02c2d8c711483b91ab%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b70ac7849248ec8128fa12f86e3655ba38838f29%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=dde88ab4e45beb60b217026207aa9c14c88d71ab%20&color=brightgreen) @@ -32,6 +33,8 @@ In the Linux kernel, the following vulnerability has been resolved:HID: multitou #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-58056.md b/2024/CVE-2024-58056.md index 5ca0812a13..ff2b635c88 100644 --- a/2024/CVE-2024-58056.md +++ b/2024/CVE-2024-58056.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=08333b911f01862e71e51b7065fb4baca3cd2e67%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:remoteproc: c #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58058.md b/2024/CVE-2024-58058.md index 6f60c6b111..5ce343ca5e 100644 --- a/2024/CVE-2024-58058.md +++ b/2024/CVE-2024-58058.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.27%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,8 @@ In the Linux kernel, the following vulnerability has been resolved:ubifs: skip d #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58061.md b/2024/CVE-2024-58061.md index 835558dd04..17427f65d6 100644 --- a/2024/CVE-2024-58061.md +++ b/2024/CVE-2024-58061.md @@ -1,9 +1,11 @@ ### [CVE-2024-58061](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58061) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3d901102922723eedce6ef10ebd03315a7abb8a5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:wifi: mac8021 #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58063.md b/2024/CVE-2024-58063.md index 6ac21b5074..eb5119641e 100644 --- a/2024/CVE-2024-58063.md +++ b/2024/CVE-2024-58063.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:wifi: rtlwifi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58068.md b/2024/CVE-2024-58068.md index e2fcad0c81..8462eef3d7 100644 --- a/2024/CVE-2024-58068.md +++ b/2024/CVE-2024-58068.md @@ -1,6 +1,7 @@ ### [CVE-2024-58068](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58068) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=add1dc094a7456d3c56782b7478940b6a550c7ed%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:OPP: fix dev_ ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58071.md b/2024/CVE-2024-58071.md index c11128a78f..336e4083ee 100644 --- a/2024/CVE-2024-58071.md +++ b/2024/CVE-2024-58071.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:team: prevent #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2024/CVE-2024-58072.md b/2024/CVE-2024-58072.md index 0e80e126d2..cd3eebe4d7 100644 --- a/2024/CVE-2024-58072.md +++ b/2024/CVE-2024-58072.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:wifi: rtlwifi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58077.md b/2024/CVE-2024-58077.md index 337effe474..9fd85c4ee4 100644 --- a/2024/CVE-2024-58077.md +++ b/2024/CVE-2024-58077.md @@ -1,6 +1,7 @@ ### [CVE-2024-58077](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58077) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1f566435141047ca7db26aa4b0b6647a25badaee%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:ASoC: soc-pcm ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2024/CVE-2024-58079.md b/2024/CVE-2024-58079.md index efe86bd42c..4305dcdd65 100644 --- a/2024/CVE-2024-58079.md +++ b/2024/CVE-2024-58079.md @@ -1,6 +1,7 @@ ### [CVE-2024-58079](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58079) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2886477ff98740cc3333cf785e4de0b1ff3d7a28%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:media: uvcvid ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58083.md b/2024/CVE-2024-58083.md index 1ab79626f8..0040c23182 100644 --- a/2024/CVE-2024-58083.md +++ b/2024/CVE-2024-58083.md @@ -1,6 +1,7 @@ ### [CVE-2024-58083](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58083) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1d487e9bf8ba66a7174c56a0029c54b1eca8f99c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.14.120%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.19.44%20&color=brightgreen) @@ -18,7 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:KVM: Explicit ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58086.md b/2024/CVE-2024-58086.md index f0fca682bb..79c2371d21 100644 --- a/2024/CVE-2024-58086.md +++ b/2024/CVE-2024-58086.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=26a4dc29b74a137f45665089f6d3d633fcc9b662%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:drm/v3d: Stop #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2024/CVE-2024-58388.md b/2024/CVE-2024-58388.md index f301da7107..6bd6fe6ebf 100644 --- a/2024/CVE-2024-58388.md +++ b/2024/CVE-2024-58388.md @@ -10,6 +10,7 @@ Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthentica ### POC #### Reference +- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/crocus-lfi.yaml - https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html#pre-auth-lfi #### Github diff --git a/2024/CVE-2024-6409.md b/2024/CVE-2024-6409.md index 4397f1dd1d..373927b9b9 100644 --- a/2024/CVE-2024-6409.md +++ b/2024/CVE-2024-6409.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.16&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Signal%20Handler%20Race%20Condition&color=brightgreen) ### Description diff --git a/2024/CVE-2024-7264.md b/2024/CVE-2024-7264.md index d52d3a976a..4a845b8fde 100644 --- a/2024/CVE-2024-7264.md +++ b/2024/CVE-2024-7264.md @@ -1,5 +1,6 @@ ### [CVE-2024-7264](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264) ![](https://img.shields.io/static/v1?label=Product&message=curl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.32.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.33.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.34.0%20&color=brightgreen) @@ -95,6 +96,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8.7.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.8.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%20Out-of-bounds%20Read&color=brightgreen) ### Description diff --git a/2024/CVE-2024-8096.md b/2024/CVE-2024-8096.md index 5bb3c66eef..b55733c1f1 100644 --- a/2024/CVE-2024-8096.md +++ b/2024/CVE-2024-8096.md @@ -1,5 +1,6 @@ ### [CVE-2024-8096](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8096) ![](https://img.shields.io/static/v1?label=Product&message=curl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.41.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.42.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.42.1%20&color=brightgreen) @@ -86,6 +87,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8.8.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.9.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.9.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-295%20Improper%20Certificate%20Validation&color=brightgreen) ### Description diff --git a/2024/CVE-2024-8176.md b/2024/CVE-2024-8176.md index c30a7f6cd2..addb471a21 100644 --- a/2024/CVE-2024-8176.md +++ b/2024/CVE-2024-8176.md @@ -20,10 +20,12 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.0%20Update%20Services%20for%20SAP%20Solutions&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.2%20Update%20Services%20for%20SAP%20Solutions&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.4%20Extended%20Update%20Support&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Core%20Services%202.4.62.SP1&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Uncontrolled%20Recursion&color=brightgreen) ### Description diff --git a/2025/CVE-2025-0167.md b/2025/CVE-2025-0167.md index 633b029743..06d0cc9b0d 100644 --- a/2025/CVE-2025-0167.md +++ b/2025/CVE-2025-0167.md @@ -1,5 +1,6 @@ ### [CVE-2025-0167](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0167) ![](https://img.shields.io/static/v1?label=Product&message=curl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.76.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.76.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.77.0%20&color=brightgreen) @@ -37,6 +38,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8.8.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.9.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.9.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) ### Description diff --git a/2025/CVE-2025-0665.md b/2025/CVE-2025-0665.md index 796e291cf2..454b94a015 100644 --- a/2025/CVE-2025-0665.md +++ b/2025/CVE-2025-0665.md @@ -1,6 +1,8 @@ ### [CVE-2025-0665](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0665) ![](https://img.shields.io/static/v1?label=Product&message=curl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.11.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1341%20Multiple%20Releases%20of%20Same%20Resource%20or%20Handle&color=brightgreen) ### Description diff --git a/2025/CVE-2025-0725.md b/2025/CVE-2025-0725.md index 56d4a2001f..3338d271f9 100644 --- a/2025/CVE-2025-0725.md +++ b/2025/CVE-2025-0725.md @@ -1,5 +1,6 @@ ### [CVE-2025-0725](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0725) ![](https://img.shields.io/static/v1?label=Product&message=curl&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.10.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.10.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7.10.7%20&color=brightgreen) @@ -162,6 +163,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8.8.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.9.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8.9.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-680%20Integer%20Overflow%20to%20Buffer%20Overflow&color=brightgreen) ### Description diff --git a/2025/CVE-2025-13465.md b/2025/CVE-2025-13465.md index 59e5357230..949a45d92c 100644 --- a/2025/CVE-2025-13465.md +++ b/2025/CVE-2025-13465.md @@ -1,16 +1,17 @@ ### [CVE-2025-13465](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13465) -![](https://img.shields.io/static/v1?label=Product&message=Lodash&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Lodash-amd&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=lodash&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=lodash-amd&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=lodash-es&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=lodash.omit&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=lodash.unset&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.0.0%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1321%20Improperly%20Controlled%20Modification%20of%20Object%20Prototype%20Attributes%20('Prototype%20Pollution')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1321%3A%20Improperly%20Controlled%20Modification%20of%20Object%20Prototype%20Attributes%20('Prototype%20Pollution')&color=brightgreen) ### Description -Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.The issue permits deletion of properties but does not allow overwriting their original behavior.This issue is patched on 4.17.23 +The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0. ### POC diff --git a/2025/CVE-2025-13533.md b/2025/CVE-2025-13533.md new file mode 100644 index 0000000000..718ff5ace5 --- /dev/null +++ b/2025/CVE-2025-13533.md @@ -0,0 +1,17 @@ +### [CVE-2025-13533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13533) +![](https://img.shields.io/static/v1?label=Product&message=CSS%20%26%20JavaScript%20Toolbox&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, and Advanced assignment data. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the CJT block edit screen in the admin dashboard. + +### POC + +#### Reference +- https://gist.github.com/e578d548291225c116a5827ad205a9e9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-1390.md b/2025/CVE-2025-1390.md index 7b43dfec4f..626938da07 100644 --- a/2025/CVE-2025-1390.md +++ b/2025/CVE-2025-1390.md @@ -1,6 +1,8 @@ ### [CVE-2025-1390](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1390) ![](https://img.shields.io/static/v1?label=Product&message=Anolis%20OS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.73%3B0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen) ### Description diff --git a/2025/CVE-2025-21645.md b/2025/CVE-2025-21645.md index 478ac921d6..0eaaac38dd 100644 --- a/2025/CVE-2025-21645.md +++ b/2025/CVE-2025-21645.md @@ -8,6 +8,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=72e5a83b7c8401856cc3732150af24e43726717a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8e60615e8932167057b363c11a7835da7f007106%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:platform/x86/ #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21648.md b/2025/CVE-2025-21648.md index a05fb153e4..d09820b741 100644 --- a/2025/CVE-2025-21648.md +++ b/2025/CVE-2025-21648.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9cc1c73ad66610bffc80b691136ffc1e9a3b1a58%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: co #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21655.md b/2025/CVE-2025-21655.md index 88e621ed0f..fdc053f54f 100644 --- a/2025/CVE-2025-21655.md +++ b/2025/CVE-2025-21655.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=21a091b970cdbcf3e8ff829234b51be6f9192766%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:io_uring/even #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/oogasawa/Utility-security diff --git a/2025/CVE-2025-21676.md b/2025/CVE-2025-21676.md index 00610a8c49..f54d7a83eb 100644 --- a/2025/CVE-2025-21676.md +++ b/2025/CVE-2025-21676.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=95698ff6177b5f1f13f251da60e7348413046ae4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: fec: han #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21682.md b/2025/CVE-2025-21682.md index 6d6891fad9..ace7e591a2 100644 --- a/2025/CVE-2025-21682.md +++ b/2025/CVE-2025-21682.md @@ -1,10 +1,12 @@ ### [CVE-2025-21682](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21682) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1054aee82321483dceabbb9b9e5d6512e8fe684b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.16%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:eth: bnxt: al #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21700.md b/2025/CVE-2025-21700.md index 4e6e4d321d..6f82fb690d 100644 --- a/2025/CVE-2025-21700.md +++ b/2025/CVE-2025-21700.md @@ -1,6 +1,7 @@ ### [CVE-2025-21700](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21700) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: sched: D ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21702.md b/2025/CVE-2025-21702.md index 50c57b8f3b..e0c2d27109 100644 --- a/2025/CVE-2025-21702.md +++ b/2025/CVE-2025-21702.md @@ -1,10 +1,12 @@ ### [CVE-2025-21702](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21702) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.34%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=57dbb2d83d100ea601c54fe129bfde0678db5dee%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:pfifo_tail_en #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21703.md b/2025/CVE-2025-21703.md index 8328471c16..a33f9c92b5 100644 --- a/2025/CVE-2025-21703.md +++ b/2025/CVE-2025-21703.md @@ -1,6 +1,7 @@ ### [CVE-2025-21703](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21703) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=10df49cfca73dfbbdb6c4150d859f7e8926ae427%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=216509dda290f6db92c816dd54b83c1df9da9e76%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=356078a5c55ec8d2061fcc009fb8599f5b0527f9%20&color=brightgreen) @@ -24,7 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:netem: Update ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21704.md b/2025/CVE-2025-21704.md index db3a8636fa..5713b5927f 100644 --- a/2025/CVE-2025-21704.md +++ b/2025/CVE-2025-21704.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:usb: cdc-acm: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21705.md b/2025/CVE-2025-21705.md index acb544c12e..5f70e32ce9 100644 --- a/2025/CVE-2025-21705.md +++ b/2025/CVE-2025-21705.md @@ -1,11 +1,13 @@ ### [CVE-2025-21705](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21705) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.1.36%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.3.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9c998d59a6b1359ad43d1ef38538af5f55fd01a2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b7bb71dfb541df376c21c24451369fea83c4f327%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c2b2ae3925b65070adb27d5a31a31c376f26dec7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -18,6 +20,8 @@ In the Linux kernel, the following vulnerability has been resolved:mptcp: handle #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21706.md b/2025/CVE-2025-21706.md index f58f62ffdf..9aa810a3b5 100644 --- a/2025/CVE-2025-21706.md +++ b/2025/CVE-2025-21706.md @@ -1,9 +1,11 @@ ### [CVE-2025-21706](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21706) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=73c762c1f07dacba4fd1cefd15e24b419d42320d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:mptcp: pm: on #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21707.md b/2025/CVE-2025-21707.md index 492771f1a8..f83c482b58 100644 --- a/2025/CVE-2025-21707.md +++ b/2025/CVE-2025-21707.md @@ -1,9 +1,11 @@ ### [CVE-2025-21707](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21707) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=84dfe3677a6f45b3d0dfdd564e55717a1a5e60cc%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:mptcp: consol #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21708.md b/2025/CVE-2025-21708.md index 4d15626d94..fb78b24ef2 100644 --- a/2025/CVE-2025-21708.md +++ b/2025/CVE-2025-21708.md @@ -1,6 +1,7 @@ ### [CVE-2025-21708](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21708) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: usb: rtl ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21716.md b/2025/CVE-2025-21716.md index 10a9d99468..00b71b7a58 100644 --- a/2025/CVE-2025-21716.md +++ b/2025/CVE-2025-21716.md @@ -1,6 +1,7 @@ ### [CVE-2025-21716](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21716) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f9c4bb0b245cee35ef66f75bf409c9573d934cf9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:vxlan: Fix un ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21718.md b/2025/CVE-2025-21718.md index 8826d45f28..1d3baa7ad0 100644 --- a/2025/CVE-2025-21718.md +++ b/2025/CVE-2025-21718.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: rose: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21719.md b/2025/CVE-2025-21719.md index 60d59b4637..922a0f0280 100644 --- a/2025/CVE-2025-21719.md +++ b/2025/CVE-2025-21719.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipmr: do not #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21724.md b/2025/CVE-2025-21724.md index a5028e4038..d5f83271c5 100644 --- a/2025/CVE-2025-21724.md +++ b/2025/CVE-2025-21724.md @@ -1,6 +1,7 @@ ### [CVE-2025-21724](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21724) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=58ccf0190d19d9a8a41f8a02b9e06742b58df4a1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:iommufd/iova_ #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21725.md b/2025/CVE-2025-21725.md index af317aed3d..192cc6feba 100644 --- a/2025/CVE-2025-21725.md +++ b/2025/CVE-2025-21725.md @@ -1,6 +1,7 @@ ### [CVE-2025-21725](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21725) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1cd8c353708de99d8bfa7db8a0c961a800b1fa7f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=548893404c44fc01a59f17727876e02553146fe6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.1.65%20&color=brightgreen) @@ -16,7 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:smb: client: ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21726.md b/2025/CVE-2025-21726.md index d7da3ea194..84adce650a 100644 --- a/2025/CVE-2025-21726.md +++ b/2025/CVE-2025-21726.md @@ -18,6 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:padata: avoid #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/runwhen-contrib/helm-charts diff --git a/2025/CVE-2025-21727.md b/2025/CVE-2025-21727.md index e8dbb7ba33..01cc06a846 100644 --- a/2025/CVE-2025-21727.md +++ b/2025/CVE-2025-21727.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:padata: fix U #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21728.md b/2025/CVE-2025-21728.md index ecd08e0e32..cad4fee0c5 100644 --- a/2025/CVE-2025-21728.md +++ b/2025/CVE-2025-21728.md @@ -20,6 +20,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Send sig #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21731.md b/2025/CVE-2025-21731.md index 1e747de4dd..916b23c0ac 100644 --- a/2025/CVE-2025-21731.md +++ b/2025/CVE-2025-21731.md @@ -1,8 +1,10 @@ ### [CVE-2025-21731](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21731) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b7aa3d39385dc2d95899f9e379623fef446a2acd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:nbd: don't al #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21735.md b/2025/CVE-2025-21735.md index b9123f69c1..4d38765342 100644 --- a/2025/CVE-2025-21735.md +++ b/2025/CVE-2025-21735.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:NFC: nci: Add #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21738.md b/2025/CVE-2025-21738.md index 88b4b6d939..88880d0cf1 100644 --- a/2025/CVE-2025-21738.md +++ b/2025/CVE-2025-21738.md @@ -1,6 +1,7 @@ ### [CVE-2025-21738](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21738) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.22%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5a5dbd18a7496ed403f6f54bb20c955c65482fa5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:ata: libata-s ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21744.md b/2025/CVE-2025-21744.md index b10cebf3cc..71db200bc8 100644 --- a/2025/CVE-2025-21744.md +++ b/2025/CVE-2025-21744.md @@ -18,6 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:wifi: brcmfma #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21745.md b/2025/CVE-2025-21745.md index 061df003a1..08c669d868 100644 --- a/2025/CVE-2025-21745.md +++ b/2025/CVE-2025-21745.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ef45fe470e1e5410db4af87abc5d5055427945ac%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -18,6 +19,8 @@ In the Linux kernel, the following vulnerability has been resolved:blk-cgroup: F - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21753.md b/2025/CVE-2025-21753.md index 1d1e9919ea..a53e22057e 100644 --- a/2025/CVE-2025-21753.md +++ b/2025/CVE-2025-21753.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:btrfs: fix us #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/runwhen-contrib/helm-charts diff --git a/2025/CVE-2025-21756.md b/2025/CVE-2025-21756.md index fe25517ff1..162adba9b4 100644 --- a/2025/CVE-2025-21756.md +++ b/2025/CVE-2025-21756.md @@ -16,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:vsock: Keep t #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/0xMarcio/cve diff --git a/2025/CVE-2025-21758.md b/2025/CVE-2025-21758.md index b69d32f7ee..abdc4d3b77 100644 --- a/2025/CVE-2025-21758.md +++ b/2025/CVE-2025-21758.md @@ -1,9 +1,11 @@ ### [CVE-2025-21758](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21758) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.26%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b8ad0cbc58f703972e9e37c4e2a8081dd7e6a551%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: mcast: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21760.md b/2025/CVE-2025-21760.md index 7c02a72e93..b8ba8a62b3 100644 --- a/2025/CVE-2025-21760.md +++ b/2025/CVE-2025-21760.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1762f7e88eb34f653b4a915be99a102e347dd45e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.26%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,8 @@ In the Linux kernel, the following vulnerability has been resolved:ndisc: extend #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21761.md b/2025/CVE-2025-21761.md index 9baace8eff..3c4098cc84 100644 --- a/2025/CVE-2025-21761.md +++ b/2025/CVE-2025-21761.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:openvswitch: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21762.md b/2025/CVE-2025-21762.md index 925b71bfb0..6b81f3e477 100644 --- a/2025/CVE-2025-21762.md +++ b/2025/CVE-2025-21762.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:arp: use RCU #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21763.md b/2025/CVE-2025-21763.md index 93a109b5e3..e57128d2f6 100644 --- a/2025/CVE-2025-21763.md +++ b/2025/CVE-2025-21763.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:neighbour: us #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21764.md b/2025/CVE-2025-21764.md index 342fb9f8bb..b621780567 100644 --- a/2025/CVE-2025-21764.md +++ b/2025/CVE-2025-21764.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=de09334b9326632bbf1a74bfd8b01866cbbf2f61%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,8 @@ In the Linux kernel, the following vulnerability has been resolved:ndisc: use RC #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21765.md b/2025/CVE-2025-21765.md index 6919001fae..4568d07863 100644 --- a/2025/CVE-2025-21765.md +++ b/2025/CVE-2025-21765.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5578689a4e3c04f2d43ea39736fd3fa396d80c6e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -18,6 +19,8 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: use RCU - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21766.md b/2025/CVE-2025-21766.md index 903f14bfb5..e242bacae4 100644 --- a/2025/CVE-2025-21766.md +++ b/2025/CVE-2025-21766.md @@ -1,6 +1,7 @@ ### [CVE-2025-21766](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21766) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2b1be6c925cdf4638811765a9160796291494b89%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2fbc6e89b2f1403189e624cabaf73e189c5e50c6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.14.200%20&color=brightgreen) @@ -22,6 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv4: use RCU #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21767.md b/2025/CVE-2025-21767.md index 74449875ed..4f1eea776f 100644 --- a/2025/CVE-2025-21767.md +++ b/2025/CVE-2025-21767.md @@ -1,6 +1,7 @@ ### [CVE-2025-21767](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21767) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=155d3c5d24ee13cafa6236b49fc02b240a511d59%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=193e14e68e907b2a7a936a7726accbaa4df25a4d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.10.50%20&color=brightgreen) @@ -20,6 +21,7 @@ In the Linux kernel, the following vulnerability has been resolved:clocksource: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21776.md b/2025/CVE-2025-21776.md index 8d5e7052fb..787d259640 100644 --- a/2025/CVE-2025-21776.md +++ b/2025/CVE-2025-21776.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:USB: hub: Ign #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21779.md b/2025/CVE-2025-21779.md index c95c81cfdd..c797802548 100644 --- a/2025/CVE-2025-21779.md +++ b/2025/CVE-2025-21779.md @@ -1,6 +1,7 @@ ### [CVE-2025-21779](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21779) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=214ff83d4473a7757fa18a64dc7efe3b0e158486%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.20%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:KVM: x86: Rej ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21780.md b/2025/CVE-2025-21780.md index 5a84ef02f6..fc6c02ca43 100644 --- a/2025/CVE-2025-21780.md +++ b/2025/CVE-2025-21780.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=137d63abbf6a0859e79b662e81d21170ecb75e59%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: a #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/pawan-shivarkar/List-of-CVE-s- diff --git a/2025/CVE-2025-21787.md b/2025/CVE-2025-21787.md index 0fb6fd5e8f..dda9944775 100644 --- a/2025/CVE-2025-21787.md +++ b/2025/CVE-2025-21787.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:team: better #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21790.md b/2025/CVE-2025-21790.md index 7a9e6be42d..ef575d05fb 100644 --- a/2025/CVE-2025-21790.md +++ b/2025/CVE-2025-21790.md @@ -1,6 +1,7 @@ ### [CVE-2025-21790](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21790) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f9c4bb0b245cee35ef66f75bf409c9573d934cf9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:vxlan: check ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21791.md b/2025/CVE-2025-21791.md index 2471d5f7de..ff3362e244 100644 --- a/2025/CVE-2025-21791.md +++ b/2025/CVE-2025-21791.md @@ -1,6 +1,7 @@ ### [CVE-2025-21791](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21791) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a8e3e1a9f02094145580ea7920c6a1d9aabd5539%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:vrf: use RCU ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/runwhen-contrib/helm-charts diff --git a/2025/CVE-2025-21795.md b/2025/CVE-2025-21795.md index 2046ce79d4..d106b77bce 100644 --- a/2025/CVE-2025-21795.md +++ b/2025/CVE-2025-21795.md @@ -10,6 +10,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=67ef9e5fd737eab2495f2586df7e9ea30caa1b77%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -22,6 +23,8 @@ In the Linux kernel, the following vulnerability has been resolved:NFSD: fix han - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21796.md b/2025/CVE-2025-21796.md index 7ad51ae20e..f9ff2a8975 100644 --- a/2025/CVE-2025-21796.md +++ b/2025/CVE-2025-21796.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a257cdd0e2179630d3201c32ba14d7fcb3c3a055%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -18,6 +19,8 @@ In the Linux kernel, the following vulnerability has been resolved:nfsd: clear a - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21802.md b/2025/CVE-2025-21802.md index caa77715f8..ed0bbaca5e 100644 --- a/2025/CVE-2025-21802.md +++ b/2025/CVE-2025-21802.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.4.156%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9b5a29f0acefa3eb1dbe2fa302b393eeff64d933%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b06ad258e01389ca3ff13bc180f3fcd6a608f1cd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c4b64011e458aa2b246cd4e42012cfd83d2d9a5c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d36b15e3e7b5937cb1f6ac590a85facc3a320642%20&color=brightgreen) @@ -22,6 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: hns3: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21806.md b/2025/CVE-2025-21806.md index 4b60560c6d..b8bc56de83 100644 --- a/2025/CVE-2025-21806.md +++ b/2025/CVE-2025-21806.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: let net. #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21814.md b/2025/CVE-2025-21814.md index 402b4b04dc..5124e02492 100644 --- a/2025/CVE-2025-21814.md +++ b/2025/CVE-2025-21814.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d94ba80ebbea17f036cecb104398fbcd788aa742%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,8 @@ In the Linux kernel, the following vulnerability has been resolved:ptp: Ensure i #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21830.md b/2025/CVE-2025-21830.md index 357e3e231a..d03f3b0087 100644 --- a/2025/CVE-2025-21830.md +++ b/2025/CVE-2025-21830.md @@ -1,6 +1,7 @@ ### [CVE-2025-21830](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21830) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cb2c7d1a1776057c9a1f48ed1250d85e94d4850d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:landlock: Han ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/Sh1r0ko11/redmagic-9spro-exploits diff --git a/2025/CVE-2025-21832.md b/2025/CVE-2025-21832.md index d5550cdf24..b992e16323 100644 --- a/2025/CVE-2025-21832.md +++ b/2025/CVE-2025-21832.md @@ -1,6 +1,7 @@ ### [CVE-2025-21832](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21832) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3e1f941dd9f33776b3df4e30f741fe445ff773f3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:block: don't ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/Sh1r0ko11/redmagic-9spro-exploits diff --git a/2025/CVE-2025-21835.md b/2025/CVE-2025-21835.md index 1981b947c2..62e56da668 100644 --- a/2025/CVE-2025-21835.md +++ b/2025/CVE-2025-21835.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:usb: gadget: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21838.md b/2025/CVE-2025-21838.md index 8db5d4e72f..c5e2da9ed0 100644 --- a/2025/CVE-2025-21838.md +++ b/2025/CVE-2025-21838.md @@ -1,6 +1,7 @@ ### [CVE-2025-21838](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21838) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5702f75375aa9ecf8ad3431aef3fe6ce8c8dbd15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:usb: gadget: ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21844.md b/2025/CVE-2025-21844.md index b9412dc06b..c2418431ab 100644 --- a/2025/CVE-2025-21844.md +++ b/2025/CVE-2025-21844.md @@ -22,6 +22,7 @@ In the Linux kernel, the following vulnerability has been resolved:smb: client: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21846.md b/2025/CVE-2025-21846.md index f0a667b3c7..f842e98544 100644 --- a/2025/CVE-2025-21846.md +++ b/2025/CVE-2025-21846.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,8 @@ In the Linux kernel, the following vulnerability has been resolved:acct: perform #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21853.md b/2025/CVE-2025-21853.md index d1577678b0..4821cf8161 100644 --- a/2025/CVE-2025-21853.md +++ b/2025/CVE-2025-21853.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fc9702273e2edb90400a34b3be76f7b08fa3344b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: avoid ho #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21858.md b/2025/CVE-2025-21858.md index 54841df338..22eccb275b 100644 --- a/2025/CVE-2025-21858.md +++ b/2025/CVE-2025-21858.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:geneve: Fix u #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21859.md b/2025/CVE-2025-21859.md index 89bebe6812..e9b1e58a26 100644 --- a/2025/CVE-2025-21859.md +++ b/2025/CVE-2025-21859.md @@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:USB: gadget: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21861.md b/2025/CVE-2025-21861.md index dc24ac56f0..dcac55c08c 100644 --- a/2025/CVE-2025-21861.md +++ b/2025/CVE-2025-21861.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8763cb45ab967a92a5ee49e9c544c0f0ea90e2d6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:mm/migrate_de #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21862.md b/2025/CVE-2025-21862.md index d27978a246..57eae17c36 100644 --- a/2025/CVE-2025-21862.md +++ b/2025/CVE-2025-21862.md @@ -16,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:drop_monitor: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21863.md b/2025/CVE-2025-21863.md index 769e9401f1..32c2b7ad21 100644 --- a/2025/CVE-2025-21863.md +++ b/2025/CVE-2025-21863.md @@ -1,8 +1,10 @@ ### [CVE-2025-21863](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21863) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d3656344fea0339fb0365c8df4d2beba4e0089cd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:io_uring: pre #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21864.md b/2025/CVE-2025-21864.md index adc379089e..ac7e8b2cd4 100644 --- a/2025/CVE-2025-21864.md +++ b/2025/CVE-2025-21864.md @@ -1,10 +1,12 @@ ### [CVE-2025-21864](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21864) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=68822bdf76f10c3dc80609d4e2cdc1e847429086%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:tcp: drop sec #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21865.md b/2025/CVE-2025-21865.md index 9549cfbff8..2951a7ee9b 100644 --- a/2025/CVE-2025-21865.md +++ b/2025/CVE-2025-21865.md @@ -28,6 +28,7 @@ In the Linux kernel, the following vulnerability has been resolved:gtp: Suppress #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21867.md b/2025/CVE-2025-21867.md index bdad665d7d..d66f4e394b 100644 --- a/2025/CVE-2025-21867.md +++ b/2025/CVE-2025-21867.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=be3d72a2896cb24090f268dce4aa8a304d40bc23%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf, test_run #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21875.md b/2025/CVE-2025-21875.md index 5941841536..b908c75d2b 100644 --- a/2025/CVE-2025-21875.md +++ b/2025/CVE-2025-21875.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b6c08380860b926752d57c8fa9911fa388c4b876%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:mptcp: always #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21887.md b/2025/CVE-2025-21887.md index 69815b4659..08760ebfe1 100644 --- a/2025/CVE-2025-21887.md +++ b/2025/CVE-2025-21887.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=62f29ca45f832e281fc14966ac25f6ff3bd121ca%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=714ba10a6dd19752a349e59aa875f3288ccb59b9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b07d5cc93e1b28df47a72c519d09d0a836043613%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e4f2a1feebb3f209a0fca82aa53507a5b8be4d53%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -24,6 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:ovl: fix UAF #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21913.md b/2025/CVE-2025-21913.md index cae331fb94..b754de839e 100644 --- a/2025/CVE-2025-21913.md +++ b/2025/CVE-2025-21913.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3fac3734c43a2e21fefeb72124d8bd31dff3956f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:x86/amd_nb: U #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21919.md b/2025/CVE-2025-21919.md index d97c3abe7c..a9eb29967b 100644 --- a/2025/CVE-2025-21919.md +++ b/2025/CVE-2025-21919.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fdaba61ef8a268d4136d0a113d153f7a89eb9984%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:sched/fair: F #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/runwhen-contrib/helm-charts diff --git a/2025/CVE-2025-21925.md b/2025/CVE-2025-21925.md index bcf55a2f45..3ae64032bf 100644 --- a/2025/CVE-2025-21925.md +++ b/2025/CVE-2025-21925.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:llc: do not u #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21926.md b/2025/CVE-2025-21926.md index a67ec063c2..1870124bf6 100644 --- a/2025/CVE-2025-21926.md +++ b/2025/CVE-2025-21926.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ad405857b174ed31a97982bb129c320d03321cf5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: gso: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21938.md b/2025/CVE-2025-21938.md index 6c69aa9e73..495c1d1936 100644 --- a/2025/CVE-2025-21938.md +++ b/2025/CVE-2025-21938.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d045b9eb95a9b611c483897a69e7285aefdc66d7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:mptcp: fix 's #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/oogasawa/Utility-security diff --git a/2025/CVE-2025-21959.md b/2025/CVE-2025-21959.md index fbe120e88d..83a71f4f17 100644 --- a/2025/CVE-2025-21959.md +++ b/2025/CVE-2025-21959.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=75af3d78168e654a5cd8bbc4c774f97be836165f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-21999.md b/2025/CVE-2025-21999.md index 9d99e6292c..f2ceee8d7c 100644 --- a/2025/CVE-2025-21999.md +++ b/2025/CVE-2025-21999.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=97a32539b9568bb653683349e5a76d02ff3c3e2c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:proc: fix UAF #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-22005.md b/2025/CVE-2025-22005.md index d7a4c233c3..d72d2b609e 100644 --- a/2025/CVE-2025-22005.md +++ b/2025/CVE-2025-22005.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7dd73168e273938b9e9bb42ca51b0c27d807992b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: Fix mem #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-22015.md b/2025/CVE-2025-22015.md index a91b40e427..4a416a7b77 100644 --- a/2025/CVE-2025-22015.md +++ b/2025/CVE-2025-22015.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.6.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=be72d197b2281e2ee3f28017fc9be1ab17e26d16%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fc346d0a70a13d52fe1c4bc49516d83a42cd7c4c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:mm/migrate: f #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-22055.md b/2025/CVE-2025-22055.md index 2a54428c86..749bc4a4c4 100644 --- a/2025/CVE-2025-22055.md +++ b/2025/CVE-2025-22055.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0ed5269f9e41f495c8e9020c85f5e1644c1afc57%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: fix gene #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/runwhen-contrib/helm-charts diff --git a/2025/CVE-2025-22056.md b/2025/CVE-2025-22056.md index 442ee8cfc8..2de32f2c43 100644 --- a/2025/CVE-2025-22056.md +++ b/2025/CVE-2025-22056.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=925d844696d9287f841d6b3e0ed62a35fb175970%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-22060.md b/2025/CVE-2025-22060.md index 5baa3417c5..0102b13ec2 100644 --- a/2025/CVE-2025-22060.md +++ b/2025/CVE-2025-22060.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3f518509dedc99f0b755d2ce68d24f610e3a005a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: mvpp2: P #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-22083.md b/2025/CVE-2025-22083.md index d1f01e0014..9067a5b1bf 100644 --- a/2025/CVE-2025-22083.md +++ b/2025/CVE-2025-22083.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4f7f46d32c9875004fae1d57ae3c02cc2e6cd6a3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:vhost-scsi: F #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-22090.md b/2025/CVE-2025-22090.md index ec39a172ea..6210a58230 100644 --- a/2025/CVE-2025-22090.md +++ b/2025/CVE-2025-22090.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.29%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2ab640379a0ab4cef746ced1d7e04a0941774bcb%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:x86/mm/pat: F #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-22095.md b/2025/CVE-2025-22095.md index f653c5cf2b..eed0584284 100644 --- a/2025/CVE-2025-22095.md +++ b/2025/CVE-2025-22095.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9e6be018b26347c26a93e63fb50a37ee2c9311de%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:PCI: brcmstb: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-22105.md b/2025/CVE-2025-22105.md new file mode 100644 index 0000000000..6a6a59813a --- /dev/null +++ b/2025/CVE-2025-22105.md @@ -0,0 +1,20 @@ +### [CVE-2025-22105](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22105) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:bonding: check xdp prog when set bond modeFollowing operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj af_xdp_kern.o sec xdp ip netns exec ns1 ip link set bond0 type bond mode broadcast ip netns del ns1When delete the namespace, dev_xdp_uninstall() is called to remove xdpprogram on bond dev, and bond_xdp_set() will check the bond mode. If bondmode is changed after attaching xdp program, the warning may occur.Some bond modes (broadcast, etc.) do not support native xdp. Set bond modewith xdp program attached is not good. Add check for xdp program when setbond mode. [1] ------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at net/core/dev.c:9912 unregister_netdevice_many_notify+0x8d9/0x930 Modules linked in: CPU: 0 UID: 0 PID: 11 Comm: kworker/u4:0 Not tainted 6.14.0-rc4 #107 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Workqueue: netns cleanup_net RIP: 0010:unregister_netdevice_many_notify+0x8d9/0x930 Code: 00 00 48 c7 c6 6f e3 a2 82 48 c7 c7 d0 b3 96 82 e8 9c 10 3e ... RSP: 0018:ffffc90000063d80 EFLAGS: 00000282 RAX: 00000000ffffffa1 RBX: ffff888004959000 RCX: 00000000ffffdfff RDX: 0000000000000000 RSI: 00000000ffffffea RDI: ffffc90000063b48 RBP: ffffc90000063e28 R08: ffffffff82d39b28 R09: 0000000000009ffb R10: 0000000000000175 R11: ffffffff82d09b40 R12: ffff8880049598e8 R13: 0000000000000001 R14: dead000000000100 R15: ffffc90000045000 FS: 0000000000000000(0000) GS:ffff888007a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000d406b60 CR3: 000000000483e000 CR4: 00000000000006f0 Call Trace: ? __warn+0x83/0x130 ? unregister_netdevice_many_notify+0x8d9/0x930 ? report_bug+0x18e/0x1a0 ? handle_bug+0x54/0x90 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? unregister_netdevice_many_notify+0x8d9/0x930 ? bond_net_exit_batch_rtnl+0x5c/0x90 cleanup_net+0x237/0x3d0 process_one_work+0x163/0x390 worker_thread+0x293/0x3b0 ? __pfx_worker_thread+0x10/0x10 kthread+0xec/0x1e0 ? __pfx_kthread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2f/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 ---[ end trace 0000000000000000 ]--- + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-22107.md b/2025/CVE-2025-22107.md index 74da5842aa..536fd9793d 100644 --- a/2025/CVE-2025-22107.md +++ b/2025/CVE-2025-22107.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6666cebc5e306f49a25bd20aa8c1cb8ef8950df5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: dsa: sja #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-22111.md b/2025/CVE-2025-22111.md index 6061a6a747..d1dfff10c6 100644 --- a/2025/CVE-2025-22111.md +++ b/2025/CVE-2025-22111.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=893b195875340cb44b54c9db99e708145f1210e8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: Remove R #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-22121.md b/2025/CVE-2025-22121.md index 40821eb306..49fc968813 100644 --- a/2025/CVE-2025-22121.md +++ b/2025/CVE-2025-22121.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e50e5129f384ae282adebfb561189cdb19b81cee%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: fix out #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-23131.md b/2025/CVE-2025-23131.md new file mode 100644 index 0000000000..59ce757122 --- /dev/null +++ b/2025/CVE-2025-23131.md @@ -0,0 +1,20 @@ +### [CVE-2025-23131](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23131) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.31%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8511a2728ab82cab398e39d019f5cf1246021c1c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:dlm: prevent NPD when writing a positive value to event_donedo_uevent returns the value written to event_done. In case it is apositive value, new_lockspace would undo all the work, and lockspacewould not be set. __dlm_new_lockspace, however, would treat thatpositive value as a success due to commit 8511a2728ab8 ("dlm: fix usecount with multiple joins").Down the line, device_create_lockspace would pass that NULL lockspace todlm_find_lockspace_local, leading to a NULL pointer dereference.Treating such positive values as successes prevents the problem. Giventhis has been broken for so long, this is unlikely to break userspaceexpectations. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-23136.md b/2025/CVE-2025-23136.md index 3fd030d453..89e19ccb08 100644 --- a/2025/CVE-2025-23136.md +++ b/2025/CVE-2025-23136.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=77e337c6e23e3b9d22e09ffec202a80f755a54c2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:thermal: int3 #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-23143.md b/2025/CVE-2025-23143.md index 9cda985683..45b77f97e3 100644 --- a/2025/CVE-2025-23143.md +++ b/2025/CVE-2025-23143.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.20%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ed07536ed6731775219c1df7fa26a7588753e693%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: Fix null #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-23368.md b/2025/CVE-2025-23368.md index 66dc3ea27a..5c0ffed751 100644 --- a/2025/CVE-2025-23368.md +++ b/2025/CVE-2025-23368.md @@ -8,7 +8,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.3%20EUS%20for%20RHEL%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.1%20for%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.1%20for%20RHEL%209&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.1.7.GA&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.1&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%20Expansion%20Pack&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Process%20Automation%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Single%20Sign-On%207&color=blue) diff --git a/2025/CVE-2025-26466.md b/2025/CVE-2025-26466.md index f9cc3b0b8b..6b45f4b59a 100644 --- a/2025/CVE-2025-26466.md +++ b/2025/CVE-2025-26466.md @@ -8,6 +8,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9.5p1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen) ### Description diff --git a/2025/CVE-2025-29087.md b/2025/CVE-2025-29087.md index 5206f33b8a..642f911cb7 100644 --- a/2025/CVE-2025-29087.md +++ b/2025/CVE-2025-29087.md @@ -1,6 +1,8 @@ ### [CVE-2025-29087](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29087) ![](https://img.shields.io/static/v1?label=Product&message=SQLite&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.44.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-190%20Integer%20Overflow%20or%20Wraparound&color=brightgreen) ### Description diff --git a/2025/CVE-2025-29088.md b/2025/CVE-2025-29088.md index cb23019e36..e533c612e9 100644 --- a/2025/CVE-2025-29088.md +++ b/2025/CVE-2025-29088.md @@ -1,6 +1,8 @@ ### [CVE-2025-29088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29088) ![](https://img.shields.io/static/v1?label=Product&message=SQLite&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.49.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-190%20Integer%20Overflow%20or%20Wraparound&color=brightgreen) ### Description diff --git a/2025/CVE-2025-32728.md b/2025/CVE-2025-32728.md index 3e233099c2..76fae7d71f 100644 --- a/2025/CVE-2025-32728.md +++ b/2025/CVE-2025-32728.md @@ -1,6 +1,7 @@ ### [CVE-2025-32728](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32728) ![](https://img.shields.io/static/v1?label=Product&message=OpenSSH&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=7.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-440%20Expected%20Behavior%20Violation&color=brightgreen) ### Description diff --git a/2025/CVE-2025-3277.md b/2025/CVE-2025-3277.md index bc1c89b16a..239c584fdb 100644 --- a/2025/CVE-2025-3277.md +++ b/2025/CVE-2025-3277.md @@ -1,6 +1,8 @@ ### [CVE-2025-3277](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3277) ![](https://img.shields.io/static/v1?label=Product&message=sqlite&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=%3C%203.49.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-122%20Heap-based%20Buffer%20Overflow&color=brightgreen) ### Description diff --git a/2025/CVE-2025-3360.md b/2025/CVE-2025-3360.md index e0a04f1c85..b72276ba2c 100644 --- a/2025/CVE-2025-3360.md +++ b/2025/CVE-2025-3360.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Integer%20Overflow%20or%20Wraparound&color=brightgreen) ### Description diff --git a/2025/CVE-2025-34158.md b/2025/CVE-2025-34158.md index f2cc18fd87..fcdf427332 100644 --- a/2025/CVE-2025-34158.md +++ b/2025/CVE-2025-34158.md @@ -11,6 +11,7 @@ Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by i #### Reference - https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md +- https://github.com/lufinkey/vulnerability-research/tree/main/CVE-2025-34158 - https://www.bleepingcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerability-immediately/ - https://www.vulncheck.com/advisories/plex-media-server-unspecified diff --git a/2025/CVE-2025-37785.md b/2025/CVE-2025-37785.md index 659c3dc32c..dd951b8dc8 100644 --- a/2025/CVE-2025-37785.md +++ b/2025/CVE-2025-37785.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ac27a0ec112a089f1a5102bc8dffc79c8c815571%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: fix OOB #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/runwhen-contrib/helm-charts diff --git a/2025/CVE-2025-37909.md b/2025/CVE-2025-37909.md index a5c3abe1de..45270c56e3 100644 --- a/2025/CVE-2025-37909.md +++ b/2025/CVE-2025-37909.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=23f0703c125be490f70501b6b24ed5645775c56a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: lan743x: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-37917.md b/2025/CVE-2025-37917.md index f2ef6d3eb1..82a06cf9d3 100644 --- a/2025/CVE-2025-37917.md +++ b/2025/CVE-2025-37917.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=97da99868573b8861de83f7126a5981d896c1d6c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: ethernet #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/runwhen-contrib/helm-charts diff --git a/2025/CVE-2025-37945.md b/2025/CVE-2025-37945.md index 5fe44ab130..026b21243b 100644 --- a/2025/CVE-2025-37945.md +++ b/2025/CVE-2025-37945.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=7dc0ed411de3450e75b2a9600b5742cbf0908167%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -20,6 +21,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: phy: all #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-37959.md b/2025/CVE-2025-37959.md index 991c09512b..603a156011 100644 --- a/2025/CVE-2025-37959.md +++ b/2025/CVE-2025-37959.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9aa1206e8f48222f35a0c809f33b2f4aaa1e2661%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Scrub pa #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/runwhen-contrib/helm-charts diff --git a/2025/CVE-2025-37964.md b/2025/CVE-2025-37964.md index 0ac7219d4f..acb6fd8379 100644 --- a/2025/CVE-2025-37964.md +++ b/2025/CVE-2025-37964.md @@ -11,6 +11,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6db2526c1d694c91c6e05e2f186c085e9460f202%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=848b5815177582de0e1d0118725378e0fbadca20%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a04fe3bfc71e28009e20357b79df1e8ef7c9d600%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b47002ed65ade940839b7f439ff4a194e7d5ec28%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d1347977661342cb09a304a17701eb2d4aa21dec%20&color=brightgreen) @@ -24,6 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:x86/mm: Elimi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-37972.md b/2025/CVE-2025-37972.md index a26000104d..80833bb366 100644 --- a/2025/CVE-2025-37972.md +++ b/2025/CVE-2025-37972.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b581acb49aec5c3b0af9ab1c537fb73481b79069%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:Input: mtk-pm #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-37980.md b/2025/CVE-2025-37980.md index 4be865154a..8e746e69af 100644 --- a/2025/CVE-2025-37980.md +++ b/2025/CVE-2025-37980.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=320ae51feed5c2f13664aa05a76bec198967e04d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:block: fix re #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-38105.md b/2025/CVE-2025-38105.md new file mode 100644 index 0000000000..cd2755aa54 --- /dev/null +++ b/2025/CVE-2025-38105.md @@ -0,0 +1,20 @@ +### [CVE-2025-38105](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38105) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c88469704d63787e8d44ca5ea1c1bd0adc29572d%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ALSA: usb-audio: Kill timer properly at removalThe USB-audio MIDI code initializes the timer, but in a rare case, thedriver might be freed without the disconnect call. This leaves thetimer in an active state while the assigned object is released viasnd_usbmidi_free(), which ends up with a kernel warning when the debugconfiguration is enabled, as spotted by fuzzer.For avoiding the problem, put timer_shutdown_sync() atsnd_usbmidi_free(), so that the timer can be killed properly.While we're at it, replace the existing timer_delete_sync() at thedisconnect callback with timer_shutdown_sync(), too. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-38125.md b/2025/CVE-2025-38125.md index a7b24e54a1..f58bef9f62 100644 --- a/2025/CVE-2025-38125.md +++ b/2025/CVE-2025-38125.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8572aec3d0dc43045254fd1bf581fb980bfdbc4b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: stmmac: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-38162.md b/2025/CVE-2025-38162.md index 4471228c4f..02a3daf1df 100644 --- a/2025/CVE-2025-38162.md +++ b/2025/CVE-2025-38162.md @@ -1,10 +1,12 @@ ### [CVE-2025-38162](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38162) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3c4287f62044a90e73a561aa05fc46e62da173da%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-38192.md b/2025/CVE-2025-38192.md index 82aca014e0..57ec62909b 100644 --- a/2025/CVE-2025-38192.md +++ b/2025/CVE-2025-38192.md @@ -1,10 +1,12 @@ ### [CVE-2025-38192](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38192) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6578171a7ff0c31dc73258f93da7407510abf085%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: clear th #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-38201.md b/2025/CVE-2025-38201.md index bb9951b263..85720f6d03 100644 --- a/2025/CVE-2025-38201.md +++ b/2025/CVE-2025-38201.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-38232.md b/2025/CVE-2025-38232.md index 2747486f7b..d5d18c1e86 100644 --- a/2025/CVE-2025-38232.md +++ b/2025/CVE-2025-38232.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=7c7cb07d4affcf41749234fe9dc4d90cd3959e32%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8677e99150b0830d29cc1318b4cc559e176940bb%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bd5ae9288d6451bd346a1b4a59d4fe7e62ba29b7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -20,6 +21,7 @@ In the Linux kernel, the following vulnerability has been resolved:NFSD: fix rac #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-38250.md b/2025/CVE-2025-38250.md new file mode 100644 index 0000000000..1e000e3c1b --- /dev/null +++ b/2025/CVE-2025-38250.md @@ -0,0 +1,20 @@ +### [CVE-2025-38250](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38250) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=bf18c7118cf83ad4b9aa476354b4a06bcb9d0c4f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: hci_core: Fix use-after-free in vhci_flush()syzbot reported use-after-free in vhci_flush() without repro. [0]From the splat, a thread close()d a vhci file descriptor whileits device was being used by iotcl() on another thread.Once the last fd refcnt is released, vhci_release() callshci_unregister_dev(), hci_free_dev(), and kfree() for structvhci_data, which is set to hci_dev->dev->driver_data.The problem is that there is no synchronisation after unlinkinghdev from hci_dev_list in hci_unregister_dev(). There might beanother thread still accessing the hdev which was fetched beforethe unlink operation.We can use SRCU for such synchronisation.Let's run hci_dev_reset() under SRCU and wait for its completionin hci_unregister_dev().Another option would be to restore hci_dev->destruct(), which wasremoved in commit 587ae086f6e4 ("Bluetooth: Remove unusedhci-destruct cb"). However, this would not be a good solution, aswe should not run hci_unregister_dev() while there are in-flightioctl() requests, which could lead to another data-race KCSAN splat.Note that other drivers seem to have the same problem, for exmaple,virtbt_remove().[0]:BUG: KASAN: slab-use-after-free in skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline]BUG: KASAN: slab-use-after-free in skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937Read of size 8 at addr ffff88807cb8d858 by task syz.1.219/6718CPU: 1 UID: 0 PID: 6718 Comm: syz.1.219 Not tainted 6.16.0-rc1-syzkaller-00196-g08207f42d3ff #0 PREEMPT(full)Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xd2/0x2b0 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline] skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937 skb_queue_purge include/linux/skbuff.h:3368 [inline] vhci_flush+0x44/0x50 drivers/bluetooth/hci_vhci.c:69 hci_dev_do_reset net/bluetooth/hci_core.c:552 [inline] hci_dev_reset+0x420/0x5c0 net/bluetooth/hci_core.c:592 sock_do_ioctl+0xd9/0x300 net/socket.c:1190 sock_ioctl+0x576/0x790 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7fRIP: 0033:0x7fcf5b98e929Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007fcf5c7b9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010RAX: ffffffffffffffda RBX: 00007fcf5bbb6160 RCX: 00007fcf5b98e929RDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000009RBP: 00007fcf5ba10b39 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000R13: 0000000000000000 R14: 00007fcf5bbb6160 R15: 00007ffd6353d528 Allocated by task 6535: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] vhci_open+0x57/0x360 drivers/bluetooth/hci_vhci.c:635 misc_open+0x2bc/0x330 drivers/char/misc.c:161 chrdev_open+0x4c9/0x5e0 fs/char_dev.c:414 do_dentry_open+0xdf0/0x1970 fs/open.c:964 vfs_open+0x3b/0x340 fs/open.c:1094 do_open fs/namei.c:3887 [inline] path_openat+0x2ee5/0x3830 fs/name---truncated--- + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-38322.md b/2025/CVE-2025-38322.md index c15de9c9fc..90119fdcc1 100644 --- a/2025/CVE-2025-38322.md +++ b/2025/CVE-2025-38322.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.6.87%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=781b2db0eb7731fbde510c268b7ccc62959c3feb%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d8370aa704bd7e384918c8f466856374725c0585%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e7f6922c8a5b41522a8329ea6bbf815993b2dd28%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f9bdf1f953392c9edd69a7f884f78c0390127029%20&color=brightgreen) @@ -25,6 +26,7 @@ In the Linux kernel, the following vulnerability has been resolved:perf/x86/inte #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-38584.md b/2025/CVE-2025-38584.md new file mode 100644 index 0000000000..8e743c0d93 --- /dev/null +++ b/2025/CVE-2025-38584.md @@ -0,0 +1,20 @@ +### [CVE-2025-38584](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38584) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=16295bec6398a3eedc9377e1af6ff4c71b98c300%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.34%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:padata: Fix pd UAF once and for allThere is a race condition/UAF in padata_reorder that goes backto the initial commit. A reference count is taken at the startof the process in padata_do_parallel, and released at the end inpadata_serial_worker.This reference count is (and only is) required for padata_replaceto function correctly. If padata_replace is never called thenthere is no issue.In the function padata_reorder which serves as the core of padata,as soon as padata is added to queue->serial.list, and the associatedspin lock released, that padata may be processed and the referencecount on pd would go away.Fix this by getting the next padata before the squeue->serial lockis released.In order to make this possible, simplify padata_reorder by onlycalling it once the next padata arrives. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-38591.md b/2025/CVE-2025-38591.md index 0d321ade36..61a632c02f 100644 --- a/2025/CVE-2025-38591.md +++ b/2025/CVE-2025-38591.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f96da09473b52c09125cc9bf7d7d4576ae8229e0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Reject n #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-38614.md b/2025/CVE-2025-38614.md index 8cdf369bf8..d91d5d6d54 100644 --- a/2025/CVE-2025-38614.md +++ b/2025/CVE-2025-38614.md @@ -15,6 +15,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8216e1a0d47cae06a75c42346f19dffe14e42d57%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a72affdbb09f3f24f64ffcbbdf62c2e57c58f379%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -27,6 +28,7 @@ In the Linux kernel, the following vulnerability has been resolved:eventpoll: Fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-38681.md b/2025/CVE-2025-38681.md index 42cac7af25..951ad99669 100644 --- a/2025/CVE-2025-38681.md +++ b/2025/CVE-2025-38681.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bbd6ec605c0fc286c3f8ce60b4ed44635361d58b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:mm/ptdump: ta #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-38704.md b/2025/CVE-2025-38704.md index 85e1974da8..2e7f915845 100644 --- a/2025/CVE-2025-38704.md +++ b/2025/CVE-2025-38704.md @@ -1,10 +1,12 @@ ### [CVE-2025-38704](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38704) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3a5761dc025da47960755ac64d9fbf1c32e8cd80%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:rcu/nocb: Fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-38721.md b/2025/CVE-2025-38721.md index 8a10e4019f..dfa56e25f3 100644 --- a/2025/CVE-2025-38721.md +++ b/2025/CVE-2025-38721.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d205dc40798d97d63ad348bfaf7394f445d152d4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -17,6 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: ct #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-38725.md b/2025/CVE-2025-38725.md index 2f314a9022..76efb4bf0d 100644 --- a/2025/CVE-2025-38725.md +++ b/2025/CVE-2025-38725.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e532a096be0e5e570b383e71d4560e7f04384e0f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: usb: asi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-38727.md b/2025/CVE-2025-38727.md index 1a8ef2907e..d8184344a9 100644 --- a/2025/CVE-2025-38727.md +++ b/2025/CVE-2025-38727.md @@ -16,6 +16,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=9da025150b7c14a8390fc06aea314c0a4011e82c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ae8f160e7eb24240a2a79fc4c815c6a0d4ee16cc%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c4ceaac5c5ba0b992ee1dc88e2a02421549e5c98%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cd7ff61bfffd7000143c42bbffb85eeb792466d6%20&color=brightgreen) @@ -31,6 +32,7 @@ In the Linux kernel, the following vulnerability has been resolved:netlink: avoi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-38732.md b/2025/CVE-2025-38732.md index da691d8bd1..e680991d98 100644 --- a/2025/CVE-2025-38732.md +++ b/2025/CVE-2025-38732.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f53b9b0bdc59c0823679f2e3214e0d538f5951b9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-38736.md b/2025/CVE-2025-38736.md index c5760f161f..d745173abe 100644 --- a/2025/CVE-2025-38736.md +++ b/2025/CVE-2025-38736.md @@ -8,6 +8,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.16.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=75947d3200de98a9ded9ad8972e02f1a177097fe%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a754ab53993b1585132e871c5d811167ad3c52ff%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ad1f8313aeec0115f9978bd2d002ef4a8d96c773%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ccef5ee4adf56472aa26bdd1f821a6d0cd06089a%20&color=brightgreen) @@ -22,6 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: usb: asi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39681.md b/2025/CVE-2025-39681.md index 44c012fde8..d9e6174bc5 100644 --- a/2025/CVE-2025-39681.md +++ b/2025/CVE-2025-39681.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=923f3a2b48bdccb6a1d1f0dd48de03de7ad936d9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:x86/cpu/hygon #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39691.md b/2025/CVE-2025-39691.md index 83e44889be..153cf044cc 100644 --- a/2025/CVE-2025-39691.md +++ b/2025/CVE-2025-39691.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs/buffer: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39721.md b/2025/CVE-2025-39721.md index 0f2a5bbddc..d4ba8e693d 100644 --- a/2025/CVE-2025-39721.md +++ b/2025/CVE-2025-39721.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e5745f34113b758b45d134dec04a7df94dc67131%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: qat - #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-39748.md b/2025/CVE-2025-39748.md index b38e3f09fe..4696580bfc 100644 --- a/2025/CVE-2025-39748.md +++ b/2025/CVE-2025-39748.md @@ -1,10 +1,12 @@ ### [CVE-2025-39748](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39748) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=960ea056561a08e2b837b2f02d22c53226414a84%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Forget r #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-39756.md b/2025/CVE-2025-39756.md index 3265db3ac0..cdc798f0be 100644 --- a/2025/CVE-2025-39756.md +++ b/2025/CVE-2025-39756.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=9cfe015aa424b3c003baba3841a60dd9b5ad319b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -17,6 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs: Prevent f #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39764.md b/2025/CVE-2025-39764.md index bab4ddbf34..bc701631ba 100644 --- a/2025/CVE-2025-39764.md +++ b/2025/CVE-2025-39764.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.23%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cf6994c2b9812a9f02b99e89df411ffc5db9c779%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: ct #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-39770.md b/2025/CVE-2025-39770.md index 71c56b81fd..d062c51c1f 100644 --- a/2025/CVE-2025-39770.md +++ b/2025/CVE-2025-39770.md @@ -16,6 +16,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=9f605135a5c0fe614c2b15197b9ced1e217eca59%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a27a5c40ee4cbe00294e2c76160de5f2589061ba%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a84978a9cda68f0afe3f01d476c68db21526baf1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bcefc3cd7f592a70fcbbbfd7ad1fbc69172ea78b%20&color=brightgreen) @@ -31,6 +32,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: gso: For #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39773.md b/2025/CVE-2025-39773.md index 91b987f6be..ad63dc781e 100644 --- a/2025/CVE-2025-39773.md +++ b/2025/CVE-2025-39773.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.34%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d902eee43f1951b358d7347d9165c6af21cf7b1b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -17,6 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: bridge: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39782.md b/2025/CVE-2025-39782.md index 4ec6923bb5..57ec17cdbc 100644 --- a/2025/CVE-2025-39782.md +++ b/2025/CVE-2025-39782.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.16%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f93ea411b73594f7d144855fd34278bcf34a9afc%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:jbd2: prevent #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39795.md b/2025/CVE-2025-39795.md index d9464237cf..41383611c3 100644 --- a/2025/CVE-2025-39795.md +++ b/2025/CVE-2025-39795.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -17,6 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:block: avoid #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39826.md b/2025/CVE-2025-39826.md index 25cb21ff3f..dc16b110e8 100644 --- a/2025/CVE-2025-39826.md +++ b/2025/CVE-2025-39826.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: rose: co #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39827.md b/2025/CVE-2025-39827.md index 119384ad09..287a0d8b4c 100644 --- a/2025/CVE-2025-39827.md +++ b/2025/CVE-2025-39827.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: rose: in #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39845.md b/2025/CVE-2025-39845.md index 1ed12d66d7..164614ce10 100644 --- a/2025/CVE-2025-39845.md +++ b/2025/CVE-2025-39845.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8d400913c231bd1da74067255816453f96cd35b0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:x86/mm/64: de #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39863.md b/2025/CVE-2025-39863.md index fc0f1bd0f7..6d0f38bc8b 100644 --- a/2025/CVE-2025-39863.md +++ b/2025/CVE-2025-39863.md @@ -1,6 +1,7 @@ ### [CVE-2025-39863](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39863) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=61730d4dfffc2cc9d3a49fad87633008105c18ba%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:wifi: brcmfma ### POC #### Reference -No PoCs from references. +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-39866.md b/2025/CVE-2025-39866.md index d21a618521..3dacf4a9f3 100644 --- a/2025/CVE-2025-39866.md +++ b/2025/CVE-2025-39866.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -17,6 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs: writeback #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/byteReaper77/CVE-2025-39866 diff --git a/2025/CVE-2025-39871.md b/2025/CVE-2025-39871.md index 8d40c710a1..e83ff56aca 100644 --- a/2025/CVE-2025-39871.md +++ b/2025/CVE-2025-39871.md @@ -10,6 +10,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.6.92%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=68ac5a01f635b3791196fd1c39bc48497252c36f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d2d05fd0fc95c4defed6f7b87550e20e8baa1d97%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d5449ff1b04dfe9ed8e455769aa01e4c2ccf6805%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -22,6 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:dmaengine: id #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-39931.md b/2025/CVE-2025-39931.md index c58736c654..3fe1d2fc39 100644 --- a/2025/CVE-2025-39931.md +++ b/2025/CVE-2025-39931.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8ff590903d5fc7f5a0a988c38267a3d08e6393a2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: af_al #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-39953.md b/2025/CVE-2025-39953.md index a434972e47..cf43f72d80 100644 --- a/2025/CVE-2025-39953.md +++ b/2025/CVE-2025-39953.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=334c3679ec4b2b113c35ebe37d2018b112dd5013%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:cgroup: split #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-39955.md b/2025/CVE-2025-39955.md index 6c7365c486..36cc36abf5 100644 --- a/2025/CVE-2025-39955.md +++ b/2025/CVE-2025-39955.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8336886f786fdacbc19b719c1f7ea91eb70706d4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:tcp: Clear tc #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-39964.md b/2025/CVE-2025-39964.md index f923500c8b..ce22aabe1b 100644 --- a/2025/CVE-2025-39964.md +++ b/2025/CVE-2025-39964.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.38%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8ff590903d5fc7f5a0a988c38267a3d08e6393a2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: af_al #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-39977.md b/2025/CVE-2025-39977.md index 252530d127..5127d4c60b 100644 --- a/2025/CVE-2025-39977.md +++ b/2025/CVE-2025-39977.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:futex: Preven #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-39978.md b/2025/CVE-2025-39978.md index b681b1f734..b722f473c3 100644 --- a/2025/CVE-2025-39978.md +++ b/2025/CVE-2025-39978.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=68fbff68dbea35f9e6f7649dd22fce492a5aedac%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:octeontx2-pf: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-39980.md b/2025/CVE-2025-39980.md index 89af735377..8f8ba4a6a0 100644 --- a/2025/CVE-2025-39980.md +++ b/2025/CVE-2025-39980.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=38428d68719c454d269cb03b776d8a4b0ad66111%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:nexthop: Forb #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-39997.md b/2025/CVE-2025-39997.md new file mode 100644 index 0000000000..c69a7f759a --- /dev/null +++ b/2025/CVE-2025-39997.md @@ -0,0 +1,27 @@ +### [CVE-2025-39997](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39997) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=06513dd6d32c37d0364db8488cfdf3e14da238a8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0718a78f6a9f04b88d0dc9616cc216b31c5f3cf1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.167%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.15.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=62066758d2ae169278e5d6aea5995b1b6f6ddeb5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=647410a7da46067953a53c0d03f8680eff570959%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c611b9e55174e439dcd85a72969b43a95f3827a4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=efaf61052b8ff9ee8968912fbaf02c2847c78ede%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_freeThe previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer properly atremoval") patched a UAF issue caused by the error timer.However, because the error timer kill added in this patch occurs after theendpoint delete, a race condition to UAF still occurs, albeit rarely.Additionally, since kill-cleanup for urb is also missing, freed memory canbe accessed in interrupt context related to urb, which can cause UAF.Therefore, to prevent this, error timer and urb must be killed beforefreeing the heap memory. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-40022.md b/2025/CVE-2025-40022.md index 2761c97cb3..f08356f28e 100644 --- a/2025/CVE-2025-40022.md +++ b/2025/CVE-2025-40022.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=9aee87da5572b3a14075f501752e209801160d3d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e4c1ec11132ec466f7362a95f36a506ce4dc08c9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -24,6 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: af_al #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-40070.md b/2025/CVE-2025-40070.md index 4749b2e5a9..b064ef1137 100644 --- a/2025/CVE-2025-40070.md +++ b/2025/CVE-2025-40070.md @@ -15,6 +15,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=85241f7de216f8298f6e48540ea13d7dcd100870%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=91932db1d96b2952299ce30c1c693d834d10ace6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c4041b6b0a7a3def8cf3f3d6120ff337bc4c40f7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c79a39dc8d060b9e64e8b0fa9d245d44befeefbe%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cd3bbcb6b3a7caa5ce67de76723b6d8531fb7f64%20&color=brightgreen) @@ -28,6 +29,7 @@ In the Linux kernel, the following vulnerability has been resolved:pps: fix warn #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-40078.md b/2025/CVE-2025-40078.md index 2ca8c3e60c..055a4457a6 100644 --- a/2025/CVE-2025-40078.md +++ b/2025/CVE-2025-40078.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1cedee13d25ab118d325f95588c1a084e9317229%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Explicit #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-40080.md b/2025/CVE-2025-40080.md index 4644142250..73e0b82e68 100644 --- a/2025/CVE-2025-40080.md +++ b/2025/CVE-2025-40080.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.3.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cf1b2326b734896734c6e167e41766f9cee7686a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -20,6 +21,7 @@ In the Linux kernel, the following vulnerability has been resolved:nbd: restrict #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-40105.md b/2025/CVE-2025-40105.md index 6a3b76935c..f084d761c8 100644 --- a/2025/CVE-2025-40105.md +++ b/2025/CVE-2025-40105.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.16%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f1ee616214cb22410e939d963bbb2349c2570f02%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:vfs: Don't le #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-40149.md b/2025/CVE-2025-40149.md index c252279d67..cacc4d2b5d 100644 --- a/2025/CVE-2025-40149.md +++ b/2025/CVE-2025-40149.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e8f69799810c32dd40c6724d829eccc70baad07f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:tls: Use __sk #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-40196.md b/2025/CVE-2025-40196.md index 17ce026f09..deb4d96a12 100644 --- a/2025/CVE-2025-40196.md +++ b/2025/CVE-2025-40196.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6f3821acd7c3143145999248087de5fb4b48cf26%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8ea87e34792258825d290f4dc5216276e91cb224%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a5abba5e0e586e258ded3e798fe5f69c66fec198%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ab6cfcf8ed2c7496f55d020b65b1d8cd55d9a2cb%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ac6f420291b3fee1113f21d612fa88b628afab5b%20&color=brightgreen) @@ -26,6 +27,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs: quota: cr #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-40219.md b/2025/CVE-2025-40219.md index 6bf5ee4ff5..fd967cf7ca 100644 --- a/2025/CVE-2025-40219.md +++ b/2025/CVE-2025-40219.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:PCI/IOV: Fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-40261.md b/2025/CVE-2025-40261.md index b822f3261c..dc05496d19 100644 --- a/2025/CVE-2025-40261.md +++ b/2025/CVE-2025-40261.md @@ -7,6 +7,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f1cd8c40936ff2b560e1f35159dd6a4602b558e5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -20,6 +21,7 @@ In the Linux kernel, the following vulnerability has been resolved:nvme: nvme-fc - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-40300.md b/2025/CVE-2025-40300.md index 3c625c163f..9d78abeb35 100644 --- a/2025/CVE-2025-40300.md +++ b/2025/CVE-2025-40300.md @@ -8,6 +8,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.4.168%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4b3870c343a82cd2df7192cc5149c87205dcc611%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c51f1e5f57cca88d8d5894b6fad1638f643a99d0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -19,6 +20,7 @@ In the Linux kernel, the following vulnerability has been resolved:x86/vmscape: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-4953.md b/2025/CVE-2025-4953.md index 07c0003972..1d6d890824 100644 --- a/2025/CVE-2025-4953.md +++ b/2025/CVE-2025-4953.md @@ -2,7 +2,6 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.12&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.13&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.14&color=blue) diff --git a/2025/CVE-2025-57310.md b/2025/CVE-2025-57310.md new file mode 100644 index 0000000000..c9934c38d3 --- /dev/null +++ b/2025/CVE-2025-57310.md @@ -0,0 +1,17 @@ +### [CVE-2025-57310](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57310) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code. + +### POC + +#### Reference +- https://gist.github.com/MMAKINGDOM/a6c2c8c70145cbea4e119525651e9a8d + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-57798.md b/2025/CVE-2025-57798.md new file mode 100644 index 0000000000..082dbf6200 --- /dev/null +++ b/2025/CVE-2025-57798.md @@ -0,0 +1,17 @@ +### [CVE-2025-57798](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57798) +![](https://img.shields.io/static/v1?label=Product&message=joplin&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.7.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen) + +### Description + +Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service (DoS) vulnerability in the title input functionality due to a lack of proper length validation. This flaw allows an attacker to cause an Out Of Memory (OOM) error and subsequent program termination by inserting an excessively long string into a note's title. This can be triggered either through direct user interface (UI) input or programmatically via the local web service API after compromising an authentication token. There are 2 primary methods of exploitation: via User Interface (UI) Input, and the Local Web Service API. A local user can directly type or paste an extremely long string into the title field when creating or editing a note Joplin runs a local web service (typically on port 41184) that allows programmatic interaction, such as creating or editing notes via HTTP API calls. If an attacker manages to exfiltrate or compromise the user's authentication token (e.g., through malware on the local system, or other local vulnerabilities), they can then send a crafted HTTP POST request to this local API. By including an excessively long string in the title parameter of this request, the application will attempt to allocate an unbounded amount of memory. This issue has been patched in version 3.7.1. + +### POC + +#### Reference +- https://github.com/laurent22/joplin/security/advisories/GHSA-6jm8-gr87-q69x + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-59953.md b/2025/CVE-2025-59953.md new file mode 100644 index 0000000000..fa068b312b --- /dev/null +++ b/2025/CVE-2025-59953.md @@ -0,0 +1,17 @@ +### [CVE-2025-59953](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59953) +![](https://img.shields.io/static/v1?label=Product&message=lmdeploy&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.9.1%2C%20%3C%200.10.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-502%3A%20Deserialization%20of%20Untrusted%20Data&color=brightgreen) + +### Description + +LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.1 and prior to version 0.10.2, the LMdeploy implements an rpc server (AsyncRPCServer in zmq_rpc.py) for supporting the RPC communications. In its core functionality call_and_response(), I found it will directly use the pickles.loads() to deserialize the received messages without any sanitization, hence resulting in a remote code execution vulnerability by this RPC server. Version 0.10.2 contains a patch. + +### POC + +#### Reference +- https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-61984.md b/2025/CVE-2025-61984.md index 866c75558e..da70321229 100644 --- a/2025/CVE-2025-61984.md +++ b/2025/CVE-2025-61984.md @@ -2,6 +2,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=OpenSSH&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-159%20Improper%20Handling%20of%20Invalid%20Use%20of%20Special%20Elements&color=brightgreen) ### Description @@ -14,6 +15,7 @@ ssh in OpenSSH before 10.1 allows control characters in usernames that originate - http://www.openwall.com/lists/oss-security/2025/10/07/1 - http://www.openwall.com/lists/oss-security/2025/10/12/1 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html - https://dgl.cx/2025/10/bash-a-newline-ssh-proxycommand-cve-2025-61984 - https://www.vicarius.io/vsociety/posts/cve-2025-61984-detection-script-remote-code-execution-vulnerability-affecting-openssh - https://www.vicarius.io/vsociety/posts/cve-2025-61984-mitigation-script-remote-code-execution-vulnerability-affecting-openssh diff --git a/2025/CVE-2025-61985.md b/2025/CVE-2025-61985.md index 1e8ad93a80..8a905e420e 100644 --- a/2025/CVE-2025-61985.md +++ b/2025/CVE-2025-61985.md @@ -2,6 +2,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=OpenSSH&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-158%20Improper%20Neutralization%20of%20Null%20Byte%20or%20NUL%20Character&color=brightgreen) ### Description @@ -12,6 +13,7 @@ ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potential #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-63607.md b/2025/CVE-2025-63607.md new file mode 100644 index 0000000000..bb8a0e8347 --- /dev/null +++ b/2025/CVE-2025-63607.md @@ -0,0 +1,17 @@ +### [CVE-2025-63607](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-63607) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser. + +### POC + +#### Reference +- https://gist.github.com/7Horrus/7c419516b064f6bac638736819e24583 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-63745.md b/2025/CVE-2025-63745.md index 7698f5a4b5..c10c3b6ca4 100644 --- a/2025/CVE-2025-63745.md +++ b/2025/CVE-2025-63745.md @@ -11,6 +11,7 @@ A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and ear #### Reference - https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-001-radare2-nullptr-deref-bin_ne.md +- https://github.com/marlinkcyber/advisories/blob/main/advisories/radare2-nullptr-deref-bin_ne.md #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-63842.md b/2025/CVE-2025-63842.md new file mode 100644 index 0000000000..82b3476a39 --- /dev/null +++ b/2025/CVE-2025-63842.md @@ -0,0 +1,17 @@ +### [CVE-2025-63842](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-63842) +![](https://img.shields.io/static/v1?label=Product&message=web%20backend&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20(XSS%20or%20'Cross-site%20Scripting')&color=brightgreen) + +### Description + +A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field. + +### POC + +#### Reference +- https://github.com/ciernyvlk/CVE/blob/main/CVE-2025-63842.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-63878.md b/2025/CVE-2025-63878.md new file mode 100644 index 0000000000..f4b46adec2 --- /dev/null +++ b/2025/CVE-2025-63878.md @@ -0,0 +1,17 @@ +### [CVE-2025-63878](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-63878) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page. + +### POC + +#### Reference +- https://github.com/rumanaemu/CVE-Research/blob/main/CVE-2025-63878.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-68206.md b/2025/CVE-2025-68206.md index b5bd7000e6..3eddad4a6b 100644 --- a/2025/CVE-2025-68206.md +++ b/2025/CVE-2025-68206.md @@ -1,10 +1,12 @@ ### [CVE-2025-68206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68206) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1a64edf54f55d7956cf5a0d95898bc1f84f9b818%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68239.md b/2025/CVE-2025-68239.md new file mode 100644 index 0000000000..dce279209c --- /dev/null +++ b/2025/CVE-2025-68239.md @@ -0,0 +1,32 @@ +### [CVE-2025-68239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68239) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3fe116e33a855bbfdd32dc207e9be2a41e3ed3a6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.14.226%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19.181%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.9.262%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=467a50d5db7deaf656e18a1f633be9ecd94b393a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4a8b4124ea4156ca52918b66c750a69c6d932aa5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.24%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.11.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.106%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5ab9464a2a3c538eedbb438f1802f2fd98d0953f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c0e0ab60d0b15469e69db93215dad009999f5a5b%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d28492be82e19fc69cc69975fc2052b37ef0c821%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e7850f4d844e0acfac7e570af611d89deade3146%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:binfmt_misc: restore write access before closing files opened by open_exec()bm_register_write() opens an executable file using open_exec(), whichinternally calls do_open_execat() and denies write access on the file toavoid modification while it is being executed.However, when an error occurs, bm_register_write() closes the file usingfilp_close() directly. This does not restore the write permission, whichmay cause subsequent write operations on the same file to fail.Fix this by calling exe_file_allow_write_access() before filp_close() torestore the write permission properly. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-68261.md b/2025/CVE-2025-68261.md index 122e3e576d..ced39a987c 100644 --- a/2025/CVE-2025-68261.md +++ b/2025/CVE-2025-68261.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=7cf6b709b6412afd1d93b2c4b37163c3602e3b95%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9b06cce3ca4d60d442c39bfa7c058b71b1cee6c2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c755e251357a0cee0679081f08c3f4ba797a8009%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=da1e40237f8f3516581b534c484c236a79ccfd14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -24,6 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: add i_d #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68264.md b/2025/CVE-2025-68264.md index b123fa94d8..5ddd765f86 100644 --- a/2025/CVE-2025-68264.md +++ b/2025/CVE-2025-68264.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=67cf5b09a46f72e048501b84996f2f77bc42e947%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: refresh #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68265.md b/2025/CVE-2025-68265.md index 4af14a3fdd..3d7878de2a 100644 --- a/2025/CVE-2025-68265.md +++ b/2025/CVE-2025-68265.md @@ -1,9 +1,11 @@ ### [CVE-2025-68265](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68265) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fe60e8c534118a288cd251a59d747cbf5c03e160%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:nvme: fix adm #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68266.md b/2025/CVE-2025-68266.md index 6e88307a6b..f4d09d7dea 100644 --- a/2025/CVE-2025-68266.md +++ b/2025/CVE-2025-68266.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:bfs: Reconstr #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68291.md b/2025/CVE-2025-68291.md index f0fcc03fc9..ae42404e40 100644 --- a/2025/CVE-2025-68291.md +++ b/2025/CVE-2025-68291.md @@ -7,6 +7,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.6.119%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9ea05fabce31ff93a0adae8221c58bc6d7b832f3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ae155060247be8dcae3802a95bd1bdf93ab3215d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c4f7b0916b95fd2226e5ab98882482b08f52e1c0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f6fb2cbc91a81178dea23d463503b4525a76825d%20&color=brightgreen) @@ -20,6 +21,7 @@ In the Linux kernel, the following vulnerability has been resolved:mptcp: Initia #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68337.md b/2025/CVE-2025-68337.md index 23c8640a77..660be3c9d1 100644 --- a/2025/CVE-2025-68337.md +++ b/2025/CVE-2025-68337.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=470decc613ab2048b619a01028072d932d9086ee%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:jbd2: avoid b #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68349.md b/2025/CVE-2025-68349.md index cc82c18892..9954d1d140 100644 --- a/2025/CVE-2025-68349.md +++ b/2025/CVE-2025-68349.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fe1cf9469d7bcb6af27e42eb555a41b0135bce4a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:NFSv4/pNFS: C #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68363.md b/2025/CVE-2025-68363.md index 50a1c08857..cbc8a98cc4 100644 --- a/2025/CVE-2025-68363.md +++ b/2025/CVE-2025-68363.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=34b2021cc61642d61c3cf943d9e71925b827941b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Check sk #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68371.md b/2025/CVE-2025-68371.md index 6c6739dfad..943eee7e05 100644 --- a/2025/CVE-2025-68371.md +++ b/2025/CVE-2025-68371.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2d80f4054f7f901b8ad97358a9069616ac8524c7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:scsi: smartpq #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68724.md b/2025/CVE-2025-68724.md index 04c86dacbe..f3481fcfea 100644 --- a/2025/CVE-2025-68724.md +++ b/2025/CVE-2025-68724.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7901c1a8effbe5f89673bfc09d6e37b8f334f1a7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: asymm #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68725.md b/2025/CVE-2025-68725.md index 1c02ef1fb1..4d7afd5bed 100644 --- a/2025/CVE-2025-68725.md +++ b/2025/CVE-2025-68725.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=850a88cc4096fe1df407452ba2e4d28cf5b3eee9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Do not l #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68742.md b/2025/CVE-2025-68742.md index 6ff702027c..fff70ee9f9 100644 --- a/2025/CVE-2025-68742.md +++ b/2025/CVE-2025-68742.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=492ecee892c2a4ba6a14903d5d586ff750b7e805%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Fix inva #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68764.md b/2025/CVE-2025-68764.md index 4ea90d42a5..851adf66d9 100644 --- a/2025/CVE-2025-68764.md +++ b/2025/CVE-2025-68764.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f2aedb713c284429987dc66c7aaf38decfc8da2a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:NFS: Automoun #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68773.md b/2025/CVE-2025-68773.md index a041eac542..98d789c565 100644 --- a/2025/CVE-2025-68773.md +++ b/2025/CVE-2025-68773.md @@ -16,6 +16,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=60afe299bb541a928ba39bcb4ae8d3e428d1c5a5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7f6738e003b364783f3019fdf6e7645bc8dd1643%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b558275c1b040f0e5aa56c862241f9212b6118c3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b9d9e8856f1c83e4277403f9b4c369b322ebcb12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=dc120f2d35b030390a2bc0f94dd5f37e900cae91%20&color=brightgreen) @@ -30,6 +31,7 @@ In the Linux kernel, the following vulnerability has been resolved:spi: fsl-cpm: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68776.md b/2025/CVE-2025-68776.md index 04355f32da..55b9a18c29 100644 --- a/2025/CVE-2025-68776.md +++ b/2025/CVE-2025-68776.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f266a683a4804dc499efc6c2206ef68efed029d0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/hsr: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68782.md b/2025/CVE-2025-68782.md index 0d80111a01..f09c99906c 100644 --- a/2025/CVE-2025-68782.md +++ b/2025/CVE-2025-68782.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9e95fb805dc043cc8ed878a08d1583e4097a5f80%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:scsi: target: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68787.md b/2025/CVE-2025-68787.md index a489cf47a3..3c75c13fe0 100644 --- a/2025/CVE-2025-68787.md +++ b/2025/CVE-2025-68787.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netrom: Fix m #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68788.md b/2025/CVE-2025-68788.md index e7337b5b7b..9ee4ecdce8 100644 --- a/2025/CVE-2025-68788.md +++ b/2025/CVE-2025-68788.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.36%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=72acc854427948efed7a83da27f7dc3239ac9afc%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:fsnotify: do #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68798.md b/2025/CVE-2025-68798.md index ae51bb8f27..129f3c7325 100644 --- a/2025/CVE-2025-68798.md +++ b/2025/CVE-2025-68798.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ada543459cab7f653dcacdaba4011a8bb19c627c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:perf/x86/amd: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68803.md b/2025/CVE-2025-68803.md index ef2c5a4421..11333564f5 100644 --- a/2025/CVE-2025-68803.md +++ b/2025/CVE-2025-68803.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.15.154%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c0cbe70742f4a70893cd6e5f6b10b6e89b6db95b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c5409ce523af40d5c3019717bc5b4f72038d48be%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d52acd23a327cada5fb597591267cfc09f08bb1d%20&color=brightgreen) @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:NFSD: NFSv4 f #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68814.md b/2025/CVE-2025-68814.md index bc8c1a8162..6bd7cdc012 100644 --- a/2025/CVE-2025-68814.md +++ b/2025/CVE-2025-68814.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b9445598d8c60a1379887b957024b71343965f74%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:io_uring: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68816.md b/2025/CVE-2025-68816.md index bd4c390a87..5c0dae7432 100644 --- a/2025/CVE-2025-68816.md +++ b/2025/CVE-2025-68816.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=70dd6fdb8987b14f7b6105f6be0617299e459398%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/mlx5: fw_ #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68818.md b/2025/CVE-2025-68818.md index 96a9d6ca5d..6133c9a9de 100644 --- a/2025/CVE-2025-68818.md +++ b/2025/CVE-2025-68818.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9189f20b4c5307c0998682bb522e481b4567a8b8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cd0a1804ac5bab2545ac700c8d0fe9ae9284c567%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d6f7377528d2abf338e504126e44439541be8f7d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -24,6 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:scsi: Revert #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-68820.md b/2025/CVE-2025-68820.md index 65522d025e..e9f2d2497c 100644 --- a/2025/CVE-2025-68820.md +++ b/2025/CVE-2025-68820.md @@ -16,6 +16,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=76c365fa7e2a8bb85f0190cdb4b8cdc99b2fdce3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=836e625b03a666cf93ff5be328c8cb30336db872%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c8e008b60492cf6fd31ef127aea6d02fd3d314cd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cf9291a3449b04688b81e32621e88de8f4314b54%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=eb59cc31b6ea076021d14b04e7faab1636b87d0e%20&color=brightgreen) @@ -30,6 +31,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: xattr: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-69196.md b/2025/CVE-2025-69196.md new file mode 100644 index 0000000000..b729d0c533 --- /dev/null +++ b/2025/CVE-2025-69196.md @@ -0,0 +1,18 @@ +### [CVE-2025-69196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69196) +![](https://img.shields.io/static/v1?label=Product&message=fastmcp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.14.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2. + +### POC + +#### Reference +- https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-5h2m-4q8j-pqpj + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-69206.md b/2025/CVE-2025-69206.md new file mode 100644 index 0000000000..bc08fc6d35 --- /dev/null +++ b/2025/CVE-2025-69206.md @@ -0,0 +1,17 @@ +### [CVE-2025-69206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69206) +![](https://img.shields.io/static/v1?label=Product&message=Hemmelig.app&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%207.3.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Hemmelig is a messing app with with client-side encryption and self-destructing messages. Prior to version 7.3.3, a Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding or open redirect services. This allows an authenticated user to make the server initiate HTTP requests to internal network resources. Version 7.3.3 contains a patch for the issue. + +### POC + +#### Reference +- https://github.com/HemmeligOrg/Hemmelig.app/security/advisories/GHSA-vvxf-wj5w-6gj5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-70873.md b/2025/CVE-2025-70873.md index 90fb635cfb..b648b0e6d7 100644 --- a/2025/CVE-2025-70873.md +++ b/2025/CVE-2025-70873.md @@ -1,5 +1,6 @@ ### [CVE-2025-70873](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-70873) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) diff --git a/2025/CVE-2025-71064.md b/2025/CVE-2025-71064.md index d2d916de45..f97934e4fb 100644 --- a/2025/CVE-2025-71064.md +++ b/2025/CVE-2025-71064.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.16%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e2cb1dec9779ba2d89302a653eb0abaeb8682196%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: hns3: us #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71075.md b/2025/CVE-2025-71075.md index e43f34905f..0842d893bf 100644 --- a/2025/CVE-2025-71075.md +++ b/2025/CVE-2025-71075.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2908d778ab3e244900c310974e1fc1c69066e450%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:scsi: aic94xx #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71079.md b/2025/CVE-2025-71079.md index e3cff4f738..e146a20f8e 100644 --- a/2025/CVE-2025-71079.md +++ b/2025/CVE-2025-71079.md @@ -16,6 +16,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=73a0d12114b4bc1a9def79a623264754b9df698e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8a9c61c3ef187d8891225f9b932390670a43a0d3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c45cea83e13699bdfd47842e04d09dd43af4c371%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ff169909eac9e00bf1aa0af739ba6ddfb1b1d135%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -28,6 +29,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: nfc: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71085.md b/2025/CVE-2025-71085.md index ef3b8dfa10..fee508b3a8 100644 --- a/2025/CVE-2025-71085.md +++ b/2025/CVE-2025-71085.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: BUG() i #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71086.md b/2025/CVE-2025-71086.md index 540d2e327a..6346166d32 100644 --- a/2025/CVE-2025-71086.md +++ b/2025/CVE-2025-71086.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=64b8bc7d5f1434c636a40bdcfcd42b278d1714be%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b10265532df7bc3666bc53261b7f03f0fd14b1c9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bd7de4734535140fda33240c2335a07fdab6f88e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c0e527c532a07556ca44642f5873b002c44da22c%20&color=brightgreen) @@ -26,6 +27,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: rose: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71088.md b/2025/CVE-2025-71088.md index 62bc31d08c..92ac1ffeae 100644 --- a/2025/CVE-2025-71088.md +++ b/2025/CVE-2025-71088.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.1.110%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:mptcp: fallba #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71095.md b/2025/CVE-2025-71095.md index 664396e56f..d7ef71b2b8 100644 --- a/2025/CVE-2025-71095.md +++ b/2025/CVE-2025-71095.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bba2556efad66e7eaa56fece13f7708caa1187f8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: stmmac: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71097.md b/2025/CVE-2025-71097.md index f2762d5307..9750727f9e 100644 --- a/2025/CVE-2025-71097.md +++ b/2025/CVE-2025-71097.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=493ced1ac47c48bb86d9d4e8e87df8592be85a0e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv4: Fix ref #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71098.md b/2025/CVE-2025-71098.md index c9180aeff6..3e59b0ac62 100644 --- a/2025/CVE-2025-71098.md +++ b/2025/CVE-2025-71098.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c12b395a46646bab69089ce7016ac78177f6001f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ip6_gre: make #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71104.md b/2025/CVE-2025-71104.md index a935254d84..7f336027d8 100644 --- a/2025/CVE-2025-71104.md +++ b/2025/CVE-2025-71104.md @@ -7,6 +7,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=421e1fadb0b0a648cc75afd5b3c826fa7daeaffc%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5a69b7b69beae9bb86e7e1b095685087976cba47%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d8f2f498d9ed0c5010bc1bbc1146f94c8bf9f8cc%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:KVM: x86: Fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71112.md b/2025/CVE-2025-71112.md index 15507466ae..7943ff6f4a 100644 --- a/2025/CVE-2025-71112.md +++ b/2025/CVE-2025-71112.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fe4144d47eef8453459c53a34e9d5940a3e6c219%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: hns3: ad #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71113.md b/2025/CVE-2025-71113.md index 68edb6f13f..1213684a7b 100644 --- a/2025/CVE-2025-71113.md +++ b/2025/CVE-2025-71113.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.38%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fe869cdb89c95d060c77eea20204d6c91f233b53%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: af_al #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71114.md b/2025/CVE-2025-71114.md index 5a09429cff..98754006fe 100644 --- a/2025/CVE-2025-71114.md +++ b/2025/CVE-2025-71114.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=dc3c56b703dad4aec8a9b3dd86f03a90d0c26a2d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:via_wdt: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71120.md b/2025/CVE-2025-71120.md index 1008348f84..ede4a1326e 100644 --- a/2025/CVE-2025-71120.md +++ b/2025/CVE-2025-71120.md @@ -8,6 +8,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=66ed7b413d31c6ff23901ac4443b1cc1af2f6113%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7be8c165dc81564705e8e0b72d398ef708f67eaa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:SUNRPC: svcau #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71123.md b/2025/CVE-2025-71123.md index e09a4c508c..2879e25a4a 100644 --- a/2025/CVE-2025-71123.md +++ b/2025/CVE-2025-71123.md @@ -13,6 +13,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=7bf46ff83a0ef11836e38ebd72cdc5107209342d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a6e94557cd05adc82fae0400f6e17745563e5412%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b2bac84fde28fb6a88817b8b761abda17a1d300b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e651294218d2684302ee5ed95ccf381646f3e5b4%20&color=brightgreen) @@ -26,6 +27,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: fix str #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71131.md b/2025/CVE-2025-71131.md index ec0df0abdb..708ed3baf8 100644 --- a/2025/CVE-2025-71131.md +++ b/2025/CVE-2025-71131.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0a270321dbf948963aeb0e8382fe17d2c2eb3771%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.25%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: seqiv #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71161.md b/2025/CVE-2025-71161.md index 22d37a096e..8b3f5ef9f5 100644 --- a/2025/CVE-2025-71161.md +++ b/2025/CVE-2025-71161.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a739ff3f543afbb4a041c16cd0182c8e8d366e70%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:dm-verity: di #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71162.md b/2025/CVE-2025-71162.md index 7b81f20a53..5338373b87 100644 --- a/2025/CVE-2025-71162.md +++ b/2025/CVE-2025-71162.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f46b195799b5cb05338e7c44cb3617eacb56d755%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:dmaengine: te #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71163.md b/2025/CVE-2025-71163.md index 4a71b7c1d5..322bdf8df2 100644 --- a/2025/CVE-2025-71163.md +++ b/2025/CVE-2025-71163.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6e7f3ee97bbe2c7d7a53b7dbd7a08a579e03c8c9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:dmaengine: id #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71185.md b/2025/CVE-2025-71185.md index f6446e9038..cce582312a 100644 --- a/2025/CVE-2025-71185.md +++ b/2025/CVE-2025-71185.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=42dbdcc6bf965997c088caff2a8be7f9bf44f701%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:dmaengine: ti #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71186.md b/2025/CVE-2025-71186.md index 4b3b21803d..f136b8827b 100644 --- a/2025/CVE-2025-71186.md +++ b/2025/CVE-2025-71186.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=df7e762db5f6c8dbd9e480f1c9ef9851de346657%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:dmaengine: st #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71189.md b/2025/CVE-2025-71189.md index 7751c92f38..ef5703bf7d 100644 --- a/2025/CVE-2025-71189.md +++ b/2025/CVE-2025-71189.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=134d9c52fca26d2d199516e915da00f0cc6adc73%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:dmaengine: dw #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71190.md b/2025/CVE-2025-71190.md index a902713c69..2518e8584a 100644 --- a/2025/CVE-2025-71190.md +++ b/2025/CVE-2025-71190.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=743e1c8ffe4ee5dd7596556dcc3f022ccde13d7b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:dmaengine: bc #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71191.md b/2025/CVE-2025-71191.md index c0ef7aa601..c524148e7a 100644 --- a/2025/CVE-2025-71191.md +++ b/2025/CVE-2025-71191.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bbe89c8e3d598129b728d1388c3ad9abe4e8e261%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:dmaengine: at #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71197.md b/2025/CVE-2025-71197.md index 3220d50f36..5647b57521 100644 --- a/2025/CVE-2025-71197.md +++ b/2025/CVE-2025-71197.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e2c94d6f572079511945e64537eb1218643f2e68%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:w1: therm: Fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71221.md b/2025/CVE-2025-71221.md index ae2c9b8457..1910ca52b9 100644 --- a/2025/CVE-2025-71221.md +++ b/2025/CVE-2025-71221.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.16%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:dmaengine: mm #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71265.md b/2025/CVE-2025-71265.md index 03263a7627..e4517fa531 100644 --- a/2025/CVE-2025-71265.md +++ b/2025/CVE-2025-71265.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=be71b5cba2e6485e8959da7a9f9a44461a1bb074%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs: ntfs3: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71266.md b/2025/CVE-2025-71266.md index c9dd230630..75536aa7a3 100644 --- a/2025/CVE-2025-71266.md +++ b/2025/CVE-2025-71266.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=82cae269cfa953032fbb8980a7d554d60fb00b17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs: ntfs3: ch #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-71267.md b/2025/CVE-2025-71267.md index 5ca05f8244..1b8cc42274 100644 --- a/2025/CVE-2025-71267.md +++ b/2025/CVE-2025-71267.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=be71b5cba2e6485e8959da7a9f9a44461a1bb074%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs: ntfs3: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2025/CVE-2025-9784.md b/2025/CVE-2025-9784.md index 30dc6a43bd..97a47af2cf 100644 --- a/2025/CVE-2025-9784.md +++ b/2025/CVE-2025-9784.md @@ -18,7 +18,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.0&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.1%20for%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.1%20for%20RHEL%209&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.1.6&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.1.3&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%20Expansion%20Pack&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Process%20Automation%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Single%20Sign-On%207.6%20for%20RHEL%207&color=blue) diff --git a/2026/CVE-2026-0993.md b/2026/CVE-2026-0993.md new file mode 100644 index 0000000000..7125b49be3 --- /dev/null +++ b/2026/CVE-2026-0993.md @@ -0,0 +1,17 @@ +### [CVE-2026-0993](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0993) +![](https://img.shields.io/static/v1?label=Product&message=SL902-SWTGW124AS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Buffer%20Copy%20without%20Checking%20Size%20of%20Input%20('Classic%20Buffer%20Overflow')&color=brightgreen) + +### Description + +SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle. + +### POC + +#### Reference +- https://hml.io/posts/blog-post-cve-2026-0993/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100304.md b/2026/CVE-2026-100304.md index 7885ddeb97..1e4e5a5ed2 100644 --- a/2026/CVE-2026-100304.md +++ b/2026/CVE-2026-100304.md @@ -10,6 +10,7 @@ TDuck survey form 6.0 contains an information disclosure vulnerability in FormAu ### POC #### Reference +- https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_details_orphan.py - https://www.vulncheck.com/advisories/tduck-survey-form-6.0-information-disclosure-via-fail-open-form-ownership-check #### Github diff --git a/2026/CVE-2026-100312.md b/2026/CVE-2026-100312.md new file mode 100644 index 0000000000..511d8c70d8 --- /dev/null +++ b/2026/CVE-2026-100312.md @@ -0,0 +1,18 @@ +### [CVE-2026-100312](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100312) +![](https://img.shields.io/static/v1?label=Product&message=CloudClassroom-PHP-Project&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=5dadec098bfbbf3300d60c3494db3fb95b66e7be%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/JaconiasDev/Advisory-CloundClassroom-PHP-Project-1.0 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100607.md b/2026/CVE-2026-100607.md new file mode 100644 index 0000000000..c83f3f46c5 --- /dev/null +++ b/2026/CVE-2026-100607.md @@ -0,0 +1,17 @@ +### [CVE-2026-100607](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100607) +![](https://img.shields.io/static/v1?label=Product&message=Flowise&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen) + +### Description + +Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method. + +### POC + +#### Reference +- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100609.md b/2026/CVE-2026-100609.md new file mode 100644 index 0000000000..e0fb3108ef --- /dev/null +++ b/2026/CVE-2026-100609.md @@ -0,0 +1,17 @@ +### [CVE-2026-100609](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100609) +![](https://img.shields.io/static/v1?label=Product&message=Flowise&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant (GET /api/v1/openai-assistants and /api/v1/openai-assistants/:id), uploadFilesToAssistant (POST /api/v1/openai-assistants-file/upload/), deleteAssistant (DELETE /api/v1/assistants/:id, reachable by first importing a poisoned assistant row via POST /api/v1/export-import/import), and the shared helper used by getVoices (GET /api/v1/text-to-speech/voices). An authenticated user of one workspace can supply a credential UUID belonging to another workspace, causing the server to decrypt and use that workspace's OpenAI or ElevenLabs API key on the attacker's behalf. No patched version was available at the time of publication. + +### POC + +#### Reference +- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-27w2-26m5-x82c + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100621.md b/2026/CVE-2026-100621.md new file mode 100644 index 0000000000..0bf5317ee1 --- /dev/null +++ b/2026/CVE-2026-100621.md @@ -0,0 +1,17 @@ +### [CVE-2026-100621](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100621) +![](https://img.shields.io/static/v1?label=Product&message=capgo.app&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Control&color=brightgreen) + +### Description + +Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The `enforce_encrypted_bundle_trigger` / `check_encrypted_bundle_on_insert` content lock in supabase/schemas/prod.sql exempts `app_versions` rows whose previous `storage_provider` is `r2-direct`, so delivery-critical columns (name, app_id, session_key, key_id, storage_provider, r2_path, external_url, checksum, manifest, native_packages) remain mutable while a row is in that state. Separately, the channel/version join used by the `/updates` endpoint (supabase/functions/_backend/utils/pg.ts) filters only deleted versions and does not exclude `r2-direct` versions, so such rows remain OTA-selectable. An attacker holding a Capgo API key with bundle write/upload permission can create or keep a bundle version in the `r2-direct` state, assign it to a channel, and then modify these fields via direct PostgREST requests, causing altered bundle metadata (for example checksum and session_key) to be served to devices through `/updates`. This bypasses the post-upload content immutability hardening added for a previous app_versions metadata-tampering issue. + +### POC + +#### Reference +- https://github.com/Cap-go/capgo.app/security/advisories/GHSA-5rg9-rhwj-wj76 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100644.md b/2026/CVE-2026-100644.md new file mode 100644 index 0000000000..82f4ec5ce9 --- /dev/null +++ b/2026/CVE-2026-100644.md @@ -0,0 +1,18 @@ +### [CVE-2026-100644](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100644) +![](https://img.shields.io/static/v1?label=Product&message=siyuan&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks. + +### POC + +#### Reference +- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100675.md b/2026/CVE-2026-100675.md new file mode 100644 index 0000000000..5dd1b1a8d5 --- /dev/null +++ b/2026/CVE-2026-100675.md @@ -0,0 +1,18 @@ +### [CVE-2026-100675](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100675) +![](https://img.shields.io/static/v1?label=Product&message=stoatchat&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Uncaught%20Exception&color=brightgreen) + +### Description + +stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts. + +### POC + +#### Reference +- https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100676.md b/2026/CVE-2026-100676.md index 115ed5e196..1e07ab5e5b 100644 --- a/2026/CVE-2026-100676.md +++ b/2026/CVE-2026-100676.md @@ -11,6 +11,7 @@ January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), befor ### POC #### Reference +- https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qv38-hwhv-jm49 - https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-local-filesystem-read-via-svg #### Github diff --git a/2026/CVE-2026-100681.md b/2026/CVE-2026-100681.md new file mode 100644 index 0000000000..7bb24e95d4 --- /dev/null +++ b/2026/CVE-2026-100681.md @@ -0,0 +1,18 @@ +### [CVE-2026-100681](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100681) +![](https://img.shields.io/static/v1?label=Product&message=server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access. + +### POC + +#### Reference +- https://github.com/Budibase/budibase/security/advisories/GHSA-942w-fccr-8r3c + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100720.md b/2026/CVE-2026-100720.md new file mode 100644 index 0000000000..aa4fca9c7a --- /dev/null +++ b/2026/CVE-2026-100720.md @@ -0,0 +1,18 @@ +### [CVE-2026-100720](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100720) +![](https://img.shields.io/static/v1?label=Product&message=froxlor&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it with openssl_x509_parse() and store the issuer organization (issuer['O']) value verbatim without sanitization. Froxlor's table-listing renderer then emits scalar cells through Twig's `raw` filter, disabling HTML auto-escaping, so when an administrator or reseller opens Domains > SSL certificates the attacker-supplied issuer value executes as script in the privileged user's session. This crosses a privilege boundary from customer to admin and can result in full administrator account takeover; because a Froxlor admin controls webserver, DNS, and PHP configuration applied by a cron job running as root, the issue can be further escalated to command execution as root on the managed server. The issue is fixed in Froxlor 2.3.12. + +### POC + +#### Reference +- https://github.com/froxlor/froxlor/security/advisories/GHSA-89vj-gqqr-73p8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100721.md b/2026/CVE-2026-100721.md new file mode 100644 index 0000000000..2d2d0808d1 --- /dev/null +++ b/2026/CVE-2026-100721.md @@ -0,0 +1,18 @@ +### [CVE-2026-100721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100721) +![](https://img.shields.io/static/v1?label=Product&message=vm2&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) + +### Description + +vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context. + +### POC + +#### Reference +- https://github.com/patriksimek/vm2/security/advisories/GHSA-5h3f-q97h-ccvc + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100836.md b/2026/CVE-2026-100836.md new file mode 100644 index 0000000000..6beee00373 --- /dev/null +++ b/2026/CVE-2026-100836.md @@ -0,0 +1,17 @@ +### [CVE-2026-100836](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100836) +![](https://img.shields.io/static/v1?label=Product&message=contrast&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Validation%20of%20Array%20Index&color=brightgreen) + +### Description + +Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a short base64-encoded ciphertext, causing log spam and request failures without crashing the process. + +### POC + +#### Reference +- https://github.com/edgelesssys/contrast/security/advisories/GHSA-3ccm-4qq2-5wrp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100848.md b/2026/CVE-2026-100848.md new file mode 100644 index 0000000000..da0b030be2 --- /dev/null +++ b/2026/CVE-2026-100848.md @@ -0,0 +1,18 @@ +### [CVE-2026-100848](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100848) +![](https://img.shields.io/static/v1?label=Product&message=AzuraCast&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities\Urls::parseUserUrl, used by StationRemote::getUrlAsUri) and performs no host or IP address restriction. A user holding only the station-scoped RemoteRelays permission can therefore set a Remote Relay URL pointing at loopback, private-network, or cloud-metadata addresses (e.g. http://127.0.0.1:/ or http://169.254.169.254/latest/meta-data/), and AzuraCast's periodic background Now Playing sync (AbstractRemote::getNowPlayingAsync) will automatically and repeatedly issue HTTP requests to that address, resulting in server-side request forgery against internal resources. This affects the main branch as of commit bcf8754eef3a268ad82c3db4d81f7920c3c28b56 (2026-07-31); no patched version is available at the time of the advisory. + +### POC + +#### Reference +- https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-4h6m-rrxm-7w3m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100852.md b/2026/CVE-2026-100852.md new file mode 100644 index 0000000000..ca02809fe9 --- /dev/null +++ b/2026/CVE-2026-100852.md @@ -0,0 +1,17 @@ +### [CVE-2026-100852](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100852) +![](https://img.shields.io/static/v1?label=Product&message=AzuraCast&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes. + +### POC + +#### Reference +- https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-73rf-jp3g-8rcf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100854.md b/2026/CVE-2026-100854.md new file mode 100644 index 0000000000..6f04522416 --- /dev/null +++ b/2026/CVE-2026-100854.md @@ -0,0 +1,18 @@ +### [CVE-2026-100854](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100854) +![](https://img.shields.io/static/v1?label=Product&message=AzuraCast&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclose filesystem paths. + +### POC + +#### Reference +- https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-4fm3-ggg2-c6qx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100860.md b/2026/CVE-2026-100860.md new file mode 100644 index 0000000000..1e2286c052 --- /dev/null +++ b/2026/CVE-2026-100860.md @@ -0,0 +1,18 @@ +### [CVE-2026-100860](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100860) +![](https://img.shields.io/static/v1?label=Product&message=heym&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Not%20Failing%20Securely%20('Failing%20Open')&color=brightgreen) + +### Description + +heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_execution/nodes/redis_node.py). When _get_accessible_credential returns None — because the credential ID does not exist or the caller is not authorized to use it — the node treats the lookup failure as an empty configuration and falls back to defaults, connecting to localhost:6379 with no password and executing the requested operation there. The same fallback occurs when an accessible credential has an empty config or no redis_host value. An authenticated workflow author who supplies a credential ID they do not own, or one that was deleted, therefore obtains a read/write connection to whatever Redis is listening on the backend's loopback interface instead of an error. Impact depends on the deployment: the stock docker-compose.yml ships no Redis, in which case the flaw surfaces as a misleading connection error rather than data exposure. + +### POC + +#### Reference +- https://github.com/heymrun/heym/security/advisories/GHSA-fmpw-hj3m-xvj6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100865.md b/2026/CVE-2026-100865.md new file mode 100644 index 0000000000..808cb608b3 --- /dev/null +++ b/2026/CVE-2026-100865.md @@ -0,0 +1,18 @@ +### [CVE-2026-100865](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100865) +![](https://img.shields.io/static/v1?label=Product&message=heym&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user. + +### POC + +#### Reference +- https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100882.md b/2026/CVE-2026-100882.md new file mode 100644 index 0000000000..96332b518f --- /dev/null +++ b/2026/CVE-2026-100882.md @@ -0,0 +1,25 @@ +### [CVE-2026-100882](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100882) +![](https://img.shields.io/static/v1?label=Product&message=laravel-crm&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.2.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.2.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.2.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.2.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) + +### Description + +A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php of the component Admin Settings Endpoint. Performing a manipulation of the argument general.settings.footer.label results in cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.2.6 is recommended to address this issue. The patch is named 6dbcf75b30dbd169ee81b7e9e00368099124efeb. You should upgrade the affected component. + +### POC + +#### Reference +- https://github.com/carlosalbertotuma/advisory/blob/main/advisory-04-stored-xss-via-footer.md +- https://github.com/krayin/laravel-crm/issues/2622 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-100894.md b/2026/CVE-2026-100894.md new file mode 100644 index 0000000000..b35d0430f9 --- /dev/null +++ b/2026/CVE-2026-100894.md @@ -0,0 +1,18 @@ +### [CVE-2026-100894](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100894) +![](https://img.shields.io/static/v1?label=Product&message=CloudClassroom-PHP-Project&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=5dadec098bfbbf3300d60c3494db3fb95b66e7be%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/JaconiasDev/Advisory-CloundClassroom-PHP-Project-1.0.git + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-101049.md b/2026/CVE-2026-101049.md new file mode 100644 index 0000000000..2c53f8d7a7 --- /dev/null +++ b/2026/CVE-2026-101049.md @@ -0,0 +1,18 @@ +### [CVE-2026-101049](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101049) +![](https://img.shields.io/static/v1?label=Product&message=heym&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen) + +### Description + +Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials. + +### POC + +#### Reference +- https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-101050.md b/2026/CVE-2026-101050.md new file mode 100644 index 0000000000..39a762c9a1 --- /dev/null +++ b/2026/CVE-2026-101050.md @@ -0,0 +1,18 @@ +### [CVE-2026-101050](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101050) +![](https://img.shields.io/static/v1?label=Product&message=heym&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen) + +### Description + +Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input. + +### POC + +#### Reference +- https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-101093.md b/2026/CVE-2026-101093.md new file mode 100644 index 0000000000..b618f5ca75 --- /dev/null +++ b/2026/CVE-2026-101093.md @@ -0,0 +1,17 @@ +### [CVE-2026-101093](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101093) +![](https://img.shields.io/static/v1?label=Product&message=Cotonti&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) + +### Description + +Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associated permissions by riding the administrator's session. + +### POC + +#### Reference +- https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-101290.md b/2026/CVE-2026-101290.md new file mode 100644 index 0000000000..7d163bb393 --- /dev/null +++ b/2026/CVE-2026-101290.md @@ -0,0 +1,17 @@ +### [CVE-2026-101290](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101290) +![](https://img.shields.io/static/v1?label=Product&message=Sick_Safetyscanners_Base%20CPP%20Driver&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%20Out-of-bounds%20read&color=brightgreen) + +### Description + +A remote attacker may send a specially crafted network packet that causes theaffected application to perform an out-of-bounds memory read due to insufficient validation ofpacket length. This may result in an application crash and a denial-of-service condition. + +### POC + +#### Reference +- https://www.first.org/cvss/calculator/3.1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-101301.md b/2026/CVE-2026-101301.md new file mode 100644 index 0000000000..92118a1d6c --- /dev/null +++ b/2026/CVE-2026-101301.md @@ -0,0 +1,17 @@ +### [CVE-2026-101301](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101301) +![](https://img.shields.io/static/v1?label=Product&message=WPCode&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen) + +### Description + +The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/e60dade1-a7af-4570-bfd6-669d10991d67/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-102248.md b/2026/CVE-2026-102248.md new file mode 100644 index 0000000000..739dd79122 --- /dev/null +++ b/2026/CVE-2026-102248.md @@ -0,0 +1,29 @@ +### [CVE-2026-102248](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102248) +![](https://img.shields.io/static/v1?label=Product&message=Rebuild&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.5.0-beta1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.5.0-beta2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.5.0-beta3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.5.0-beta4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.5.0-beta5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen) + +### Description + +A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/ASantsSec/CVE/issues/25 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-102360.md b/2026/CVE-2026-102360.md new file mode 100644 index 0000000000..e3b23b3481 --- /dev/null +++ b/2026/CVE-2026-102360.md @@ -0,0 +1,18 @@ +### [CVE-2026-102360](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102360) +![](https://img.shields.io/static/v1?label=Product&message=lib0&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%200.2.1-0.2.117%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%201.0.0-rc.32%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) + +### Description + +A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. `readUint8Array` never compares the wire-supplied length against the decoder's own view, so one over-long length prefix returns whatever the host process allocated next: other tenants' document content, personal data, and live bearer session tokens**, recovered in full and at will. An attacker who can supply bytes to a lib0 decoder which means any peer that can open a socket, including before authentication reads adjacent process memory and, where the consumer echoes, stores or re-serves the decoded value, receives it back. This is patched in version 0.2.118 and 1.0.0-rc.33. + +### POC + +#### Reference +- https://github.com/dmonad/lib0/security/advisories/GHSA-r5c8-rf4w-qrq8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-102825.md b/2026/CVE-2026-102825.md new file mode 100644 index 0000000000..b423e594b7 --- /dev/null +++ b/2026/CVE-2026-102825.md @@ -0,0 +1,17 @@ +### [CVE-2026-102825](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102825) +![](https://img.shields.io/static/v1?label=Product&message=russh&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.62.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-307%3A%20Improper%20Restriction%20of%20Excessive%20Authentication%20Attempts&color=brightgreen) + +### Description + +Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload. This issue is fixed in version 0.62.6. + +### POC + +#### Reference +- https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-102980.md b/2026/CVE-2026-102980.md new file mode 100644 index 0000000000..f718e27815 --- /dev/null +++ b/2026/CVE-2026-102980.md @@ -0,0 +1,17 @@ +### [CVE-2026-102980](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102980) +![](https://img.shields.io/static/v1?label=Product&message=plane&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. ProjectPagePermission likewise derives the caller's role from the URL project while resolving the requested page workspace-wide, so a member of one project can use that project's identifier to read description_html for a public page in another project in the same workspace. The affected path is read-only and does not enable cross-project page modification. This issue is fixed in version 1.4.0. + +### POC + +#### Reference +- https://github.com/makeplane/plane/security/advisories/GHSA-ghcr-frqr-6pqr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-102992.md b/2026/CVE-2026-102992.md new file mode 100644 index 0000000000..30d4e56ce1 --- /dev/null +++ b/2026/CVE-2026-102992.md @@ -0,0 +1,19 @@ +### [CVE-2026-102992](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102992) +![](https://img.shields.io/static/v1?label=Product&message=piscina&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.9.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%205.0.0%2C%20%3C%205.3.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%206.0.0-rc.1%2C%20%3C%206.0.0-rc.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1321%3A%20Improperly%20Controlled%20Modification%20of%20Object%20Prototype%20Attributes%20('Prototype%20Pollution')&color=brightgreen) + +### Description + +piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can therefore supply inherited values for security-sensitive options that do not have own defaults. An inherited execArgv value is passed to the Node.js Worker constructor and can preload attacker-controlled code in worker threads, an inherited loadBalancer function can execute during task scheduling, and inherited env values can alter worker environments. This issue is fixed in versions 4.9.4, 5.3.2, and 6.0.0-rc.5. + +### POC + +#### Reference +- https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-103304.md b/2026/CVE-2026-103304.md new file mode 100644 index 0000000000..2e4af6d87e --- /dev/null +++ b/2026/CVE-2026-103304.md @@ -0,0 +1,17 @@ +### [CVE-2026-103304](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103304) +![](https://img.shields.io/static/v1?label=Product&message=eaSYNC%20Booking&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/99069eac-aa52-41da-9d63-3fb9e2a05f4a/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-103308.md b/2026/CVE-2026-103308.md new file mode 100644 index 0000000000..e47b46deae --- /dev/null +++ b/2026/CVE-2026-103308.md @@ -0,0 +1,17 @@ +### [CVE-2026-103308](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103308) +![](https://img.shields.io/static/v1?label=Product&message=Visma%20Pay%20for%20WooCommerce&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-345%20Insufficient%20Verification%20of%20Data%20Authenticity&color=brightgreen) + +### Description + +The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/26bae5f0-510b-403e-bd69-c4aa2392406d/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-103324.md b/2026/CVE-2026-103324.md new file mode 100644 index 0000000000..b6e8b13363 --- /dev/null +++ b/2026/CVE-2026-103324.md @@ -0,0 +1,17 @@ +### [CVE-2026-103324](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103324) +![](https://img.shields.io/static/v1?label=Product&message=Cardinity%20Payment%20Gateway%20for%20WooCommerce&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.2.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-345%20Insufficient%20Verification%20of%20Data%20Authenticity&color=brightgreen) + +### Description + +The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mark arbitrary orders as paid, or force them to failed. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/4e23c520-bb92-47b8-a617-0d334820db50/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-104250.md b/2026/CVE-2026-104250.md new file mode 100644 index 0000000000..f3ec3ac0a9 --- /dev/null +++ b/2026/CVE-2026-104250.md @@ -0,0 +1,18 @@ +### [CVE-2026-104250](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-104250) +![](https://img.shields.io/static/v1?label=Product&message=unstructured&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.24.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-116%3A%20Improper%20Encoding%20or%20Escaping%20of%20Output&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partition_html(html_parser_version="v2") and the VLM partitioner can preserve untrusted document tags, attributes, text, and link targets in metadata.text_as_html, while elements_to_html() emits the result as an HTML document. The to_html() path in unstructured/documents/ontology.py does not escape output or reject unsafe URL schemes, allowing event-handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML or text_as_html is rendered in a browser, attacker-controlled script can execute in the viewer's origin, including in document-ingestion workflows where a privileged reviewer opens submitted content. This issue is fixed in version 0.24.1. + +### POC + +#### Reference +- https://github.com/Unstructured-IO/unstructured/security/advisories/GHSA-v5mq-3xhg-98m9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-104643.md b/2026/CVE-2026-104643.md new file mode 100644 index 0000000000..97b58d8ebc --- /dev/null +++ b/2026/CVE-2026-104643.md @@ -0,0 +1,17 @@ +### [CVE-2026-104643](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-104643) +![](https://img.shields.io/static/v1?label=Product&message=Easy%20HTTPS%20Redirection%20(SSL)&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/8b75ec7a-2b37-4e77-a83a-18b5e6f71d51/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-104982.md b/2026/CVE-2026-104982.md new file mode 100644 index 0000000000..c99e68b254 --- /dev/null +++ b/2026/CVE-2026-104982.md @@ -0,0 +1,23 @@ +### [CVE-2026-104982](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-104982) +![](https://img.shields.io/static/v1?label=Product&message=Xreader&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.6.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.6.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.6.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.6.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.6.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 4.6.6 is capable of addressing this issue. Patch name: a5aecea074e8564b7a22f1ce054b31ec862974b7. It is advisable to upgrade the affected component. One of the project maintainers explains, that "EPUB support was removed from Xreader and reimplemented in Xepub". + +### POC + +#### Reference +- https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-104983.md b/2026/CVE-2026-104983.md index 19384dc72d..ebc00ffad3 100644 --- a/2026/CVE-2026-104983.md +++ b/2026/CVE-2026-104983.md @@ -19,6 +19,7 @@ A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is th ### POC #### Reference +- https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2 - https://github.com/linuxmint/xreader/issues/714 #### Github diff --git a/2026/CVE-2026-105236.md b/2026/CVE-2026-105236.md new file mode 100644 index 0000000000..401e423a28 --- /dev/null +++ b/2026/CVE-2026-105236.md @@ -0,0 +1,20 @@ +### [CVE-2026-105236](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105236) +![](https://img.shields.io/static/v1?label=Product&message=OTP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=18.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4fe38c4b8b2c8024afb60990e598ff823743fd54%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-295%20Improper%20Certificate%20Validation&color=brightgreen) + +### Description + +Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there.A server that serves several SNI names from one listen socket through sni_fun or sni_hosts keeps one pre-TLS 1.3 session cache per listener and does not bind a cached session to the SNI name or client trust policy that established it. When an SNI option set switches to verify_peer without naming reuse_sessions, ssl_config:update_options/3 inherits the base listener's reuse_sessions value of true, so the default that disables reuse for client-authenticating servers does not apply. On an abbreviated handshake ssl_session:is_resumable/4 checks only that the cached session uses one of the current server certificates and carries some peer certificate, and never revalidates that certificate against the CA selected for the requested name. The names must share a server certificate, which is common with wildcard or multi-SAN certificates. TLS 1.3 does not use this cache and is not affected.This issue affects OTP from OTP 18.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 7.0 before 11.2.12.14, 11.6.0.7, and 11.7.8. + +### POC + +#### Reference +- https://cna.erlef.org/cves/CVE-2026-105236.html +- https://osv.dev/vulnerability/EEF-CVE-2026-105236 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-105659.md b/2026/CVE-2026-105659.md new file mode 100644 index 0000000000..d3b6933859 --- /dev/null +++ b/2026/CVE-2026-105659.md @@ -0,0 +1,19 @@ +### [CVE-2026-105659](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105659) +![](https://img.shields.io/static/v1?label=Product&message=bandit&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=fff06efe3be962b484bd4d3eb339372fda5a231f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%20Uncontrolled%20Resource%20Consumption&color=brightgreen) + +### Description + +Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOW_UPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants more window, and each block carries a 15 second deadline. Both deadlines restart whenever the peer makes partial progress. Bandit.HTTP2.Connection.finish_data/5 re-queues a partially advanced send in pending_sends with a fresh expires_at, so every WINDOW_UPDATE on stream 0, and every SETTINGS frame, resets the clock. Bandit.HTTP2.Stream.send_data/3 recurses on each stream WINDOW_UPDATE and re-arms a fresh after read_timeout. A peer that grants a few bytes every few seconds keeps the blocked stream process, its Plug state and any resource it holds mid-response alive for as long as it keeps dripping, and repeats this across streams and connections to exhaust server processes and memory.The two paths are independent. The stream-level block is reached on its own by widening the connection window with a large WINDOW_UPDATE on stream 0 and shrinking the per-stream window with a small SETTINGS_INITIAL_WINDOW_SIZE, so closing only the connection-level path leaves it exploitable.This issue affects bandit: from 1.4.0 onward. + +### POC + +#### Reference +- https://cna.erlef.org/cves/CVE-2026-105659.html +- https://osv.dev/vulnerability/EEF-CVE-2026-105659 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106031.md b/2026/CVE-2026-106031.md new file mode 100644 index 0000000000..290e357c42 --- /dev/null +++ b/2026/CVE-2026-106031.md @@ -0,0 +1,17 @@ +### [CVE-2026-106031](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106031) +![](https://img.shields.io/static/v1?label=Product&message=Spin%20Wheel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen) + +### Description + +The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/51b61b2b-6bf7-4dee-be8a-907cf5071920/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106037.md b/2026/CVE-2026-106037.md new file mode 100644 index 0000000000..4d0b503883 --- /dev/null +++ b/2026/CVE-2026-106037.md @@ -0,0 +1,17 @@ +### [CVE-2026-106037](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106037) +![](https://img.shields.io/static/v1?label=Product&message=Mooncake&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) + +### Description + +Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user prompts, inject or delete objects, and mount attacker-described segments. + +### POC + +#### Reference +- https://github.com/kvcache-ai/Mooncake/issues/4476 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106041.md b/2026/CVE-2026-106041.md new file mode 100644 index 0000000000..096e9b60ea --- /dev/null +++ b/2026/CVE-2026-106041.md @@ -0,0 +1,17 @@ +### [CVE-2026-106041](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106041) +![](https://img.shields.io/static/v1?label=Product&message=Mooncake&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL_DISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replicas pointing at attacker-controlled endpoints to serve poisoned disk-tier reads and fake key existence. + +### POC + +#### Reference +- https://github.com/kvcache-ai/Mooncake/issues/4479 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106116.md b/2026/CVE-2026-106116.md new file mode 100644 index 0000000000..3ff8d8cc82 --- /dev/null +++ b/2026/CVE-2026-106116.md @@ -0,0 +1,17 @@ +### [CVE-2026-106116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106116) +![](https://img.shields.io/static/v1?label=Product&message=ImageSharp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.0.0%2C%20%3C%204.1.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-835%3A%20Loop%20with%20Unreachable%20Exit%20Condition%20('Infinite%20Loop')&color=brightgreen) + +### Description + +ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without advancing the stream or terminating the outer loop, so a small malformed BigTIFF can keep one decoder thread executing for an attacker-controlled duration. This report does not claim worker-pool exhaustion. This issue is fixed in version 4.1.2. + +### POC + +#### Reference +- https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106210.md b/2026/CVE-2026-106210.md new file mode 100644 index 0000000000..08dc122220 --- /dev/null +++ b/2026/CVE-2026-106210.md @@ -0,0 +1,17 @@ +### [CVE-2026-106210](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106210) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=155.0.8059.39%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Observable%20discrepancy&color=brightgreen) + +### Description + +Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/556304559 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106238.md b/2026/CVE-2026-106238.md new file mode 100644 index 0000000000..3d5bae21a6 --- /dev/null +++ b/2026/CVE-2026-106238.md @@ -0,0 +1,17 @@ +### [CVE-2026-106238](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106238) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=155.0.8059.39%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Race%20condition&color=brightgreen) + +### Description + +Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/492374387 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106283.md b/2026/CVE-2026-106283.md new file mode 100644 index 0000000000..aeacacfd87 --- /dev/null +++ b/2026/CVE-2026-106283.md @@ -0,0 +1,17 @@ +### [CVE-2026-106283](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106283) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=155.0.8059.39%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen) + +### Description + +Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/499468981 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106307.md b/2026/CVE-2026-106307.md new file mode 100644 index 0000000000..1fa63dc63f --- /dev/null +++ b/2026/CVE-2026-106307.md @@ -0,0 +1,17 @@ +### [CVE-2026-106307](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106307) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=155.0.8059.39%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20authorization&color=brightgreen) + +### Description + +Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/537832408 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106308.md b/2026/CVE-2026-106308.md new file mode 100644 index 0000000000..3f8ad2daf9 --- /dev/null +++ b/2026/CVE-2026-106308.md @@ -0,0 +1,17 @@ +### [CVE-2026-106308](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106308) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=155.0.8059.39%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20reference%20resolution&color=brightgreen) + +### Description + +Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/560055258 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106336.md b/2026/CVE-2026-106336.md new file mode 100644 index 0000000000..4496ab7723 --- /dev/null +++ b/2026/CVE-2026-106336.md @@ -0,0 +1,17 @@ +### [CVE-2026-106336](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106336) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=155.0.8059.39%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Observable%20discrepancy&color=brightgreen) + +### Description + +Observable discrepancy in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/522722456 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106364.md b/2026/CVE-2026-106364.md new file mode 100644 index 0000000000..b3abb54fa0 --- /dev/null +++ b/2026/CVE-2026-106364.md @@ -0,0 +1,17 @@ +### [CVE-2026-106364](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106364) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=155.0.8059.39%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20authorization&color=brightgreen) + +### Description + +Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/540018068 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106365.md b/2026/CVE-2026-106365.md new file mode 100644 index 0000000000..308b7c5cf2 --- /dev/null +++ b/2026/CVE-2026-106365.md @@ -0,0 +1,17 @@ +### [CVE-2026-106365](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106365) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=155.0.8059.39%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20authorization&color=brightgreen) + +### Description + +Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/498075038 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106370.md b/2026/CVE-2026-106370.md new file mode 100644 index 0000000000..f7ed184263 --- /dev/null +++ b/2026/CVE-2026-106370.md @@ -0,0 +1,17 @@ +### [CVE-2026-106370](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106370) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=155.0.8059.39%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Uninitialized%20resource&color=brightgreen) + +### Description + +Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/517033396 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-106406.md b/2026/CVE-2026-106406.md new file mode 100644 index 0000000000..01585f97b1 --- /dev/null +++ b/2026/CVE-2026-106406.md @@ -0,0 +1,17 @@ +### [CVE-2026-106406](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-106406) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=155.0.8059.39%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20authorization&color=brightgreen) + +### Description + +Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/505186109 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-108065.md b/2026/CVE-2026-108065.md new file mode 100644 index 0000000000..c71b412555 --- /dev/null +++ b/2026/CVE-2026-108065.md @@ -0,0 +1,17 @@ +### [CVE-2026-108065](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-108065) +![](https://img.shields.io/static/v1?label=Product&message=WebAlliance%20eCommerce&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20Improper%20neutralization%20of%20special%20elements%20used%20in%20an%20SQL%20command%20('SQL%20injection')&color=brightgreen) + +### Description + +SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query. + +### POC + +#### Reference +- https://www.rapid7.com/blog/post/ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-108390.md b/2026/CVE-2026-108390.md new file mode 100644 index 0000000000..6ee041e108 --- /dev/null +++ b/2026/CVE-2026-108390.md @@ -0,0 +1,19 @@ +### [CVE-2026-108390](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-108390) +![](https://img.shields.io/static/v1?label=Product&message=hestiacp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.9.7%2C%20%3C%201.10.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-427%3A%20Uncontrolled%20Search%20Path%20Element&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-88%3A%20Improper%20Neutralization%20of%20Argument%20Delimiters%20in%20a%20Command%20('Argument%20Injection')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated panel user with a web domain to inject an additional PATH field. When the user invokes the ordinary Search feature, the root-privileged v-search-user-object script loads the forged field through parse_object_kv_list_non_eval(), which permits reserved shell-variable names and globally replaces PATH before invoking column without an absolute path. By placing a malicious column executable in the injected search path, the user can execute arbitrary code as root. This residual vulnerability was introduced when version 1.9.7 replaced the raw eval sink addressed by CVE-2026-84984 with parse_object_kv_list_non_eval(), and it is fixed in version 1.10.5. + +### POC + +#### Reference +- https://ravindulakmina.pages.dev/advisories/cve-2026-108390-hestiacp-apostrophe-to-root + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-108544.md b/2026/CVE-2026-108544.md new file mode 100644 index 0000000000..7f4b31f80c --- /dev/null +++ b/2026/CVE-2026-108544.md @@ -0,0 +1,22 @@ +### [CVE-2026-108544](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-108544) +![](https://img.shields.io/static/v1?label=Product&message=Docx%20Reader%20Office%20Viewer%20App&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.4.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.4.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.4.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.4.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function word.office.docxviewer.document.docx.reader.ViewTxt. Such manipulation of the argument _display_name leads to path traversal. The attack may be performed from remote. + +### POC + +#### Reference +- https://github.com/Secsys-FDU/AF_CVEs/issues/31 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-109145.md b/2026/CVE-2026-109145.md new file mode 100644 index 0000000000..8046709721 --- /dev/null +++ b/2026/CVE-2026-109145.md @@ -0,0 +1,17 @@ +### [CVE-2026-109145](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109145) +![](https://img.shields.io/static/v1?label=Product&message=User%20Rights%20Access%20Manager&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-269%20Improper%20Privilege%20Management&color=brightgreen) + +### Description + +The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/62aa4b8c-b9f5-44f4-ac5a-220c14eb719a/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-109172.md b/2026/CVE-2026-109172.md index 0637ea603a..457c1cf5ae 100644 --- a/2026/CVE-2026-109172.md +++ b/2026/CVE-2026-109172.md @@ -10,6 +10,7 @@ yshop-crm through 2.1.3 contains a missing authorization vulnerability that allo ### POC #### Reference +- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/yshop-crm/poc_crm_receivables_check.py - https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-contract-receivables-check-endpoint #### Github diff --git a/2026/CVE-2026-109185.md b/2026/CVE-2026-109185.md index c576a8c15f..96756b4781 100644 --- a/2026/CVE-2026-109185.md +++ b/2026/CVE-2026-109185.md @@ -10,6 +10,7 @@ jshERP through 3.6 contains a missing authorization vulnerability in the UserCon ### POC #### Reference +- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_identity_privilege_write.py - https://www.vulncheck.com/advisories/jsherp-through-3.6-privilege-escalation-via-put-user-updateuser #### Github diff --git a/2026/CVE-2026-109186.md b/2026/CVE-2026-109186.md index d416bdeb0e..19cd3b9d63 100644 --- a/2026/CVE-2026-109186.md +++ b/2026/CVE-2026-109186.md @@ -10,6 +10,7 @@ jshERP through 3.6 contains a mass assignment vulnerability in the UserControlle ### POC #### Reference +- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_identity_privilege_write.py - https://www.vulncheck.com/advisories/jsherp-through-3.6-mass-assignment-via-put-user-update #### Github diff --git a/2026/CVE-2026-109255.md b/2026/CVE-2026-109255.md new file mode 100644 index 0000000000..c207197b43 --- /dev/null +++ b/2026/CVE-2026-109255.md @@ -0,0 +1,18 @@ +### [CVE-2026-109255](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109255) +![](https://img.shields.io/static/v1?label=Product&message=FreeRDP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Heap-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVER_LICENSE_REQUEST with a large scopeCount that bypasses length checks, causing out-of-bounds writes leading to denial of service or remote code execution. + +### POC + +#### Reference +- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hxw3-57rq-3v4m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-109299.md b/2026/CVE-2026-109299.md new file mode 100644 index 0000000000..f1f33de2a6 --- /dev/null +++ b/2026/CVE-2026-109299.md @@ -0,0 +1,18 @@ +### [CVE-2026-109299](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109299) +![](https://img.shields.io/static/v1?label=Product&message=open-webui&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Uncontrolled%20Resource%20Consumption&color=brightgreen) + +### Description + +Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update endpoints, blocking the shared event loop for seconds per request. + +### POC + +#### Reference +- https://github.com/open-webui/open-webui/security/advisories/GHSA-5w58-mwmh-vf2m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-109309.md b/2026/CVE-2026-109309.md new file mode 100644 index 0000000000..738c9bdad3 --- /dev/null +++ b/2026/CVE-2026-109309.md @@ -0,0 +1,18 @@ +### [CVE-2026-109309](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109309) +![](https://img.shields.io/static/v1?label=Product&message=siyuan&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to read any file readable by the SiYuan process, including the API token and conf.json. + +### POC + +#### Reference +- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-phmw-4rgv-r4xv + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-109330.md b/2026/CVE-2026-109330.md new file mode 100644 index 0000000000..7489e6c660 --- /dev/null +++ b/2026/CVE-2026-109330.md @@ -0,0 +1,18 @@ +### [CVE-2026-109330](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109330) +![](https://img.shields.io/static/v1?label=Product&message=Network-AI&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Origin%20Validation%20in%20WebSockets&color=brightgreen) + +### Description + +Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets. + +### POC + +#### Reference +- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-hr6v-mfxm-4438 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-109397.md b/2026/CVE-2026-109397.md new file mode 100644 index 0000000000..61bc435239 --- /dev/null +++ b/2026/CVE-2026-109397.md @@ -0,0 +1,18 @@ +### [CVE-2026-109397](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109397) +![](https://img.shields.io/static/v1?label=Product&message=Thelia&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brightgreen) + +### Description + +Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user. + +### POC + +#### Reference +- https://github.com/thelia/thelia/security/advisories/GHSA-5524-qfxp-33v9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-109558.md b/2026/CVE-2026-109558.md new file mode 100644 index 0000000000..5a9b917a75 --- /dev/null +++ b/2026/CVE-2026-109558.md @@ -0,0 +1,17 @@ +### [CVE-2026-109558](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109558) +![](https://img.shields.io/static/v1?label=Product&message=EdgeEver&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge. + +### POC + +#### Reference +- https://github.com/tianma-if/edgeever/issues/533 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-109570.md b/2026/CVE-2026-109570.md index 2561f77082..7028df2c47 100644 --- a/2026/CVE-2026-109570.md +++ b/2026/CVE-2026-109570.md @@ -10,6 +10,7 @@ Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authenti ### POC #### Reference +- https://github.com/Pratham-16/fireboltt-Bsw013-BLE-vuln - https://www.vulncheck.com/advisories/fire-boltt-bsw013-through-v0-0.8-unauthenticated-ble-notification-injection #### Github diff --git a/2026/CVE-2026-109571.md b/2026/CVE-2026-109571.md index 15da1425b8..16361ad7ae 100644 --- a/2026/CVE-2026-109571.md +++ b/2026/CVE-2026-109571.md @@ -10,6 +10,7 @@ Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authenti ### POC #### Reference +- https://github.com/Pratham-16/fireboltt-Bsw013-BLE-vuln - https://www.vulncheck.com/advisories/fire-boltt-bsw013-firmware-through-v0-0.8-unauthenticated-heart-rate-disclosure-via-ble #### Github diff --git a/2026/CVE-2026-109680.md b/2026/CVE-2026-109680.md new file mode 100644 index 0000000000..4d376607f1 --- /dev/null +++ b/2026/CVE-2026-109680.md @@ -0,0 +1,18 @@ +### [CVE-2026-109680](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109680) +![](https://img.shields.io/static/v1?label=Product&message=FreeRDP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.18.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Write&color=brightgreen) + +### Description + +FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername that reaches the CLI credential prompt, crashing the client when the user types input. + +### POC + +#### Reference +- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4ww8-3vqm-jgcf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-109827.md b/2026/CVE-2026-109827.md new file mode 100644 index 0000000000..a75e3b1fdf --- /dev/null +++ b/2026/CVE-2026-109827.md @@ -0,0 +1,20 @@ +### [CVE-2026-109827](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109827) +![](https://img.shields.io/static/v1?label=Product&message=GPAC&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=26.07%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Write&color=brightgreen) + +### Description + +A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue. + +### POC + +#### Reference +- https://github.com/gpac/gpac/issues/3930 +- https://github.com/gpac/gpac/pull/3932 +- https://www.mediafire.com/file/zbpfhkgaf18cntf/poc_gpac_g1.zip/file + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110097.md b/2026/CVE-2026-110097.md index 2ad41021ff..2d7699a82f 100644 --- a/2026/CVE-2026-110097.md +++ b/2026/CVE-2026-110097.md @@ -10,6 +10,7 @@ Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that ### POC #### Reference +- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-110097-ikaros-2fa-bypass-temp-token - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ikaros-2fa-bypass-temp-token #### Github diff --git a/2026/CVE-2026-110119.md b/2026/CVE-2026-110119.md index dedaaa03d0..f10da78d7a 100644 --- a/2026/CVE-2026-110119.md +++ b/2026/CVE-2026-110119.md @@ -10,6 +10,7 @@ Yshopmall through 2.0.0 contains an insecure direct object reference vulnerabili ### POC #### Reference +- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-110119-110120-yshopmall-member-api-ownership-idor - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yshopmall-member-api-ownership-idor #### Github diff --git a/2026/CVE-2026-110596.md b/2026/CVE-2026-110596.md new file mode 100644 index 0000000000..d45e141730 --- /dev/null +++ b/2026/CVE-2026-110596.md @@ -0,0 +1,17 @@ +### [CVE-2026-110596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110596) +![](https://img.shields.io/static/v1?label=Product&message=quirc&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Excessive%20Iteration&color=brightgreen) + +### Description + +quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/quirc-alignment-pattern-infinite-loop-dos + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110597.md b/2026/CVE-2026-110597.md new file mode 100644 index 0000000000..b32569ed92 --- /dev/null +++ b/2026/CVE-2026-110597.md @@ -0,0 +1,17 @@ +### [CVE-2026-110597](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110597) +![](https://img.shields.io/static/v1?label=Product&message=tinyexr&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute() bounds checks, crashing applications or leaking adjacent heap memory into attribute values. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/tinyexr-multipart-header-stale-size-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110598.md b/2026/CVE-2026-110598.md new file mode 100644 index 0000000000..b7c151e05a --- /dev/null +++ b/2026/CVE-2026-110598.md @@ -0,0 +1,17 @@ +### [CVE-2026-110598](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110598) +![](https://img.shields.io/static/v1?label=Product&message=libpff&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE or PT_MV_BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/libpff-multivalue-offset-underflow-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110599.md b/2026/CVE-2026-110599.md new file mode 100644 index 0000000000..881f02783e --- /dev/null +++ b/2026/CVE-2026-110599.md @@ -0,0 +1,18 @@ +### [CVE-2026-110599](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110599) +![](https://img.shields.io/static/v1?label=Product&message=l-smash&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Double%20Free&color=brightgreen) + +### Description + +L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/cve-2016-20099-2026-110599-l-smash-hevc-importer-double-free +- https://hackmd.io/@haind-pwn/l-smash-hevc-importer-double-free + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110600.md b/2026/CVE-2026-110600.md new file mode 100644 index 0000000000..5ae63d5220 --- /dev/null +++ b/2026/CVE-2026-110600.md @@ -0,0 +1,17 @@ +### [CVE-2026-110600](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110600) +![](https://img.shields.io/static/v1?label=Product&message=xlsxio&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=NULL%20Pointer%20Dereference&color=brightgreen) + +### Description + +xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship lacking an Id attribute, crashing the process when xlsxioread_sheet_open() is called. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/xlsxio-relationship-missing-id-null-deref + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110601.md b/2026/CVE-2026-110601.md new file mode 100644 index 0000000000..1dcca7604f --- /dev/null +++ b/2026/CVE-2026-110601.md @@ -0,0 +1,18 @@ +### [CVE-2026-110601](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110601) +![](https://img.shields.io/static/v1?label=Product&message=libsixel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Write&color=brightgreen) + +### Description + +libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. Attackers can supply a crafted GIF with a small color table and large transparent index, processed with a background color set, to write bytes past the palette buffer, causing heap corruption or crashes. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/libsixel-gif-transparent-index-oob-write + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110602.md b/2026/CVE-2026-110602.md new file mode 100644 index 0000000000..55e5932ec7 --- /dev/null +++ b/2026/CVE-2026-110602.md @@ -0,0 +1,17 @@ +### [CVE-2026-110602](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110602) +![](https://img.shields.io/static/v1?label=Product&message=libmspack&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Access%20of%20Uninitialized%20Pointer&color=brightgreen) + +### Description + +libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers can supply a truncated, empty, or wrong-signature KWAJ file to crash the process or obtain an arbitrary-free memory corruption primitive. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110603.md b/2026/CVE-2026-110603.md new file mode 100644 index 0000000000..e03f713fa7 --- /dev/null +++ b/2026/CVE-2026-110603.md @@ -0,0 +1,17 @@ +### [CVE-2026-110603](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110603) +![](https://img.shields.io/static/v1?label=Product&message=LASzip&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Access%20of%20Uninitialized%20Pointer&color=brightgreen) + +### Description + +LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C API, crashes the process and corrupts the heap. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/laszip-vlr-uninitialized-free + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110604.md b/2026/CVE-2026-110604.md new file mode 100644 index 0000000000..1da122a8b2 --- /dev/null +++ b/2026/CVE-2026-110604.md @@ -0,0 +1,18 @@ +### [CVE-2026-110604](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110604) +![](https://img.shields.io/static/v1?label=Product&message=Mini-XML&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Off-by-one%20Error&color=brightgreen) + +### Description + +Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the process. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/cve-2026-110604-mxml-strtod-locale-stack-overflow +- https://hackmd.io/@haind-pwn/mxml-strtod-locale-stack-overflow + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110605.md b/2026/CVE-2026-110605.md new file mode 100644 index 0000000000..fdaefa4266 --- /dev/null +++ b/2026/CVE-2026-110605.md @@ -0,0 +1,17 @@ +### [CVE-2026-110605](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110605) +![](https://img.shields.io/static/v1?label=Product&message=libschrift&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Divide%20By%20Zero&color=brightgreen) + +### Description + +libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/libschrift-unitsperem-zero-oob + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110606.md b/2026/CVE-2026-110606.md new file mode 100644 index 0000000000..35b50a6d9d --- /dev/null +++ b/2026/CVE-2026-110606.md @@ -0,0 +1,18 @@ +### [CVE-2026-110606](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110606) +![](https://img.shields.io/static/v1?label=Product&message=LibreCAD&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=libdxfrw&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the decrypted header to read adjacent stack memory and crash the process. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/libdxfrw-dwg-header-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110609.md b/2026/CVE-2026-110609.md new file mode 100644 index 0000000000..44374c221e --- /dev/null +++ b/2026/CVE-2026-110609.md @@ -0,0 +1,17 @@ +### [CVE-2026-110609](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110609) +![](https://img.shields.io/static/v1?label=Product&message=skyeye&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. Attackers can send crafted keyword values to the queryWarehousingDetails or queryOutgoingDetails endpoints to extract database data, including other tenants' data, using boolean, UNION, error or time-based techniques. + +### POC + +#### Reference +- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/skyeye-erp-statistics-keyword-sqli + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110610.md b/2026/CVE-2026-110610.md new file mode 100644 index 0000000000..7e7a518c34 --- /dev/null +++ b/2026/CVE-2026-110610.md @@ -0,0 +1,17 @@ +### [CVE-2026-110610](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110610) +![](https://img.shields.io/static/v1?label=Product&message=ruoyi-vue-pro&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints. + +### POC + +#### Reference +- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yudao-ai-image-midjourney-ssrf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110611.md b/2026/CVE-2026-110611.md new file mode 100644 index 0000000000..4b4a3129a0 --- /dev/null +++ b/2026/CVE-2026-110611.md @@ -0,0 +1,17 @@ +### [CVE-2026-110611](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110611) +![](https://img.shields.io/static/v1?label=Product&message=rebuild&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or chat-stream-stop to read, delete, exfiltrate, or interrupt AI assistant conversations. + +### POC + +#### Reference +- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/getrebuild-rebuild-aibot-chat-idor + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110612.md b/2026/CVE-2026-110612.md new file mode 100644 index 0000000000..491ce16729 --- /dev/null +++ b/2026/CVE-2026-110612.md @@ -0,0 +1,17 @@ +### [CVE-2026-110612](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110612) +![](https://img.shields.io/static/v1?label=Product&message=vlife&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20Hard-coded%20Cryptographic%20Key&color=brightgreen) + +### Description + +vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances. + +### POC + +#### Reference +- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110613.md b/2026/CVE-2026-110613.md new file mode 100644 index 0000000000..c4d9d0403d --- /dev/null +++ b/2026/CVE-2026-110613.md @@ -0,0 +1,17 @@ +### [CVE-2026-110613](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110613) +![](https://img.shields.io/static/v1?label=Product&message=youlai-mall&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=de86041995fa3a8b1e959b86232cb9f0bf52ff46%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status. + +### POC + +#### Reference +- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/youlai-mall-order-list-cross-member-disclosure + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110614.md b/2026/CVE-2026-110614.md new file mode 100644 index 0000000000..e9e86af9d4 --- /dev/null +++ b/2026/CVE-2026-110614.md @@ -0,0 +1,17 @@ +### [CVE-2026-110614](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110614) +![](https://img.shields.io/static/v1?label=Product&message=citrus&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques. + +### POC + +#### Reference +- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/citrus-generic-query-orderby-sqli + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110615.md b/2026/CVE-2026-110615.md new file mode 100644 index 0000000000..6711c777fe --- /dev/null +++ b/2026/CVE-2026-110615.md @@ -0,0 +1,17 @@ +### [CVE-2026-110615](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110615) +![](https://img.shields.io/static/v1?label=Product&message=jshERP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts. + +### POC + +#### Reference +- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/jsherp-user-account-lifecycle-missing-authz + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110625.md b/2026/CVE-2026-110625.md new file mode 100644 index 0000000000..a77b118899 --- /dev/null +++ b/2026/CVE-2026-110625.md @@ -0,0 +1,17 @@ +### [CVE-2026-110625](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110625) +![](https://img.shields.io/static/v1?label=Product&message=clipbucket-v5&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. Attackers can send crafted flagged_item.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin. + +### POC + +#### Reference +- https://hackmd.io/@leediay/BJR_lh2ifg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110626.md b/2026/CVE-2026-110626.md new file mode 100644 index 0000000000..6818befb98 --- /dev/null +++ b/2026/CVE-2026-110626.md @@ -0,0 +1,17 @@ +### [CVE-2026-110626](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110626) +![](https://img.shields.io/static/v1?label=Product&message=clipbucket-v5&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin. + +### POC + +#### Reference +- https://hackmd.io/@leediay/BJR_lh2ifg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110627.md b/2026/CVE-2026-110627.md new file mode 100644 index 0000000000..3c49b75f54 --- /dev/null +++ b/2026/CVE-2026-110627.md @@ -0,0 +1,17 @@ +### [CVE-2026-110627](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110627) +![](https://img.shields.io/static/v1?label=Product&message=clipbucket-v5&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection, executing script in the admin panel origin. + +### POC + +#### Reference +- https://hackmd.io/@leediay/BJR_lh2ifg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110628.md b/2026/CVE-2026-110628.md new file mode 100644 index 0000000000..400eef0d98 --- /dev/null +++ b/2026/CVE-2026-110628.md @@ -0,0 +1,17 @@ +### [CVE-2026-110628](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110628) +![](https://img.shields.io/static/v1?label=Product&message=kan&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.5.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata. + +### POC + +#### Reference +- https://hackmd.io/@leediay/HyIxU63ofg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110632.md b/2026/CVE-2026-110632.md new file mode 100644 index 0000000000..4abd8474e2 --- /dev/null +++ b/2026/CVE-2026-110632.md @@ -0,0 +1,17 @@ +### [CVE-2026-110632](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110632) +![](https://img.shields.io/static/v1?label=Product&message=MyReport%20Updater&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) + +### Description + +Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM. + +### POC + +#### Reference +- https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110633.md b/2026/CVE-2026-110633.md new file mode 100644 index 0000000000..d6b9102e86 --- /dev/null +++ b/2026/CVE-2026-110633.md @@ -0,0 +1,17 @@ +### [CVE-2026-110633](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110633) +![](https://img.shields.io/static/v1?label=Product&message=MyReport%20Updater&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Privilege%20Management&color=brightgreen) + +### Description + +MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges. + +### POC + +#### Reference +- https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110654.md b/2026/CVE-2026-110654.md new file mode 100644 index 0000000000..3cbfd70c21 --- /dev/null +++ b/2026/CVE-2026-110654.md @@ -0,0 +1,17 @@ +### [CVE-2026-110654](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110654) +![](https://img.shields.io/static/v1?label=Product&message=libzvbi&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Write&color=brightgreen) + +### Description + +libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/zvbi-teletext-drcs-mode-oob-write + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110655.md b/2026/CVE-2026-110655.md new file mode 100644 index 0000000000..a3f1371618 --- /dev/null +++ b/2026/CVE-2026-110655.md @@ -0,0 +1,19 @@ +### [CVE-2026-110655](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110655) +![](https://img.shields.io/static/v1?label=Product&message=miniupnpc&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client. + +### POC + +#### Reference +- https://github.com/miniupnp/miniupnp/blob/bf4215a7574f88aa55859db9db00e3ae58cf42d6/miniupnpc/src/minixml.c#L61 +- https://github.com/miniupnp/miniupnp/commit/3cfb4fb78d5ac04ed0dadc8dd842fc9e448916db +- https://hackmd.io/@haind-pwn/miniupnpc-minixml-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110656.md b/2026/CVE-2026-110656.md new file mode 100644 index 0000000000..e4be570e8d --- /dev/null +++ b/2026/CVE-2026-110656.md @@ -0,0 +1,19 @@ +### [CVE-2026-110656](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110656) +![](https://img.shields.io/static/v1?label=Product&message=miniupnpc&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client. + +### POC + +#### Reference +- https://github.com/miniupnp/miniupnp/blob/bf4215a7574f88aa55859db9db00e3ae58cf42d6/miniupnpc/src/minixml.c#L141 +- https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c +- https://hackmd.io/@haind-pwn/miniupnpc-minixml-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110658.md b/2026/CVE-2026-110658.md new file mode 100644 index 0000000000..8e4ff6006a --- /dev/null +++ b/2026/CVE-2026-110658.md @@ -0,0 +1,17 @@ +### [CVE-2026-110658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110658) +![](https://img.shields.io/static/v1?label=Product&message=sofia-sip&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/sofia-sip-multipart-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110659.md b/2026/CVE-2026-110659.md new file mode 100644 index 0000000000..d97561dcfc --- /dev/null +++ b/2026/CVE-2026-110659.md @@ -0,0 +1,17 @@ +### [CVE-2026-110659](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110659) +![](https://img.shields.io/static/v1?label=Product&message=ELFIO&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=NULL%20Pointer%20Dereference&color=brightgreen) + +### Description + +ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to crash applications via an unvalidated sh_link index. Attackers can supply a crafted ELF file whose SHT_REL or SHT_RELA section has a dangling sh_link, causing find_hash_section() to dereference null and deny service. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/elfio-relocation-get-entry-null-deref + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110660.md b/2026/CVE-2026-110660.md new file mode 100644 index 0000000000..490027f0df --- /dev/null +++ b/2026/CVE-2026-110660.md @@ -0,0 +1,17 @@ +### [CVE-2026-110660](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110660) +![](https://img.shields.io/static/v1?label=Product&message=vgmstream&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/vgmstream-g7221-bitreader-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110661.md b/2026/CVE-2026-110661.md new file mode 100644 index 0000000000..8504d6acbb --- /dev/null +++ b/2026/CVE-2026-110661.md @@ -0,0 +1,17 @@ +### [CVE-2026-110661](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110661) +![](https://img.shields.io/static/v1?label=Product&message=CGNS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past disk_node_data, crashing tools like cgnslist. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/cgns-adf-node-header-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110689.md b/2026/CVE-2026-110689.md new file mode 100644 index 0000000000..2c3ad9c302 --- /dev/null +++ b/2026/CVE-2026-110689.md @@ -0,0 +1,24 @@ +### [CVE-2026-110689](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110689) +![](https://img.shields.io/static/v1?label=Product&message=ClawScan&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.1.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.1.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.1.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.1.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Protection%20Mechanism%20Failure&color=brightgreen) + +### Description + +A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection mechanism failure. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.1.7 will fix this issue. The patch is named 9f6a6fbb9f1137345566d0ab44c73893dfe112fa. The affected component should be upgraded. + +### POC + +#### Reference +- https://github.com/openclaw/clawscan/issues/39 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110712.md b/2026/CVE-2026-110712.md new file mode 100644 index 0000000000..ad84710227 --- /dev/null +++ b/2026/CVE-2026-110712.md @@ -0,0 +1,17 @@ +### [CVE-2026-110712](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110712) +![](https://img.shields.io/static/v1?label=Product&message=libsmb2&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/libsmb2-query-info-reply-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110713.md b/2026/CVE-2026-110713.md new file mode 100644 index 0000000000..baac69be50 --- /dev/null +++ b/2026/CVE-2026-110713.md @@ -0,0 +1,17 @@ +### [CVE-2026-110713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110713) +![](https://img.shields.io/static/v1?label=Product&message=libsmb2&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/libsmb2-query-info-reply-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110714.md b/2026/CVE-2026-110714.md new file mode 100644 index 0000000000..fa666265f9 --- /dev/null +++ b/2026/CVE-2026-110714.md @@ -0,0 +1,17 @@ +### [CVE-2026-110714](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110714) +![](https://img.shields.io/static/v1?label=Product&message=libsmb2&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Integer%20Underflow%20(Wrap%20or%20Wraparound)&color=brightgreen) + +### Description + +libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/libsmb2-query-info-reply-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110715.md b/2026/CVE-2026-110715.md new file mode 100644 index 0000000000..1261709e5f --- /dev/null +++ b/2026/CVE-2026-110715.md @@ -0,0 +1,17 @@ +### [CVE-2026-110715](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110715) +![](https://img.shields.io/static/v1?label=Product&message=MuJS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.3.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Write&color=brightgreen) + +### Description + +MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/mujs-array-length-flat-oob + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110716.md b/2026/CVE-2026-110716.md new file mode 100644 index 0000000000..76e662a286 --- /dev/null +++ b/2026/CVE-2026-110716.md @@ -0,0 +1,17 @@ +### [CVE-2026-110716](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110716) +![](https://img.shields.io/static/v1?label=Product&message=unshield&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range file_table_offset or large file counts to crash the unshield tool or library consumers. + +### POC + +#### Reference +- https://hackmd.io/@haind-pwn/unshield-header-filetable-oob-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110734.md b/2026/CVE-2026-110734.md new file mode 100644 index 0000000000..1a21014cbf --- /dev/null +++ b/2026/CVE-2026-110734.md @@ -0,0 +1,17 @@ +### [CVE-2026-110734](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110734) +![](https://img.shields.io/static/v1?label=Product&message=Godot%20Engine&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%20Out-of-bounds%20Write&color=brightgreen) + +### Description + +Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's repeat/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file. The defect is reached automatically when the product imports a crafted .hdr (e.g., when opening a project containing one), and at runtime in exported projects that load untrusted .hdr images. NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model. + +### POC + +#### Reference +- https://github.com/godotengine/godot/issues/123608 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110735.md b/2026/CVE-2026-110735.md new file mode 100644 index 0000000000..1f4ce6eb09 --- /dev/null +++ b/2026/CVE-2026-110735.md @@ -0,0 +1,17 @@ +### [CVE-2026-110735](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110735) +![](https://img.shields.io/static/v1?label=Product&message=Godot%20Engine&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-195%20Signed%20to%20Unsigned%20Conversion%20Error&color=brightgreen) + +### Description + +Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, copying file-controlled data far past the undersized heap allocation. The defect is reached when the product or an exported game loads a crafted binary resource file (.res). NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model. + +### POC + +#### Reference +- https://github.com/godotengine/godot/issues/123608 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110736.md b/2026/CVE-2026-110736.md new file mode 100644 index 0000000000..c35e4e47ec --- /dev/null +++ b/2026/CVE-2026-110736.md @@ -0,0 +1,17 @@ +### [CVE-2026-110736](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110736) +![](https://img.shields.io/static/v1?label=Product&message=Godot%20Engine&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1285%20Improper%20Validation%20of%20Specified%20Index%2C%20Position%2C%20or%20Offset%20in%20Input&color=brightgreen) + +### Description + +Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.cpp, OptimizedTranslation::get_message). Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation; only a single sentinel value is rejected. A crafted file can point an index far past the allocated buffer. Depending on the values, the result is a crash, or a string lookup (tr()) returns raw bytes from elsewhere in the process heap as the translated string, disclosing process memory. The defect is reached when the product or an exported game loads and performs lookups in a crafted translation file. NOTE: the Supplier's position is that the research has identified "no security issues" because the required attacker access is outside of the current Godot Engine threat model. + +### POC + +#### Reference +- https://github.com/godotengine/godot/issues/123608 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110763.md b/2026/CVE-2026-110763.md new file mode 100644 index 0000000000..b0273d0b75 --- /dev/null +++ b/2026/CVE-2026-110763.md @@ -0,0 +1,17 @@ +### [CVE-2026-110763](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110763) +![](https://img.shields.io/static/v1?label=Product&message=lamp-boot&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.16.0-java17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's department membership within the tenant. + +### POC + +#### Reference +- https://hackmd.io/@hieuPenguinnn/lamp-boot-finddeptbycompany-employee-idor + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110766.md b/2026/CVE-2026-110766.md new file mode 100644 index 0000000000..4c538ed4df --- /dev/null +++ b/2026/CVE-2026-110766.md @@ -0,0 +1,17 @@ +### [CVE-2026-110766](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110766) +![](https://img.shields.io/static/v1?label=Product&message=colanode&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces. + +### POC + +#### Reference +- https://hackmd.io/@hieuPenguinnn/colanode-avatar-download-path-traversal + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110767.md b/2026/CVE-2026-110767.md new file mode 100644 index 0000000000..1e400e1d9b --- /dev/null +++ b/2026/CVE-2026-110767.md @@ -0,0 +1,17 @@ +### [CVE-2026-110767](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110767) +![](https://img.shields.io/static/v1?label=Product&message=gitingest&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Link%20Resolution%20Before%20File%20Access%20('Link%20Following')&color=brightgreen) + +### Description + +Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the server to return any file the service user can read, up to 10 MB. + +### POC + +#### Reference +- https://hackmd.io/@hieuPenguinnn/gitingest-blob-symlink-arbitrary-file-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110770.md b/2026/CVE-2026-110770.md new file mode 100644 index 0000000000..78ff3881a1 --- /dev/null +++ b/2026/CVE-2026-110770.md @@ -0,0 +1,17 @@ +### [CVE-2026-110770](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110770) +![](https://img.shields.io/static/v1?label=Product&message=databasus&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Restriction%20of%20Excessive%20Authentication%20Attempts&color=brightgreen) + +### Description + +Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, or invalidation to take over accounts, including administrators. + +### POC + +#### Reference +- https://hackmd.io/@hieuPenguinnn/databasus-password-reset-code-brute-force + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110771.md b/2026/CVE-2026-110771.md new file mode 100644 index 0000000000..91f993f5ee --- /dev/null +++ b/2026/CVE-2026-110771.md @@ -0,0 +1,17 @@ +### [CVE-2026-110771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110771) +![](https://img.shields.io/static/v1?label=Product&message=Shopizer&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings. + +### POC + +#### Reference +- https://hackmd.io/@hieuPenguinnn/shopizer-rest-product-review-idor + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110772.md b/2026/CVE-2026-110772.md new file mode 100644 index 0000000000..7eddfb99d1 --- /dev/null +++ b/2026/CVE-2026-110772.md @@ -0,0 +1,17 @@ +### [CVE-2026-110772](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110772) +![](https://img.shields.io/static/v1?label=Product&message=sure&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports. + +### POC + +#### Reference +- https://hackmd.io/@hieuPenguinnn/we-promise-sure-transactions-bulk-update-missing-authz + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110773.md b/2026/CVE-2026-110773.md new file mode 100644 index 0000000000..cf88219a71 --- /dev/null +++ b/2026/CVE-2026-110773.md @@ -0,0 +1,17 @@ +### [CVE-2026-110773](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110773) +![](https://img.shields.io/static/v1?label=Product&message=growchief&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short search value to GET /users/all-users to enumerate user ids, emails, names and organization IDs of every tenant. + +### POC + +#### Reference +- https://hackmd.io/@hieuPenguinnn/growchief-all-users-missing-authz-cross-tenant-disclosure + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110775.md b/2026/CVE-2026-110775.md new file mode 100644 index 0000000000..f2c10ca0f8 --- /dev/null +++ b/2026/CVE-2026-110775.md @@ -0,0 +1,17 @@ +### [CVE-2026-110775](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110775) +![](https://img.shields.io/static/v1?label=Product&message=nexent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage for presigned URLs or use GET /file/download/{object_name} to download other tenants' source documents. + +### POC + +#### Reference +- https://hackmd.io/@hieuPenguinnn/nexent-knowledge-base-cross-tenant-file-read + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-110871.md b/2026/CVE-2026-110871.md new file mode 100644 index 0000000000..8445daf9d5 --- /dev/null +++ b/2026/CVE-2026-110871.md @@ -0,0 +1,18 @@ +### [CVE-2026-110871](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-110871) +![](https://img.shields.io/static/v1?label=Product&message=nodemailer&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Uncontrolled%20Resource%20Consumption&color=brightgreen) + +### Description + +Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing. + +### POC + +#### Reference +- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15512.md b/2026/CVE-2026-15512.md new file mode 100644 index 0000000000..6f408e9cf5 --- /dev/null +++ b/2026/CVE-2026-15512.md @@ -0,0 +1,20 @@ +### [CVE-2026-15512](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15512) +![](https://img.shields.io/static/v1?label=Product&message=Pig&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.9.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.9.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.java of the component pig-codegen. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://vuldb.com/submit/847500 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16349.md b/2026/CVE-2026-16349.md new file mode 100644 index 0000000000..c32e4eac2e --- /dev/null +++ b/2026/CVE-2026-16349.md @@ -0,0 +1,18 @@ +### [CVE-2026-16349](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16349) +![](https://img.shields.io/static/v1?label=Product&message=Firefox&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Thunderbird&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. + +### POC + +#### Reference +- https://bugzilla.mozilla.org/show_bug.cgi?id=2034682 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16436.md b/2026/CVE-2026-16436.md new file mode 100644 index 0000000000..6e3cd0257b --- /dev/null +++ b/2026/CVE-2026-16436.md @@ -0,0 +1,28 @@ +### [CVE-2026-16436](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16436) +![](https://img.shields.io/static/v1?label=Product&message=AnalytiX&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=BizViz&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=GENESIS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=GENESIS32&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=GENESIS64&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Hyper%20Historian&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=ICONICS%20Suite&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=IoTWorX&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=MC%20Works64&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=MobileHMI&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=all%20versions%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=versions%2010.97.3%20and%20prior%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=versions%2011.03%20and%20prior%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-640%20Weak%20Password%20Recovery%20Mechanism%20for%20Forgotten%20Password&color=brightgreen) + +### Description + +Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition. + +### POC + +#### Reference +- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16437.md b/2026/CVE-2026-16437.md new file mode 100644 index 0000000000..c019c441ce --- /dev/null +++ b/2026/CVE-2026-16437.md @@ -0,0 +1,28 @@ +### [CVE-2026-16437](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16437) +![](https://img.shields.io/static/v1?label=Product&message=AnalytiX&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=BizViz&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=GENESIS&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=GENESIS32&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=GENESIS64&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Hyper%20Historian&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=ICONICS%20Suite&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=IoTWorX&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=MC%20Works64&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=MobileHMI&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=all%20versions%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=versions%2010.97.3%20and%20prior%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=versions%2011.03%20and%20prior%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-640%20Weak%20Password%20Recovery%20Mechanism%20for%20Forgotten%20Password&color=brightgreen) + +### Description + +Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition. + +### POC + +#### Reference +- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16438.md b/2026/CVE-2026-16438.md new file mode 100644 index 0000000000..6755124737 --- /dev/null +++ b/2026/CVE-2026-16438.md @@ -0,0 +1,23 @@ +### [CVE-2026-16438](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16438) +![](https://img.shields.io/static/v1?label=Product&message=AnalytiX&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=GENESIS64&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Hyper%20Historian&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=ICONICS%20Suite&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=MC%20Works64&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=MobileHMI&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=all%20versions%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=versions%2010.97.3%20and%20prior%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-266%20Incorrect%20Privilege%20Assignment&color=brightgreen) + +### Description + +Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition. + +### POC + +#### Reference +- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18649.md b/2026/CVE-2026-18649.md index 395cfbadd0..d29334ec0b 100644 --- a/2026/CVE-2026-18649.md +++ b/2026/CVE-2026-18649.md @@ -25,6 +25,7 @@ A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and #### Reference - https://0xsemizzz.vercel.app/blog/cve-2026-18649-gstreamer-rtp-dos/ - https://0xsemizzz.vercel.app/projects/cve-2026-18649-gstreamer-rtp-dos/ +- https://github.com/0xSemizzz/CVE-2026-18649 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-18773.md b/2026/CVE-2026-18773.md new file mode 100644 index 0000000000..898fa83ff2 --- /dev/null +++ b/2026/CVE-2026-18773.md @@ -0,0 +1,23 @@ +### [CVE-2026-18773](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18773) +![](https://img.shields.io/static/v1?label=Product&message=hermes-agent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2026.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.6.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.6.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.6.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.6.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.6.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) + +### Description + +A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py of the component Quick Command Handler. The manipulation results in incorrect authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://gist.github.com/YLChen-007/f0036aa1c410b70f5e41272947180645 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18775.md b/2026/CVE-2026-18775.md new file mode 100644 index 0000000000..6d960d7dc8 --- /dev/null +++ b/2026/CVE-2026-18775.md @@ -0,0 +1,32 @@ +### [CVE-2026-18775](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18775) +![](https://img.shields.io/static/v1?label=Product&message=hermes-agent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.16.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery&color=brightgreen) + +### Description + +A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser_snapshot of the file tools/browser_tool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://gist.github.com/YLChen-007/2e5bf7fa58113967807425032234cc89 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18968.md b/2026/CVE-2026-18968.md new file mode 100644 index 0000000000..a5614a938e --- /dev/null +++ b/2026/CVE-2026-18968.md @@ -0,0 +1,18 @@ +### [CVE-2026-18968](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18968) +![](https://img.shields.io/static/v1?label=Product&message=OBlog&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3ca6a45a2fcc81f6086751d8af124658720e8f8f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) + +### Description + +A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://gist.github.com/hackusman/a1ba43253d6a62ace31ef39ec325e973 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18992.md b/2026/CVE-2026-18992.md new file mode 100644 index 0000000000..5d4b92e9cf --- /dev/null +++ b/2026/CVE-2026-18992.md @@ -0,0 +1,20 @@ +### [CVE-2026-18992](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18992) +![](https://img.shields.io/static/v1?label=Product&message=CowAgent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) + +### Description + +A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function _select_tools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carried out remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/zhayujie/CowAgent/issues/2904 +- https://github.com/zhayujie/CowAgent/issues/2904#issuecomment-4756833239 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18996.md b/2026/CVE-2026-18996.md new file mode 100644 index 0000000000..47497519e3 --- /dev/null +++ b/2026/CVE-2026-18996.md @@ -0,0 +1,29 @@ +### [CVE-2026-18996](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18996) +![](https://img.shields.io/static/v1?label=Product&message=mercury-agent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Privilege%20Assignment&color=brightgreen) + +### Description + +A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component run_command Handler. Such manipulation leads to incorrect privilege assignment. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/cosmicstack-labs/mercury-agent/issues/72 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19082.md b/2026/CVE-2026-19082.md new file mode 100644 index 0000000000..00c366c733 --- /dev/null +++ b/2026/CVE-2026-19082.md @@ -0,0 +1,18 @@ +### [CVE-2026-19082](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19082) +![](https://img.shields.io/static/v1?label=Product&message=Imager&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.45_02%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%20Out-of-bounds%20Read&color=brightgreen) + +### Description + +Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags.copy_string_tags() computes an ASCII EXIF tag's length as `entry->size - 1` to strip the trailing NUL. A zero-count ASCII entry sets `entry->size` to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request to call strlen(), scanning past the entry to the next NUL and copying those bytes into the tag. JPEG reaches this path via im_decode_exif(), as does the separate Imager::File::WEBP distribution, which is fixed by upgrading Imager.Any caller of Imager->read() on an attacker-supplied image with such an entry may receive an exif_* tag holding adjacent heap bytes instead of an empty string. + +### POC + +#### Reference +- https://github.com/tonycoz/imager/commit/24bde0427a113264d53f45a9c29ae756d84c82fe.patch +- https://github.com/tonycoz/imager/security/advisories/GHSA-hx46-55wp-hv6m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19335.md b/2026/CVE-2026-19335.md new file mode 100644 index 0000000000..dd87a37f68 --- /dev/null +++ b/2026/CVE-2026-19335.md @@ -0,0 +1,20 @@ +### [CVE-2026-19335](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19335) +![](https://img.shields.io/static/v1?label=Product&message=skill-vision-control&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/Jane-xiaoer/skill-vision-control/issues/2 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19744.md b/2026/CVE-2026-19744.md index 22c9c1953d..584675a67b 100644 --- a/2026/CVE-2026-19744.md +++ b/2026/CVE-2026-19744.md @@ -10,6 +10,7 @@ Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 ### POC #### Reference +- https://github.com/ccyl13/Pentestify/commit/272f7d6033fd93fbc858835f55d616157041f123 - https://secur0.com/en/cna/cve-list/cve-2026-19744-stored-xss-in-pentestify-markdown-renderer-via-unescaped-quotes #### Github diff --git a/2026/CVE-2026-19826.md b/2026/CVE-2026-19826.md new file mode 100644 index 0000000000..7ba7a190d8 --- /dev/null +++ b/2026/CVE-2026-19826.md @@ -0,0 +1,26 @@ +### [CVE-2026-19826](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19826) +![](https://img.shields.io/static/v1?label=Product&message=alldata&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Deserialization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Input%20Validation&color=brightgreen) + +### Description + +A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any further explanation. + +### POC + +#### Reference +- https://github.com/alldatacenter/alldata/issues/832 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-22977.md b/2026/CVE-2026-22977.md index 87e4c655d0..e5819b59f4 100644 --- a/2026/CVE-2026-22977.md +++ b/2026/CVE-2026-22977.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.16%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6d07d1cd300f4c7e16005f881fea388164999cc8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: sock: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-22979.md b/2026/CVE-2026-22979.md index 14e136bad3..f80afc98fc 100644 --- a/2026/CVE-2026-22979.md +++ b/2026/CVE-2026-22979.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.8.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d225b0ac96dc40d7e8ae2bc227eb2c56e130975f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ed4cccef64c1d0d5b91e69f7a8a6697c3a865486%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6%20&color=brightgreen) @@ -22,6 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: fix memo #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-22980.md b/2026/CVE-2026-22980.md index fd1072a3d7..9e8f844e85 100644 --- a/2026/CVE-2026-22980.md +++ b/2026/CVE-2026-22980.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7f5ef2e900d9462bf9cffaf6bb246ed87a20a6d6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:nfsd: provide #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-22982.md b/2026/CVE-2026-22982.md index 83108fe896..ec9b425097 100644 --- a/2026/CVE-2026-22982.md +++ b/2026/CVE-2026-22982.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=528d3f190c98c8f7d9581f68db4af021696727b2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: mscc: oc #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-22992.md b/2026/CVE-2026-22992.md index b593047859..407de39db2 100644 --- a/2026/CVE-2026-22992.md +++ b/2026/CVE-2026-22992.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cd1a677cad994021b19665ed476aea63f5d54f31%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:libceph: retu #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-22994.md b/2026/CVE-2026-22994.md index 3937e85cea..69e53e91bb 100644 --- a/2026/CVE-2026-22994.md +++ b/2026/CVE-2026-22994.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1c194998252469cad00a08bd9ef0b99fd255c260%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Fix refe #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23003.md b/2026/CVE-2026-23003.md index 978002f8cd..7ed32341cb 100644 --- a/2026/CVE-2026-23003.md +++ b/2026/CVE-2026-23003.md @@ -10,6 +10,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8d975c15c0cd744000ca386247432d57b21f9df0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a9bc32879a08f23cdb80a48c738017e39aea1080%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=af6b5c50d47ab43e5272ad61935d0ed2e264d3f0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c835df3bcc14858ae9b27315dd7de76370b94f3a%20&color=brightgreen) @@ -24,6 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:ip6_tunnel: u #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23005.md b/2026/CVE-2026-23005.md index 95e5c897f3..dc0566b493 100644 --- a/2026/CVE-2026-23005.md +++ b/2026/CVE-2026-23005.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=820a6ee944e74e57255ac2e90916ecdaade57b95%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:x86/fpu: Clea #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23010.md b/2026/CVE-2026-23010.md index 488630694c..c4eb7073fd 100644 --- a/2026/CVE-2026-23010.md +++ b/2026/CVE-2026-23010.md @@ -10,6 +10,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=836deb96383ed9c1a411f172954d74b3f74ec6ac%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=851b3bb105c595cc20b8dcc1b4de029061ce2b76%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ca97dd10424860a3806ad3a9e26b9dce2901ee0c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cb74207ef98317f8874a0b9780bb339c2eb700b0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -22,6 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: Fix use #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23011.md b/2026/CVE-2026-23011.md index 8d4493f937..bc033f6a86 100644 --- a/2026/CVE-2026-23011.md +++ b/2026/CVE-2026-23011.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c54419321455631079c7d6e60bc732dd0c5914c5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv4: ip_gre: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23019.md b/2026/CVE-2026-23019.md index 3b9715e4a6..c44e1839d5 100644 --- a/2026/CVE-2026-23019.md +++ b/2026/CVE-2026-23019.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=34dd1710f5a3c9a7dc78e1ff6de69a19d407db25%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: marvell: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23026.md b/2026/CVE-2026-23026.md index d51ac8d0ec..e3db24ebc4 100644 --- a/2026/CVE-2026-23026.md +++ b/2026/CVE-2026-23026.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5d0c3533a19f48e5e7e73806a3e4b29cd4364130%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:dmaengine: qc #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23038.md b/2026/CVE-2026-23038.md index dbe51d3559..3e0288f4dd 100644 --- a/2026/CVE-2026-23038.md +++ b/2026/CVE-2026-23038.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d67ae825a59d639e4d8b82413af84d854617a87e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:pnfs/flexfile #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23054.md b/2026/CVE-2026-23054.md index c03cb314da..037533c546 100644 --- a/2026/CVE-2026-23054.md +++ b/2026/CVE-2026-23054.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=962f3fee83a4ef9010ae84dc43ae7aecb572e2a9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: hv_netvs #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23060.md b/2026/CVE-2026-23060.md index 510c8eed62..e3c8e2536f 100644 --- a/2026/CVE-2026-23060.md +++ b/2026/CVE-2026-23060.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=104880a6b470958ddc30e139c41aa4f6ed3a5234%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: authe #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23066.md b/2026/CVE-2026-23066.md new file mode 100644 index 0000000000..71b2319ffd --- /dev/null +++ b/2026/CVE-2026-23066.md @@ -0,0 +1,20 @@ +### [CVE-2026-23066](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23066) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=540b1c48c37ac0ad66212004db21e1ff7e2d78be%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:rxrpc: Fix recvmsg() unconditional requeueIf rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call atthe front of the recvmsg queue already has its mutex locked, it requeuesthe call - whether or not the call is already queued. The call may be onthe queue because MSG_PEEK was also passed and so the call was not dequeuedor because the I/O thread requeued it.The unconditional requeue may then corrupt the recvmsg queue, leading tothings like UAFs or refcount underruns.Fix this by only requeuing the call if it isn't already on the queue - andmoving it to the front if it is already queued. If we don't queue it, wehave to put the ref we obtained by dequeuing it.Also, MSG_PEEK doesn't dequeue the call so shouldn't callrxrpc_notify_socket() for the call if we didn't use up all the data on thequeue, so fix that also. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23083.md b/2026/CVE-2026-23083.md index cec9f63ef1..f86bb7bef4 100644 --- a/2026/CVE-2026-23083.md +++ b/2026/CVE-2026-23083.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=23461551c00628c3f3fe9cf837bf53cf8f212b63%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:fou: Don't al #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23084.md b/2026/CVE-2026-23084.md index d3a7256635..e0a6c49048 100644 --- a/2026/CVE-2026-23084.md +++ b/2026/CVE-2026-23084.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=95046b927a54f461766f83a212c6a93bc5fd2e67%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:be2net: Fix N #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23086.md b/2026/CVE-2026-23086.md index 39b0515b34..540167abdb 100644 --- a/2026/CVE-2026-23086.md +++ b/2026/CVE-2026-23086.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=06a8fc78367d070720af960dcecec917d3ae5f3b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:vsock/virtio: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23087.md b/2026/CVE-2026-23087.md index 90adaa94c5..a3cc765418 100644 --- a/2026/CVE-2026-23087.md +++ b/2026/CVE-2026-23087.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d9d660f6e562a47b4065eeb7e538910b0471b988%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:scsi: xen: sc #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23095.md b/2026/CVE-2026-23095.md index 208cd0565c..49f16b460a 100644 --- a/2026/CVE-2026-23095.md +++ b/2026/CVE-2026-23095.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=37dd0247797b168ad1cc7f5dbec825a1ee66535b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:gue: Fix skb #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23100.md b/2026/CVE-2026-23100.md index 7b66fa7f0c..696e24da27 100644 --- a/2026/CVE-2026-23100.md +++ b/2026/CVE-2026-23100.md @@ -1,6 +1,7 @@ ### [CVE-2026-23100](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23100) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=02333ac1c35370517a19a4a131332a9690c6a5c7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2e31443a0d18ae43b9d29e02bf0563f07772193d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.10.239%20&color=brightgreen) @@ -15,6 +16,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=94b4b41d0cdf5cfd4d4325bc0e6e9e0d0e996133%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -26,6 +28,8 @@ In the Linux kernel, the following vulnerability has been resolved:mm/hugetlb: f #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23103.md b/2026/CVE-2026-23103.md index 21c780ac7c..e57f840851 100644 --- a/2026/CVE-2026-23103.md +++ b/2026/CVE-2026-23103.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8230819494b3bf284ca7262ac5f877333147b937%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipvlan: Make #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23110.md b/2026/CVE-2026-23110.md index 83e64b5876..b6cf82f447 100644 --- a/2026/CVE-2026-23110.md +++ b/2026/CVE-2026-23110.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6eb045e092efefafc6687409a6fa6d1dabf0fb69%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:scsi: core: W #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23111.md b/2026/CVE-2026-23111.md index 8f5368eb5f..ab96cfe420 100644 --- a/2026/CVE-2026-23111.md +++ b/2026/CVE-2026-23111.md @@ -14,6 +14,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=628bd3e49cba1c066228e23d71a852c23e26da73%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a136b7942ad2a50de708f76ea299ccb45ac7a7f9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bc9f791d2593f17e39f87c6e2b3a36549a3705b1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d60be2da67d172aecf866302c91ea11533eca4d9%20&color=brightgreen) @@ -30,6 +31,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23113.md b/2026/CVE-2026-23113.md index ee85151791..719d1e8e95 100644 --- a/2026/CVE-2026-23113.md +++ b/2026/CVE-2026-23113.md @@ -1,9 +1,11 @@ ### [CVE-2026-23113](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23113) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c60eb049f4a19ddddcd3ee97a9c79ab8066a6a03%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:io_uring/io-w #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23141.md b/2026/CVE-2026-23141.md new file mode 100644 index 0000000000..5342792332 --- /dev/null +++ b/2026/CVE-2026-23141.md @@ -0,0 +1,20 @@ +### [CVE-2026-23141](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23141) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=82bfb2e7b645c8f228dc3b6d3b27b0b10125ca4f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:btrfs: send: check for inline extents in range_is_hole_in_parent()Before accessing the disk_bytenr field of a file extent item we needto check if we are dealing with an inline extent.This is because for inline extents their data starts at the offset ofthe disk_bytenr field. So accessing the disk_bytenrmeans we are accessing inline data or in case the inline data is lessthan 8 bytes we can actually cause an invalidmemory access if this inline extent item is the first item in the leafor access metadata from other items. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23154.md b/2026/CVE-2026-23154.md index 8a95abb574..bce6188d6a 100644 --- a/2026/CVE-2026-23154.md +++ b/2026/CVE-2026-23154.md @@ -1,10 +1,12 @@ ### [CVE-2026-23154](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23154) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9fd1ff5d2ac7181844735806b0a703c942365291%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: fix segm #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23157.md b/2026/CVE-2026-23157.md new file mode 100644 index 0000000000..f3229efc25 --- /dev/null +++ b/2026/CVE-2026-23157.md @@ -0,0 +1,20 @@ +### [CVE-2026-23157](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23157) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.29%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=793955bca66c99defdffc857ae6eb7e8431d6bbe%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:btrfs: do not strictly require dirty metadata threshold for metadata writepages[BUG]There is an internal report that over 1000 processes arewaiting at the io_schedule_timeout() of balance_dirty_pages(), causinga system hang and trigger a kernel coredump.The kernel is v6.4 kernel based, but the root problem still applies toany upstream kernel before v6.18.[CAUSE]From Jan Kara for his wisdom on the dirty page balance behavior first. This cgroup dirty limit was what was actually playing the role here because the cgroup had only a small amount of memory and so the dirty limit for it was something like 16MB. Dirty throttling is responsible for enforcing that nobody can dirty (significantly) more dirty memory than there's dirty limit. Thus when a task is dirtying pages it periodically enters into balance_dirty_pages() and we let it sleep there to slow down the dirtying. When the system is over dirty limit already (either globally or within a cgroup of the running task), we will not let the task exit from balance_dirty_pages() until the number of dirty pages drops below the limit. So in this particular case, as I already mentioned, there was a cgroup with relatively small amount of memory and as a result with dirty limit set at 16MB. A task from that cgroup has dirtied about 28MB worth of pages in btrfs btree inode and these were practically the only dirty pages in that cgroup.So that means the only way to reduce the dirty pages of that cgroup isto writeback the dirty pages of btrfs btree inode, and only after thatthose processes can exit balance_dirty_pages().Now back to the btrfs part, btree_writepages() is responsible forwriting back dirty btree inode pages.The problem here is, there is a btrfs internal threshold that if thebtree inode's dirty bytes are below the 32M threshold, it will notdo any writeback.This behavior is to batch as much metadata as possible so we won't writeback those tree blocks and then later re-COW them again for anothermodification.This internal 32MiB is higher than the existing dirty page size (28MiB),meaning no writeback will happen, causing a deadlock between btrfs andcgroup:- Btrfs doesn't want to write back btree inode until more dirty pages- Cgroup/MM doesn't want more dirty pages for btrfs btree inode Thus any process touching that btree inode is put into sleep until the number of dirty pages is reduced.Thanks Jan Kara a lot for the analysis of the root cause.[ENHANCEMENT]Since kernel commit b55102826d7d ("btrfs: set AS_KERNEL_FILE on thebtree_inode"), btrfs btree inode pages will only be charged to the rootcgroup which should have a much larger limit than btrfs' 32MiBthreshold.So it should not affect newer kernels.But for all current LTS kernels, they are all affected by this problem,and backporting the whole AS_KERNEL_FILE may not be a good idea.Even for newer kernels I still think it's a good idea to getrid of the internal threshold at btree_writepages(), since for most casescgroup/MM has a better view of full system memory usage than btrfs' fixedthreshold.For internal callers using btrfs_btree_balance_dirty() since thatfunction is already doing internal threshold check, we don't need tobother them.But for external callers of btree_writepages(), just respect theirrequests and write back whatever they want, ignoring the internalbtrfs threshold to avoid such deadlock on btree inode dirty pagebalancing. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23204.md b/2026/CVE-2026-23204.md index bf9fde2560..39975b9166 100644 --- a/2026/CVE-2026-23204.md +++ b/2026/CVE-2026-23204.md @@ -1,9 +1,11 @@ ### [CVE-2026-23204](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23204) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.35%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: cl #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23231.md b/2026/CVE-2026-23231.md index 97cd5c292e..ebba3e6ae9 100644 --- a/2026/CVE-2026-23231.md +++ b/2026/CVE-2026-23231.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=91c7b38dc9f0de4f7f444b796d14476bc12df7bc%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -18,6 +19,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23242.md b/2026/CVE-2026-23242.md index 0fd89c2084..fb30614a40 100644 --- a/2026/CVE-2026-23242.md +++ b/2026/CVE-2026-23242.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8b6a361b8c482f22ac99c3273285ff16b23fba91%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:RDMA/siw: Fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23243.md b/2026/CVE-2026-23243.md index fb3d0897dc..cc2e509594 100644 --- a/2026/CVE-2026-23243.md +++ b/2026/CVE-2026-23243.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2be8e3ee8efd6f99ce454115c29d09750915021a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:RDMA/umad: Re #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23245.md b/2026/CVE-2026-23245.md index 1145f5f668..db67389c20 100644 --- a/2026/CVE-2026-23245.md +++ b/2026/CVE-2026-23245.md @@ -1,9 +1,11 @@ ### [CVE-2026-23245](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23245) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a51c328df3106663879645680609eb49b3ff6444%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: ac #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23253.md b/2026/CVE-2026-23253.md new file mode 100644 index 0000000000..09aae94f4e --- /dev/null +++ b/2026/CVE-2026-23253.md @@ -0,0 +1,20 @@ +### [CVE-2026-23253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23253) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=34731df288a5ffe4b0c396caf8cd24c6a710a222%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:media: dvb-core: fix wrong reinitialization of ringbuffer on reopendvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens theDVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), whichreinitializes the waitqueue list head to empty.Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of thesame DVR device share it), this orphans any existing waitqueue entriesfrom io_uring poll or epoll, leaving them with stale prev/next pointerswhile the list head is reset to {self, self}.The waitqueue and spinlock in dvr_buffer are already properlyinitialized once in dvb_dmxdev_init(). The open path only needs toreset the buffer data pointer, size, and read/write positions.Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with directassignment of data/size and a call to dvb_ringbuffer_reset(), whichproperly resets pread, pwrite, and error with correct memory orderingwithout touching the waitqueue or spinlock. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23255.md b/2026/CVE-2026-23255.md index 56fcc69654..c69b9c202c 100644 --- a/2026/CVE-2026-23255.md +++ b/2026/CVE-2026-23255.md @@ -1,9 +1,11 @@ ### [CVE-2026-23255](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23255) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: add prop #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23270.md b/2026/CVE-2026-23270.md index ec545e2b8f..74f79aad72 100644 --- a/2026/CVE-2026-23270.md +++ b/2026/CVE-2026-23270.md @@ -1,6 +1,7 @@ ### [CVE-2026-23270](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0b5b831122fc3789fff75be433ba3e4dd7b779d4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=172ba7d46c202e679f3ccb10264c67416aaeb1c4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3f14b377d01d8357eba032b4cabc8c1149b458b6%20&color=brightgreen) @@ -12,6 +13,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=73f7da5fd124f2cda9161e2e46114915e6e82e97%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f5346df0591d10bc948761ca854b1fae6d2ef441%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -24,6 +26,8 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: On #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23271.md b/2026/CVE-2026-23271.md index f9c71ceb04..f9d32f2f8b 100644 --- a/2026/CVE-2026-23271.md +++ b/2026/CVE-2026-23271.md @@ -1,10 +1,12 @@ ### [CVE-2026-23271](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23271) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.31%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=592903cdcbf606a838056bae6d03fc557806c914%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:perf: Fix __p #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23272.md b/2026/CVE-2026-23272.md new file mode 100644 index 0000000000..d403d33d13 --- /dev/null +++ b/2026/CVE-2026-23272.md @@ -0,0 +1,22 @@ +### [CVE-2026-23272](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23272) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=35d0ac9070ef619e3bf44324375878a1c540387b%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.9.33%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=fefdd79403e89b0c673965343b92e2e01e2713a8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: unconditionally bump set->nelems before insertionIn case that the set is full, a new element gets published then removedwithout waiting for the RCU grace period, while RCU reader can bewalking over it already.To address this issue, add the element transaction even if set is full,but toggle the set_full flag to report -ENFILE so the abort path safelyunwinds the set to its previous state.As for element updates, decrement set->nelems to restore it.A simpler fix is to call synchronize_rcu() in the error path.However, with a large batch adding elements to already maxed-out set,this could cause noticeable slowdown of such batches. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23273.md b/2026/CVE-2026-23273.md index 1e967c93b2..6fc470a676 100644 --- a/2026/CVE-2026-23273.md +++ b/2026/CVE-2026-23273.md @@ -1,6 +1,7 @@ ### [CVE-2026-23273](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23273) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=11ba9f0dc865136174cb98834280fb21bbc950c7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.10.250%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.15.200%20&color=brightgreen) @@ -13,6 +14,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=986967a162142710076782d5b93daab93a892980%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c43d0e787cbba569ec9d11579ed370b50fab6c9c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cdedcd5aa3f3cb8b7ae0f87ab3a936d0bd583d66%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=da5c6b8ae47e414be47e5e04def15b25d5c962dc%20&color=brightgreen) @@ -28,6 +30,8 @@ In the Linux kernel, the following vulnerability has been resolved:macvlan: obse #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23274.md b/2026/CVE-2026-23274.md index ea96ab524f..0df36f11a7 100644 --- a/2026/CVE-2026-23274.md +++ b/2026/CVE-2026-23274.md @@ -1,10 +1,12 @@ ### [CVE-2026-23274](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23274) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=68983a354a655c35d3fb204489d383a2a051fda7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: xt #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23277.md b/2026/CVE-2026-23277.md index d59738b8a7..a37c9d9a33 100644 --- a/2026/CVE-2026-23277.md +++ b/2026/CVE-2026-23277.md @@ -1,10 +1,12 @@ ### [CVE-2026-23277](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23277) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=039f50629b7f860f36644ed1f34b27da9aa62f43%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: te #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23278.md b/2026/CVE-2026-23278.md new file mode 100644 index 0000000000..7c42afaac5 --- /dev/null +++ b/2026/CVE-2026-23278.md @@ -0,0 +1,32 @@ +### [CVE-2026-23278](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23278) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3c7ec098e3b588434a8b07ea9b5b36f04cef1f50%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19.316%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.188%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.121%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.262%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.36%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.3.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=628bd3e49cba1c066228e23d71a852c23e26da73%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a136b7942ad2a50de708f76ea299ccb45ac7a7f9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=bc9f791d2593f17e39f87c6e2b3a36549a3705b1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d60be2da67d172aecf866302c91ea11533eca4d9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_tables: always walk all pending catchall elementsDuring transaction processing we might have more than one catchall element:1 live catchall element and 1 pending element that is coming as part of thenew batch.If the map holding the catchall elements is also going away, itsrequired to toggle all catchall elements and not just the first viablecandidate.Otherwise, we get: WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404 RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables] [..] __nft_set_elem_destroy+0x106/0x380 [nf_tables] nf_tables_abort_release+0x348/0x8d0 [nf_tables] nf_tables_abort+0xcf2/0x3ac0 [nf_tables] nfnetlink_rcv_batch+0x9c9/0x20e0 [..] + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23279.md b/2026/CVE-2026-23279.md new file mode 100644 index 0000000000..c3cd13357c --- /dev/null +++ b/2026/CVE-2026-23279.md @@ -0,0 +1,20 @@ +### [CVE-2026-23279](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23279) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8f2535b92d685c68db4bc699dd78462a646f6ef9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()In mesh_rx_csa_frame(), elems->mesh_chansw_params_ie is dereferencedat lines 1638 and 1642 without a prior NULL check: ifmsh->chsw_ttl = elems->mesh_chansw_params_ie->mesh_ttl; ... pre_value = le16_to_cpu(elems->mesh_chansw_params_ie->mesh_pre_value);The mesh_matches_local() check above only validates the Mesh ID,Mesh Configuration, and Supported Rates IEs. It does not verify thepresence of the Mesh Channel Switch Parameters IE (element ID 118).When a received CSA action frame omits that IE, ieee802_11_parse_elems()leaves elems->mesh_chansw_params_ie as NULL, and the unconditionaldereference causes a kernel NULL pointer dereference.A remote mesh peer with an established peer link (PLINK_ESTAB) cantrigger this by sending a crafted SPECTRUM_MGMT/CHL_SWITCH action framethat includes a matching Mesh ID and Mesh Configuration IE but omits theMesh Channel Switch Parameters IE. No authentication beyond the defaultopen mesh peering is required.Crash confirmed on kernel 6.17.0-5-generic via mac80211_hwsim: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:ieee80211_mesh_rx_queued_mgmt+0x143/0x2a0 [mac80211] CR2: 0000000000000000Fix by adding a NULL check for mesh_chansw_params_ie aftermesh_matches_local() returns, consistent with how other optional IEsare guarded throughout the mesh code.The bug has been present since v3.13 (released 2014-01-19). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23281.md b/2026/CVE-2026-23281.md new file mode 100644 index 0000000000..07d45f3a50 --- /dev/null +++ b/2026/CVE-2026-23281.md @@ -0,0 +1,20 @@ +### [CVE-2026-23281](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23281) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.24%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=954ee164f4f4598afc172c0ec3865d0352e55a0b%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: libertas: fix use-after-free in lbs_free_adapter()The lbs_free_adapter() function uses timer_delete() (non-synchronous)for both command_timer and tx_lockup_timer before the structure isfreed. This is incorrect because timer_delete() does not wait forany running timer callback to complete.If a timer callback is executing when lbs_free_adapter() is called,the callback will access freed memory since lbs_cfg_free() frees thecontaining structure immediately after lbs_free_adapter() returns.Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler)access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields,which would all be use-after-free violations.Use timer_delete_sync() instead to ensure any running timer callbackhas completed before returning.This bug was introduced in commit 8f641d93c38a ("libertas: detect TXlockups and reset hardware") where del_timer() was used instead ofdel_timer_sync() in the cleanup path. The command_timer has had thesame issue since the driver was first written. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23284.md b/2026/CVE-2026-23284.md index 4ed1685f05..ba11c68bba 100644 --- a/2026/CVE-2026-23284.md +++ b/2026/CVE-2026-23284.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=7c26c20da5d420cde55618263be4aa2f6de53056%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: ethernet #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23287.md b/2026/CVE-2026-23287.md index 810b73aba0..7063d75dc6 100644 --- a/2026/CVE-2026-23287.md +++ b/2026/CVE-2026-23287.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cc9f04f9a84f745949e325661550ed14bd0ff322%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:irqchip/sifiv #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23290.md b/2026/CVE-2026-23290.md index ec5e06db1d..4eef7e2483 100644 --- a/2026/CVE-2026-23290.md +++ b/2026/CVE-2026-23290.md @@ -1,10 +1,12 @@ ### [CVE-2026-23290](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23290) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: usb: peg #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23291.md b/2026/CVE-2026-23291.md new file mode 100644 index 0000000000..e0182ba762 --- /dev/null +++ b/2026/CVE-2026-23291.md @@ -0,0 +1,20 @@ +### [CVE-2026-23291](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23291) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c46ee38620a2aa2b25b16bc9738ace80dbff76a4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:nfc: pn533: properly drop the usb interface reference on disconnectWhen the device is disconnected from the driver, there is a "dangling"reference count on the usb interface that was grabbed in the probecallback. Fix this up by properly dropping the reference after we aredone with it. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23292.md b/2026/CVE-2026-23292.md new file mode 100644 index 0000000000..701ab0510d --- /dev/null +++ b/2026/CVE-2026-23292.md @@ -0,0 +1,26 @@ +### [CVE-2026-23292](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23292) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=09e21253d17f53bdb5aac0e0dbd057a29fcbe8d1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0dfc45be875a378c2a3a4d6ed8e668ec8eb75073%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.14.154%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19.84%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.9.201%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=49824b5c875087a52672b0c8e8ecbefe6f773532%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=b0841eefd9693827afb9888235e26ddd098f9cef%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:scsi: target: Fix recursive locking in __configfs_open_file()In flush_write_buffer, &p->frag_sem is acquired and then the loaded storefunction is called, which, here, is target_core_item_dbroot_store(). Thisfunction called filp_open(), following which these functions were called(in reverse order), according to the call trace: down_read __configfs_open_file do_dentry_open vfs_open do_open path_openat do_filp_open file_open_name filp_open target_core_item_dbroot_store flush_write_buffer configfs_write_itertarget_core_item_dbroot_store() tries to validate the new file path bytrying to open the file path provided to it; however, in this case, the bugreport shows:db_root: not a directory: /sys/kernel/config/target/dbrootindicating that the same configfs file was tried to be opened, on which itis currently working on. Thus, it is trying to acquire frag_sem semaphoreof the same file of which it already holds the semaphore obtained inflush_write_buffer(), leading to acquiring the semaphore in a nested mannerand a possibility of recursive locking.Fix this by modifying target_core_item_dbroot_store() to use kern_path()instead of filp_open() to avoid opening the file using filesystem-specificfunction __configfs_open_file(), and further modifying it to make this fixcompatible. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23293.md b/2026/CVE-2026-23293.md index f0cf6f414a..e02cb88f76 100644 --- a/2026/CVE-2026-23293.md +++ b/2026/CVE-2026-23293.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e15a00aafa4b7953ad717d3cb1ad7acf4ff76945%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: vxlan: f #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23296.md b/2026/CVE-2026-23296.md new file mode 100644 index 0000000000..8faf768343 --- /dev/null +++ b/2026/CVE-2026-23296.md @@ -0,0 +1,26 @@ +### [CVE-2026-23296](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23296) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2e7eb4c1e8af8385de22775bd0be552f59b28c9a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.223%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.164%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.19.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5ce8fad941233e81f2afb5b52a3fcddd3ba8732f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8fe4ce5836e932f5766317cb651c1ff2a4cd0506%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f818708eeeae793e12dc39f8984ed7732048a7d9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:scsi: core: Fix refcount leak for tagset_refcntThis leak will cause a hang when tearing down the SCSI host. For example,iscsid hangs with the following call trace:[130120.652718] scsi_alloc_sdev: Allocation failure during SCSI scanning, some SCSI devices might not be configuredPID: 2528 TASK: ffff9d0408974e00 CPU: 3 COMMAND: "iscsid" #0 [ffffb5b9c134b9e0] __schedule at ffffffff860657d4 #1 [ffffb5b9c134ba28] schedule at ffffffff86065c6f #2 [ffffb5b9c134ba40] schedule_timeout at ffffffff86069fb0 #3 [ffffb5b9c134bab0] __wait_for_common at ffffffff8606674f #4 [ffffb5b9c134bb10] scsi_remove_host at ffffffff85bfe84b #5 [ffffb5b9c134bb30] iscsi_sw_tcp_session_destroy at ffffffffc03031c4 [iscsi_tcp] #6 [ffffb5b9c134bb48] iscsi_if_recv_msg at ffffffffc0292692 [scsi_transport_iscsi] #7 [ffffb5b9c134bb98] iscsi_if_rx at ffffffffc02929c2 [scsi_transport_iscsi] #8 [ffffb5b9c134bbf0] netlink_unicast at ffffffff85e551d6 #9 [ffffb5b9c134bc38] netlink_sendmsg at ffffffff85e554ef + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23300.md b/2026/CVE-2026-23300.md index bcdc46a5a5..5d9799bd39 100644 --- a/2026/CVE-2026-23300.md +++ b/2026/CVE-2026-23300.md @@ -1,10 +1,12 @@ ### [CVE-2026-23300](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23300) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=493ced1ac47c48bb86d9d4e8e87df8592be85a0e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: ipv6: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23302.md b/2026/CVE-2026-23302.md new file mode 100644 index 0000000000..7a82bd63b6 --- /dev/null +++ b/2026/CVE-2026-23302.md @@ -0,0 +1,20 @@ +### [CVE-2026-23302](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23302) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=604326b41a6fb9b4a78b6179335decee0365cd8c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: annotate data-races around sk->sk_{data_ready,write_space}skmsg (and probably other layers) are changing these pointerswhile other cpus might read them concurrently.Add corresponding READ_ONCE()/WRITE_ONCE() annotationsfor UDP, TCP and AF_UNIX. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23303.md b/2026/CVE-2026-23303.md new file mode 100644 index 0000000000..f9ef88f7ec --- /dev/null +++ b/2026/CVE-2026-23303.md @@ -0,0 +1,20 @@ +### [CVE-2026-23303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23303) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8a8798a5ff90977d6459ce1d657cf8fe13a51e97%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:smb: client: Don't log plaintext credentials in cifs_set_cifscredsWhen debug logging is enabled, cifs_set_cifscreds() logs the keypayload and exposes the plaintext username and password. Remove thedebug log to avoid exposing credentials. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23304.md b/2026/CVE-2026-23304.md index 5c587f9333..a89374aafb 100644 --- a/2026/CVE-2026-23304.md +++ b/2026/CVE-2026-23304.md @@ -1,10 +1,12 @@ ### [CVE-2026-23304](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23304) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4832c30d5458387ff2533ff66fbde26ad8bb5a2d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: fix NUL #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23310.md b/2026/CVE-2026-23310.md new file mode 100644 index 0000000000..cfbad69c5f --- /dev/null +++ b/2026/CVE-2026-23310.md @@ -0,0 +1,20 @@ +### [CVE-2026-23310](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23310) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=39a0876d595bd7c7512782dfcce0ee66f65bf221%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loadedbond_option_mode_set() already rejects mode changes that would make aloaded XDP program incompatible via bond_xdp_check(). However,bond_option_xmit_hash_policy_set() has no such guard.For 802.3ad and balance-xor modes, bond_xdp_check() returns false whenxmit_hash_policy is vlan+srcmac, because the 802.1q payload is usuallyabsent due to hardware offload. This means a user can:1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode with a compatible xmit_hash_policy (e.g. layer2+3).2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded.This leaves bond->xdp_prog set but bond_xdp_check() now returning falsefor the same device. When the bond is later destroyed, dev_xdp_uninstall()calls bond_xdp_set(dev, NULL, NULL) to remove the program, which hitsthe bond_xdp_check() guard and returns -EOPNOTSUPP, triggering:WARN_ON(dev_xdp_install(dev, mode, bpf_op, NULL, 0, NULL))Fix this by rejecting xmit_hash_policy changes to vlan+srcmac when anXDP program is loaded on a bond in 802.3ad or balance-xor mode.commit 39a0876d595b ("net, bonding: Disallow vlan+srcmac with XDP")introduced bond_xdp_check() which returns false for 802.3ad/balance-xormodes when xmit_hash_policy is vlan+srcmac. The check was wired intobond_xdp_set() to reject XDP attachment with an incompatible policy, butthe symmetric path -- preventing xmit_hash_policy from being changed to anincompatible value after XDP is already loaded -- was left unguarded inbond_option_xmit_hash_policy_set().Note:commit 094ee6017ea0 ("bonding: check xdp prog when set bond mode")later added a similar guard to bond_option_mode_set(), butbond_option_xmit_hash_policy_set() remained unprotected. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23312.md b/2026/CVE-2026-23312.md new file mode 100644 index 0000000000..c26b1567d4 --- /dev/null +++ b/2026/CVE-2026-23312.md @@ -0,0 +1,20 @@ +### [CVE-2026-23312](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23312) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: usb: kaweth: validate USB endpointsThe kaweth driver should validate that the device it is probing has theproper number and types of USB endpoints it is expecting before it bindsto it. If a malicious device were to not have the same urbs the driverwill crash later on when it blindly accesses these endpoints. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23315.md b/2026/CVE-2026-23315.md new file mode 100644 index 0000000000..664c3955b3 --- /dev/null +++ b/2026/CVE-2026-23315.md @@ -0,0 +1,20 @@ +### [CVE-2026-23315](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23315) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=577dbc6c656da6997dddc6cf842b7954588f2d4e%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()Check frame length before accessing the mgmt fields inmt76_connac2_mac_write_txwi_80211 in order to avoid a possible oobaccess.[fix check to also cover mgmt->u.action.u.addba_req.capab,correct Fixes tag] + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23317.md b/2026/CVE-2026-23317.md new file mode 100644 index 0000000000..405ee0d29f --- /dev/null +++ b/2026/CVE-2026-23317.md @@ -0,0 +1,22 @@ +### [CVE-2026-23317](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23317) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7ac9578e45b20e3f3c0c8eb71f5417a499a7226a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a309c7194e8a2f8bd4539b9449917913f6c2cd50%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:drm/vmwgfx: Return the correct value in vmw_translate_ptr functionsBefore the referenced fixes these functions used a lookup function thatreturned a pointer. This was changed to another lookup function thatreturned an error code with the pointer becoming an out parameter.The error path when the lookup failed was not changed to reflect thischange and the code continued to return the PTR_ERR of the nowuninitialized pointer. This could cause the vmw_translate_ptr functionsto return success when they actually failed causing further uninitializedand OOB accesses. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23318.md b/2026/CVE-2026-23318.md new file mode 100644 index 0000000000..31c3b4a761 --- /dev/null +++ b/2026/CVE-2026-23318.md @@ -0,0 +1,24 @@ +### [CVE-2026-23318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23318) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=17821e2fb16752f5d363fb5c3f8aab4df41b9bcc%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19.84%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.3.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=57f8770620e9b51c61089751f0b5ad3dbe376ff2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=bf74a46aebb1b5ab5e5f25bafa4ae0a453ba813a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ALSA: usb-audio: Use correct version for UAC3 header validationThe entry of the validators table for UAC3 AC header descriptor isdefined with the wrong protocol version UAC_VERSION_2, while it shouldhave been UAC_VERSION_3. This results in the validator never matchingfor actual UAC3 devices (protocol == UAC_VERSION_3), causing theirheader descriptors to bypass validation entirely. A malicious USBdevice presenting a truncated UAC3 header could exploit this to causeout-of-bounds reads when the driver later accesses unvalidateddescriptor fields.The bug was introduced in the same commit as the recently fixed UAC3feature unit sub-type typo, and appears to be from the same copy-pasteerror when the UAC3 section was created from the UAC2 section. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23319.md b/2026/CVE-2026-23319.md index 300c59d538..519c4f03cf 100644 --- a/2026/CVE-2026-23319.md +++ b/2026/CVE-2026-23319.md @@ -1,10 +1,12 @@ ### [CVE-2026-23319](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23319) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=69fd337a975c7e690dfe49d9cb4fe5ba1e6db44e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Fix a UA #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23321.md b/2026/CVE-2026-23321.md index d257aa2915..cf7ef4c894 100644 --- a/2026/CVE-2026-23321.md +++ b/2026/CVE-2026-23321.md @@ -1,6 +1,7 @@ ### [CVE-2026-23321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23321) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0f21cc29bc13e86512621727a4388c8a7ad2716b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.1.106%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.10.5%20&color=brightgreen) @@ -10,6 +11,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=85df533a787bf07bf4367ce2a02b822ff1fba1a3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d93cf38fad9f66397093432b8917971a92ee0146%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -22,6 +24,8 @@ In the Linux kernel, the following vulnerability has been resolved:mptcp: pm: in #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23335.md b/2026/CVE-2026-23335.md index c68350d1ee..51cccbec9f 100644 --- a/2026/CVE-2026-23335.md +++ b/2026/CVE-2026-23335.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b48c24c2d710cf34810c555dcef883a3d35a9c08%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:RDMA/irdma: F #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23336.md b/2026/CVE-2026-23336.md new file mode 100644 index 0000000000..eea7ca0ad0 --- /dev/null +++ b/2026/CVE-2026-23336.md @@ -0,0 +1,20 @@ +### [CVE-2026-23336](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23336) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1f87f7d3a3b42b20f34cb03f0fd1a41c3d0e27f3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.31%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()There is a use-after-free error in cfg80211_shutdown_all_interfaces foundby syzkaller:BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary)Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014Workqueue: events cfg80211_rfkill_block_workCall Trace: dump_stack_lvl+0x116/0x1f0 print_report+0xcd/0x630 kasan_report+0xe0/0x110 cfg80211_shutdown_all_interfaces+0x213/0x220 cfg80211_rfkill_block_work+0x1e/0x30 process_one_work+0x9cf/0x1b70 worker_thread+0x6c8/0xf10 kthread+0x3c5/0x780 ret_from_fork+0x56d/0x700 ret_from_fork_asm+0x1a/0x30 The problem arises due to the rfkill_block work is not cancelled when wiphyis being unregistered. In order to fix the issue cancel the correspondingwork in wiphy_unregister().Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23339.md b/2026/CVE-2026-23339.md new file mode 100644 index 0000000000..f63933349e --- /dev/null +++ b/2026/CVE-2026-23339.md @@ -0,0 +1,20 @@ +### [CVE-2026-23339](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23339) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6a2968aaf50c7a22fced77a5e24aa636281efca8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:nfc: nci: free skb on nci_transceive early error pathsnci_transceive() takes ownership of the skb passed by the caller,but the -EPROTO, -EINVAL, and -EBUSY error paths return withoutfreeing it.Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changesthe nci/nci_dev selftest hits the error path occasionally in NIPA,and kmemleak detects leaks:unreferenced object 0xff11000015ce6a40 (size 640): comm "nci_dev", pid 3954, jiffies 4295441246 hex dump (first 32 bytes): 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace (crc 7c40cc2a): kmem_cache_alloc_node_noprof+0x492/0x630 __alloc_skb+0x11e/0x5f0 alloc_skb_with_frags+0xc6/0x8f0 sock_alloc_send_pskb+0x326/0x3f0 nfc_alloc_send_skb+0x94/0x1d0 rawsock_sendmsg+0x162/0x4c0 do_syscall_64+0x117/0xfc0 + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23340.md b/2026/CVE-2026-23340.md index de4700deb6..bbe6026484 100644 --- a/2026/CVE-2026-23340.md +++ b/2026/CVE-2026-23340.md @@ -1,10 +1,12 @@ ### [CVE-2026-23340](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23340) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.16%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6b3ba9146fe64b9bebb6346c9dcfe3b4851de2d7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: sched: a #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23343.md b/2026/CVE-2026-23343.md index b869918fa5..1a8f125c46 100644 --- a/2026/CVE-2026-23343.md +++ b/2026/CVE-2026-23343.md @@ -1,9 +1,11 @@ ### [CVE-2026-23343](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23343) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bf25146a5595269810b1f47d048f114c5ff9f544%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:xdp: produce #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23351.md b/2026/CVE-2026-23351.md index 74e3cc3e36..287154ce7b 100644 --- a/2026/CVE-2026-23351.md +++ b/2026/CVE-2026-23351.md @@ -1,10 +1,12 @@ ### [CVE-2026-23351](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23351) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3c4287f62044a90e73a561aa05fc46e62da173da%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23352.md b/2026/CVE-2026-23352.md new file mode 100644 index 0000000000..99b16dd867 --- /dev/null +++ b/2026/CVE-2026-23352.md @@ -0,0 +1,22 @@ +### [CVE-2026-23352](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23352) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0aed459e8487eb6ebdb4efe8cefe1eafbc704b30%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.39.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=916f676f8dc016103f983c7ec54c18ecdbb6e349%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:x86/efi: defer freeing of boot services memoryefi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODEand EFI_BOOT_SERVICES_DATA using memblock_free_late().There are two issue with that: memblock_free_late() should be used formemory allocated with memblock_alloc() while the memory reserved withmemblock_reserve() should be freed with free_reserved_area().More acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=yefi_free_boot_services() is called before deferred initialization of thememory map is complete.Benjamin Herrenschmidt reports that this causes a leak of ~140MB ofRAM on EC2 t3a.nano instances which only have 512MB or RAM.If the freed memory resides in the areas that memory map for them isstill uninitialized, they won't be actually freed becausememblock_free_late() calls memblock_free_pages() and the latter skipsuninitialized pages.Using free_reserved_area() at this point is also problematic because__free_page() accesses the buddy of the freed page and that again mightend up in uninitialized part of the memory map.Delaying the entire efi_free_boot_services() could be problematicbecause in addition to freeing boot services memory it updatesefi.memmap without any synchronization and that's undesirable late inboot when there is concurrency.More robust approach is to only defer freeing of the EFI boot servicesmemory.Split efi_free_boot_services() in two. First efi_unmap_boot_services()collects ranges that should be freed into an array thenefi_free_boot_services() later frees them after deferred init is complete. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23356.md b/2026/CVE-2026-23356.md new file mode 100644 index 0000000000..7377913a07 --- /dev/null +++ b/2026/CVE-2026-23356.md @@ -0,0 +1,20 @@ +### [CVE-2026-23356](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23356) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=08a1ddab6df7d3c7b6341774cb1cf4b21b96a214%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()Even though we check that we "should" be able to do lc_get_cumulative()while holding the device->al_lock spinlock, it may still fail,if some other code path decided to do lc_try_lock() with bad timing.If that happened, we logged "LOGIC BUG for enr=...",but still did not return an error.The rest of the code now assumed that this request has referencesfor the relevant activity log extents.The implcations are that during an active resync, mutual exclusivity ofresync versus application IO is not guaranteed. And a potential crashat this point may not realizs that these extents could have been targetof in-flight IO and would need to be resynced just in case.Also, once the request completes, it will give up activity log references itdoes not even hold, which will trigger a BUG_ON(refcnt == 0) in lc_put().Fix:Do not crash the kernel for a condition that is harmless during normaloperation: also catch "e->refcnt == 0", not only "e == NULL"when being noisy about "al_complete_io() called on inactive extent %u\n".And do not try to be smart and "guess" whether something will work, thenbe surprised when it does not.Deal with the fact that it may or may not work. If it does not, remember apossible "partially in activity log" state (only possible for requests thatcross extent boundaries), and return an error code fromdrbd_al_begin_io_nonblock().A latter call for the same request will then resume from where we left off. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23357.md b/2026/CVE-2026-23357.md new file mode 100644 index 0000000000..d0db037221 --- /dev/null +++ b/2026/CVE-2026-23357.md @@ -0,0 +1,20 @@ +### [CVE-2026-23357](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23357) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.34%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=bf66f3736a945dd4e92d86427276c6eeab0a6c1d%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:can: mcp251x: fix deadlock in error path of mcp251x_openThe mcp251x_open() function call free_irq() in its error path with thempc_lock mutex held. But if an interrupt already occurred theinterrupt handler will be waiting for the mpc_lock and free_irq() willdeadlock waiting for the handler to finish.This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can:mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") butfor the error path.To solve this issue move the call to free_irq() after the lock isreleased. Setting `priv->force_quit = 1` beforehand ensure that the IRQhandler will exit right away once it acquired the lock. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23359.md b/2026/CVE-2026-23359.md index 2d72175a53..553f3c2524 100644 --- a/2026/CVE-2026-23359.md +++ b/2026/CVE-2026-23359.md @@ -1,9 +1,11 @@ ### [CVE-2026-23359](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23359) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=aeea1b86f9363f3feabb496534d886f082a89f21%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Fix stac #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23364.md b/2026/CVE-2026-23364.md new file mode 100644 index 0000000000..cd2f7fdc28 --- /dev/null +++ b/2026/CVE-2026-23364.md @@ -0,0 +1,20 @@ +### [CVE-2026-23364](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23364) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ksmbd: Compare MACs in constant timeTo prevent timing attacks, MAC comparisons need to be constant-time.Replace the memcmp() with the correct function, crypto_memneq(). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23365.md b/2026/CVE-2026-23365.md index c76b992503..c58b246eaf 100644 --- a/2026/CVE-2026-23365.md +++ b/2026/CVE-2026-23365.md @@ -1,9 +1,11 @@ ### [CVE-2026-23365](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23365) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d40261236e8e278cb1936cb5e934262971692b10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: usb: kal #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23367.md b/2026/CVE-2026-23367.md new file mode 100644 index 0000000000..2c23180bbe --- /dev/null +++ b/2026/CVE-2026-23367.md @@ -0,0 +1,20 @@ +### [CVE-2026-23367](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23367) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.34%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=33e5a2f776e331dc8a4379b6efb660d38f182d96%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: radiotap: reject radiotap with unknown bitsThe radiotap parser is currently only used with the radiotapnamespace (not with vendor namespaces), but if the undefinedfield 18 is used, the alignment/size is unknown as well. Inthis case, iterator->_next_ns_data isn't initialized (it'sonly set for skipping vendor namespaces), and syzbot pointsout that we later compare against this uninitialized value.Fix this by moving the rejection of unknown radiotap fieldsdown to after the in-namespace lookup, so it will really useiterator->_next_ns_data only for vendor namespaces, even incase undefined fields are present. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23368.md b/2026/CVE-2026-23368.md index 4a7011ca8b..dbf6ac8430 100644 --- a/2026/CVE-2026-23368.md +++ b/2026/CVE-2026-23368.md @@ -1,10 +1,12 @@ ### [CVE-2026-23368](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23368) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=06f502f57d0d7728f9fa0f157ec5e4111ddb98f6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.16%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: phy: reg #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23370.md b/2026/CVE-2026-23370.md index 33ab6c3283..a04e1d87cf 100644 --- a/2026/CVE-2026-23370.md +++ b/2026/CVE-2026-23370.md @@ -1,9 +1,11 @@ ### [CVE-2026-23370](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23370) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e8a60aa7404bfef37705da5607c97737073ac38d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:platform/x86: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23372.md b/2026/CVE-2026-23372.md new file mode 100644 index 0000000000..5449b7a4ba --- /dev/null +++ b/2026/CVE-2026-23372.md @@ -0,0 +1,20 @@ +### [CVE-2026-23372](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23372) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=23b7869c0fd08d73c9f83a2db88a13312d6198bb%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:nfc: rawsock: cancel tx_work before socket teardownIn rawsock_release(), cancel any pending tx_work and purge the writequeue before orphaning the socket. rawsock_tx_work runs on the systemworkqueue and calls nfc_data_exchange which dereferences the NCIdevice. Without synchronization, tx_work can race with socket anddevice teardown when a process is killed (e.g. by SIGKILL), leadingto use-after-free or leaked references.Set SEND_SHUTDOWN first so that if tx_work is already running it willsee the flag and skip transmitting, then use cancel_work_sync to waitfor any in-progress execution to finish, and finally purge anyremaining queued skbs. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23378.md b/2026/CVE-2026-23378.md index 96f3e86736..dee8c0da27 100644 --- a/2026/CVE-2026-23378.md +++ b/2026/CVE-2026-23378.md @@ -1,9 +1,11 @@ ### [CVE-2026-23378](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23378) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=aa9fd9a325d51fa0b11153b03b8fefff569fa955%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: ac #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23379.md b/2026/CVE-2026-23379.md index 5096a6ed46..e4f39e556d 100644 --- a/2026/CVE-2026-23379.md +++ b/2026/CVE-2026-23379.md @@ -1,9 +1,11 @@ ### [CVE-2026-23379](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23379) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d35eb52bd2ac7557b62bda52668f2e64dde2cf90%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: et #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23381.md b/2026/CVE-2026-23381.md index 0f4944466c..89d95e08d8 100644 --- a/2026/CVE-2026-23381.md +++ b/2026/CVE-2026-23381.md @@ -1,9 +1,11 @@ ### [CVE-2026-23381](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23381) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ed842faeb2bd49256f00485402f3113205f91d30%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: bridge: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23382.md b/2026/CVE-2026-23382.md new file mode 100644 index 0000000000..e747d27944 --- /dev/null +++ b/2026/CVE-2026-23382.md @@ -0,0 +1,20 @@ +### [CVE-2026-23382](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23382) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.35%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d0742abaa1c396a26bb3d3ce2732988cd3faa020%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing themIn commit 2ff5baa9b527 ("HID: appleir: Fix potential NULL dereference atraw event handle"), we handle the fact that raw event callbackscan happen even for a HID device that has not been "claimed" causing acrash if a broken device were attempted to be connected to the system.Fix up the remaining in-tree HID drivers that forgot to add this samecheck to resolve the same issue. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23388.md b/2026/CVE-2026-23388.md new file mode 100644 index 0000000000..f5dee5150e --- /dev/null +++ b/2026/CVE-2026-23388.md @@ -0,0 +1,20 @@ +### [CVE-2026-23388](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23388) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.29%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f400e12656ab518be107febfe2315fb1eab5a342%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Squashfs: check metadata block offset is within rangeSyzkaller reports a "general protection fault in squashfs_copy_data"This is ultimately caused by a corrupted index look-up table, whichproduces a negative metadata block offset.This is subsequently passed to squashfs_copy_data (viasquashfs_read_metadata) where the negative offset causes an out of boundsaccess.The fix is to check that the offset is within range insquashfs_read_metadata. This will trap this and other cases. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23389.md b/2026/CVE-2026-23389.md new file mode 100644 index 0000000000..80e47643ea --- /dev/null +++ b/2026/CVE-2026-23389.md @@ -0,0 +1,20 @@ +### [CVE-2026-23389](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23389) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=fcea6f3da546b93050f3534aadea7bd96c1d7349%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ice: Fix memory leak in ice_set_ringparam()In ice_set_ringparam, tx_rings and xdp_rings are allocated beforerx_rings. If the allocation of rx_rings fails, the code jumps tothe done label leaking both tx_rings and xdp_rings. Furthermore, ifthe setup of an individual Rx ring fails during the loop, the code jumpsto the free_tx label which releases tx_rings but leaks xdp_rings.Fix this by introducing a free_xdp label and updating the error paths toensure both xdp_rings and tx_rings are properly freed if rx_ringsallocation or setup fails.Compile tested only. Issue found using a prototype static analysis tooland code review. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23391.md b/2026/CVE-2026-23391.md index 45a6316bd9..10eea36db4 100644 --- a/2026/CVE-2026-23391.md +++ b/2026/CVE-2026-23391.md @@ -1,10 +1,12 @@ ### [CVE-2026-23391](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23391) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=24de58f465165298aaa8f286b2592f0163706cfe%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: xt #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23392.md b/2026/CVE-2026-23392.md index 9aed2eec52..dbe8155068 100644 --- a/2026/CVE-2026-23392.md +++ b/2026/CVE-2026-23392.md @@ -1,10 +1,12 @@ ### [CVE-2026-23392](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23392) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3b49e2e94e6ebb8b23d0955d9e898254455734f8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.16%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23395.md b/2026/CVE-2026-23395.md new file mode 100644 index 0000000000..50987b122c --- /dev/null +++ b/2026/CVE-2026-23395.md @@ -0,0 +1,20 @@ +### [CVE-2026-23395](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23395) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15f02b91056253e8cdc592888f431da0731337b8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQCurrently the code attempts to accept requests regardless of thecommand identifier which may cause multiple requests to be markedas pending (FLAG_DEFER_SETUP) which can cause more thanL2CAP_ECRED_MAX_CID(5) to be allocated in l2cap_ecred_rsp_defercausing an overflow.The spec is quite clear that the same identifier shall not be used onsubsequent requests:'Within each signaling channel a different Identifier shall be usedfor each successive request or indication.'https://www.bluetooth.com/wp-content/uploads/Files/Specification/HTML/Core-62/out/en/host/logical-link-control-and-adaptation-protocol-specification.html#UUID-32a25a06-4aa4-c6c7-77c5-dcfe3682355dSo this attempts to check if there are any channels pending with thesame identifier and rejects if any are found. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23396.md b/2026/CVE-2026-23396.md new file mode 100644 index 0000000000..e2140b7368 --- /dev/null +++ b/2026/CVE-2026-23396.md @@ -0,0 +1,20 @@ +### [CVE-2026-23396](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23396) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.26%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2e3c8736820bf72a8ad10721c7e31d36d4fa7790%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: mac80211: fix NULL deref in mesh_matches_local()mesh_matches_local() unconditionally dereferences ie->mesh_config tocompare mesh configuration parameters. When called frommesh_rx_csa_frame(), the parsed action-frame elements may not contain aMesh Configuration IE, leaving ie->mesh_config NULL and triggering akernel NULL pointer dereference.The other two callers are already safe: - ieee80211_mesh_rx_bcn_presp() checks !elems->mesh_config before calling mesh_matches_local() - mesh_plink_get_event() is only reached through mesh_process_plink_frame(), which checks !elems->mesh_config, toomesh_rx_csa_frame() is the only caller that passes raw parsed elementsto mesh_matches_local() without guarding mesh_config. An adjacentattacker can exploit this by sending a crafted CSA action frame thatincludes a valid Mesh ID IE but omits the Mesh Configuration IE,crashing the kernel.The captured crash log:Oops: general protection fault, probably for non-canonical address ...KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]Workqueue: events_unbound cfg80211_wiphy_work[...]Call Trace: ? __pfx_mesh_matches_local (net/mac80211/mesh.c:65) ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686) [...] ieee80211_iface_work (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802) [...] cfg80211_wiphy_work (net/wireless/core.c:426) process_one_work (net/kernel/workqueue.c:3280) ? assign_work (net/kernel/workqueue.c:1219) worker_thread (net/kernel/workqueue.c:3352) ? __pfx_worker_thread (net/kernel/workqueue.c:3385) kthread (net/kernel/kthread.c:436) [...] ret_from_fork_asm (net/arch/x86/entry/entry_64.S:255) This patch adds a NULL check for ie->mesh_config at the top ofmesh_matches_local() to return false early when the Mesh ConfigurationIE is absent. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23397.md b/2026/CVE-2026-23397.md index dbb0637dc7..a23b592790 100644 --- a/2026/CVE-2026-23397.md +++ b/2026/CVE-2026-23397.md @@ -1,10 +1,12 @@ ### [CVE-2026-23397](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23397) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.31%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:nfnetlink_osf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23398.md b/2026/CVE-2026-23398.md index 8b5a1ce56e..2f8e8e2970 100644 --- a/2026/CVE-2026-23398.md +++ b/2026/CVE-2026-23398.md @@ -1,10 +1,12 @@ ### [CVE-2026-23398](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23398) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:icmp: fix NUL #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23399.md b/2026/CVE-2026-23399.md index ed93085377..ef603ac026 100644 --- a/2026/CVE-2026-23399.md +++ b/2026/CVE-2026-23399.md @@ -1,9 +1,11 @@ ### [CVE-2026-23399](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23399) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=563125a73ac30d7036ae69ca35c40500562c1de4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:nf_tables: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23414.md b/2026/CVE-2026-23414.md index acc5835fc3..637654cc1b 100644 --- a/2026/CVE-2026-23414.md +++ b/2026/CVE-2026-23414.md @@ -11,6 +11,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=9f83fd0c179e0f458e824e417f9d5ad53443f685%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b8a6ff84abbcbbc445463de58704686011edc8e1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c61d4368197d65c4809d9271f3b85325a600586a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -24,6 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:tls: Purge as #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23422.md b/2026/CVE-2026-23422.md index 6f5277e5a8..94b2654d50 100644 --- a/2026/CVE-2026-23422.md +++ b/2026/CVE-2026-23422.md @@ -14,6 +14,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=77611cab5bdfff7a070ae574bbfba20a1de99d1b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f89e33c9c37f0001b730e23b3b05ab7b1ecface2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -26,6 +27,7 @@ In the Linux kernel, the following vulnerability has been resolved:dpaa2-switch: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23434.md b/2026/CVE-2026-23434.md index 2884a8d8f9..07d494331e 100644 --- a/2026/CVE-2026-23434.md +++ b/2026/CVE-2026-23434.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=92270086b7e5ada7ab381c06cc3da2e95ed17088%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:mtd: rawnand: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23438.md b/2026/CVE-2026-23438.md index 14512f5247..265f8cc6c4 100644 --- a/2026/CVE-2026-23438.md +++ b/2026/CVE-2026-23438.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: mvpp2: g #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23439.md b/2026/CVE-2026-23439.md index a155afa7f5..8895698bd1 100644 --- a/2026/CVE-2026-23439.md +++ b/2026/CVE-2026-23439.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fd384412e199b62c3ddaabd18dce86d0e164c5b9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:udp_tunnel: f #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23442.md b/2026/CVE-2026-23442.md new file mode 100644 index 0000000000..797854e682 --- /dev/null +++ b/2026/CVE-2026-23442.md @@ -0,0 +1,20 @@ +### [CVE-2026-23442](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23442) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1ababeba4a21f3dba3da3523c670b207fb2feb62%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ipv6: add NULL checks for idev in SRv6 paths__in6_dev_get() can return NULL when the device has no IPv6 configuration(e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER).Add NULL checks for idev returned by __in6_dev_get() in bothseg6_hmac_validate_skb() and ipv6_srh_rcv() to prevent potential NULLpointer dereferences. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23444.md b/2026/CVE-2026-23444.md new file mode 100644 index 0000000000..99d644f8ef --- /dev/null +++ b/2026/CVE-2026-23444.md @@ -0,0 +1,20 @@ +### [CVE-2026-23444](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23444) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=06be6b149f7e406bcf16098567f5a6c9f042bced%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failureieee80211_tx_prepare_skb() has three error paths, but only two of themfree the skb. The first error path (ieee80211_tx_prepare() returningTX_DROP) does not free it, while invoke_tx_handlers() failure and thefragmentation check both do.Add kfree_skb() to the first error path so all three are consistent,and remove the now-redundant frees in callers (ath9k, mt76,mac80211_hwsim) to avoid double-free.Document the skb ownership guarantee in the function's kdoc. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-23446.md b/2026/CVE-2026-23446.md index a44eeb5013..cb3a63fd5d 100644 --- a/2026/CVE-2026-23446.md +++ b/2026/CVE-2026-23446.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e58ba4544c7771591d1e3157bc01b4a8e4d1c3fc%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: usb: aqc #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23449.md b/2026/CVE-2026-23449.md index c5f2fd26c2..af4c53a207 100644 --- a/2026/CVE-2026-23449.md +++ b/2026/CVE-2026-23449.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=96009c7d500efdd5534e83b2e3eb2c58d4b137ae%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: te #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23450.md b/2026/CVE-2026-23450.md index fe49d5dfaf..bc04cafdb5 100644 --- a/2026/CVE-2026-23450.md +++ b/2026/CVE-2026-23450.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8270d9c21041470f58348248b9d9dcf3bf79592e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ebfee3e153f67c8b38eb94a7062ee94aa6f92708%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/smc: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23452.md b/2026/CVE-2026-23452.md index 974002b64b..8cbf33ec4b 100644 --- a/2026/CVE-2026-23452.md +++ b/2026/CVE-2026-23452.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5e928f77a09a07f9dd595bb8a489965d69a83458%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:PM: runtime: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23454.md b/2026/CVE-2026-23454.md index 43085ab815..57776065da 100644 --- a/2026/CVE-2026-23454.md +++ b/2026/CVE-2026-23454.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: mana: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23455.md b/2026/CVE-2026-23455.md index 1ae68b7054..82c4170ab4 100644 --- a/2026/CVE-2026-23455.md +++ b/2026/CVE-2026-23455.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5e35941d990123f155b02d5663e51a24f816b6f3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23456.md b/2026/CVE-2026-23456.md index 65bde03287..17c11b11e4 100644 --- a/2026/CVE-2026-23456.md +++ b/2026/CVE-2026-23456.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5e35941d990123f155b02d5663e51a24f816b6f3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23457.md b/2026/CVE-2026-23457.md index 49658f0f63..beb5d3cfda 100644 --- a/2026/CVE-2026-23457.md +++ b/2026/CVE-2026-23457.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.34%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f5b321bd37fbec9188feb1f721ab46a5ac0b35da%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23458.md b/2026/CVE-2026-23458.md index 2a920929e5..b8982760f5 100644 --- a/2026/CVE-2026-23458.md +++ b/2026/CVE-2026-23458.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e844a928431fa8f1359d1f4f2cef53d9b446bf52%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: ct #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23463.md b/2026/CVE-2026-23463.md index 815aed9f3e..492d0e79ef 100644 --- a/2026/CVE-2026-23463.md +++ b/2026/CVE-2026-23463.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c535e923bb97a4b361e89a6383693482057f8b0c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:soc: fsl: qbm #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23474.md b/2026/CVE-2026-23474.md index 132d7ef9f5..597f59c5ea 100644 --- a/2026/CVE-2026-23474.md +++ b/2026/CVE-2026-23474.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:mtd: Avoid bo #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-23475.md b/2026/CVE-2026-23475.md index e8c417e4c4..477649f57e 100644 --- a/2026/CVE-2026-23475.md +++ b/2026/CVE-2026-23475.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6598b91b5ac32bc756d7c3000a31f775d4ead1c4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:spi: fix stat #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-26151.md b/2026/CVE-2026-26151.md index 481f334bc9..398c1c547b 100644 --- a/2026/CVE-2026-26151.md +++ b/2026/CVE-2026-26151.md @@ -6,7 +6,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2023H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2024H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2025H2&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2022H3&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2023H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2026H1&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202012%20(Server%20Core%20installation)&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202012%20R2%20(Server%20Core%20installation)&color=blue) diff --git a/2026/CVE-2026-27135.md b/2026/CVE-2026-27135.md index 907cfc2a1f..820f8f495f 100644 --- a/2026/CVE-2026-27135.md +++ b/2026/CVE-2026-27135.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=%3C%201.68.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-617%3A%20Reachable%20Assertion&color=brightgreen) ### Description @@ -13,6 +14,7 @@ nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-27891.md b/2026/CVE-2026-27891.md new file mode 100644 index 0000000000..6b9a996bc4 --- /dev/null +++ b/2026/CVE-2026-27891.md @@ -0,0 +1,18 @@ +### [CVE-2026-27891](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27891) +![](https://img.shields.io/static/v1?label=Product&message=facturascripts&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202026.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%3A%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brightgreen) + +### Description + +FacturaScripts is an open source accounting and invoicing software. Versions 2026 and below contain a critical vulnerability in the Plugins::add() function. The system fails to properly validate the file paths within uploaded ZIP archives. This allows an attacker to perform a Zip Slip attack, leading to Arbitrary File Write and Remote Code Execution (RCE) by overwriting sensitive .php files outside the designated plugins directory. The vulnerability is located in Plugins.php. While the testZipFile function attempts to validate that the ZIP contains only one root folder, it does not sanitize or validate the individual file paths within that folder. An attacker can bypass this check by naming a file ValidPluginName/../../shell.php. The explode function will see ValidPluginName as the root folder, satisfying the count($folders) != 1 check. However, during extraction, the ../../ sequence triggers a path traversal, allowing the file to be written anywhere the web server has permissions the root directory. This issue is fixed in version 2026.1. + +### POC + +#### Reference +- https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-3pgc-xqg9-cfr6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31389.md b/2026/CVE-2026-31389.md index 44d1dfd465..f85efda1ae 100644 --- a/2026/CVE-2026-31389.md +++ b/2026/CVE-2026-31389.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6598b91b5ac32bc756d7c3000a31f775d4ead1c4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:spi: fix use- #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31391.md b/2026/CVE-2026-31391.md index 94c0880852..3a3cc5cda0 100644 --- a/2026/CVE-2026-31391.md +++ b/2026/CVE-2026-31391.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=da001fb651b00e1deeaf24767dd691ae8152a4f5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: atmel #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31396.md b/2026/CVE-2026-31396.md index 7dd70cc172..3aca8bdab2 100644 --- a/2026/CVE-2026-31396.md +++ b/2026/CVE-2026-31396.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c2594d804d5c8033861d44840673d852d98508c1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: macb: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31402.md b/2026/CVE-2026-31402.md index 9602abcba6..79fdd2475f 100644 --- a/2026/CVE-2026-31402.md +++ b/2026/CVE-2026-31402.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:nfsd: fix hea #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31403.md b/2026/CVE-2026-31403.md index 4cf073d026..57961ad067 100644 --- a/2026/CVE-2026-31403.md +++ b/2026/CVE-2026-31403.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=96d851c4d28de8cc83fe2bd5c6bc2eb8f253a6c5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:NFSD: Hold ne #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31407.md b/2026/CVE-2026-31407.md new file mode 100644 index 0000000000..40d438db66 --- /dev/null +++ b/2026/CVE-2026-31407.md @@ -0,0 +1,20 @@ +### [CVE-2026-31407](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31407) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.27%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a258860e01b80e8f554a4ab1a6c95e6042eb8b73%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:netfilter: conntrack: add missing netlink policy validationsHyunwoo Kim reports out-of-bounds access in sctp and ctnetlink.These attributes are used by the kernel without any validation.Extend the netlink policies accordingly.Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..] and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by UBSAN. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31411.md b/2026/CVE-2026-31411.md index b9f11d6928..973c26e541 100644 --- a/2026/CVE-2026-31411.md +++ b/2026/CVE-2026-31411.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: atm: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31414.md b/2026/CVE-2026-31414.md index 59f26cc5b0..9a7750f9e6 100644 --- a/2026/CVE-2026-31414.md +++ b/2026/CVE-2026-31414.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.30%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ea781f197d6a835cbb93a0bf88ee1696296ed8aa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31415.md b/2026/CVE-2026-31415.md index 0c82a40cf3..35bcd6ce9f 100644 --- a/2026/CVE-2026-31415.md +++ b/2026/CVE-2026-31415.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=333fad5364d6b457c8d837f7d05802d2aaf8a961%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: avoid o #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31416.md b/2026/CVE-2026-31416.md index e5fcedebd5..19a2aa076b 100644 --- a/2026/CVE-2026-31416.md +++ b/2026/CVE-2026-31416.md @@ -11,6 +11,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=9dfa1dfe4d5e5e66a991321ab08afe69759d797a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=add9183d993c12fb61ce0a674a424341d5be5b36%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b1fef6b81871a396f3b8702077333e769673c87b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -24,6 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31417.md b/2026/CVE-2026-31417.md index cc7d33b806..5e78b8aac9 100644 --- a/2026/CVE-2026-31417.md +++ b/2026/CVE-2026-31417.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/x25: Fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31418.md b/2026/CVE-2026-31418.md index c1d6e07c60..2131445143 100644 --- a/2026/CVE-2026-31418.md +++ b/2026/CVE-2026-31418.md @@ -8,6 +8,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8af1c6fbd9239877998c7f5a591cb2c88d41fb66%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d2997d64dfa65082236bca1efd596b6c935daf5e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -20,6 +21,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: ip #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31421.md b/2026/CVE-2026-31421.md index 6ad383b7ac..587d99daff 100644 --- a/2026/CVE-2026-31421.md +++ b/2026/CVE-2026-31421.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: cl #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31422.md b/2026/CVE-2026-31422.md index ed5ffde577..2e9b305d0d 100644 --- a/2026/CVE-2026-31422.md +++ b/2026/CVE-2026-31422.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: cl #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31423.md b/2026/CVE-2026-31423.md index 14aaf5d929..86b725f7a0 100644 --- a/2026/CVE-2026-31423.md +++ b/2026/CVE-2026-31423.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: sc #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31424.md b/2026/CVE-2026-31424.md index 5c5378b0b5..0efe5d38a2 100644 --- a/2026/CVE-2026-31424.md +++ b/2026/CVE-2026-31424.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=9291747f118d6404e509747b85ff5f6dfec368d2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: x_ #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31427.md b/2026/CVE-2026-31427.md index 99fba4351f..2347e2e2b9 100644 --- a/2026/CVE-2026-31427.md +++ b/2026/CVE-2026-31427.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4ab9e64e5e3c0516577818804aaf13a630d67bc9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31428.md b/2026/CVE-2026-31428.md index acf4dadee8..dc050e53fd 100644 --- a/2026/CVE-2026-31428.md +++ b/2026/CVE-2026-31428.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.24%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=df6fb868d6118686805c2fa566e213a8f31c8e4f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31441.md b/2026/CVE-2026-31441.md index c6a91dfec9..2df298005c 100644 --- a/2026/CVE-2026-31441.md +++ b/2026/CVE-2026-31441.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=da32b28c95a79e399e18c03f8178f41aec9c66e4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:dmaengine: id #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31446.md b/2026/CVE-2026-31446.md index 5b63ac0427..8f927a52d4 100644 --- a/2026/CVE-2026-31446.md +++ b/2026/CVE-2026-31446.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=585ef03c9e79672781f954daae730dfe24bf3a46%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=afe490e48d47df1b3f64012835c1bc2f075a8c8b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b98535d091795a79336f520b0708457aacf55c67%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -22,6 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: fix use #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31447.md b/2026/CVE-2026-31447.md index 9ea73230cf..d0bf7fcbfc 100644 --- a/2026/CVE-2026-31447.md +++ b/2026/CVE-2026-31447.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: reject #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31448.md b/2026/CVE-2026-31448.md index 7103f62ffa..905dc053dc 100644 --- a/2026/CVE-2026-31448.md +++ b/2026/CVE-2026-31448.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=315054f023d28ee64f308adf8b5737831541776b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: avoid i #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31449.md b/2026/CVE-2026-31449.md index a6510bb75c..8ba51d92b1 100644 --- a/2026/CVE-2026-31449.md +++ b/2026/CVE-2026-31449.md @@ -1,8 +1,10 @@ ### [CVE-2026-31449](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31449) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a86c61812637c7dd0c57e29880cffd477b62f2e7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: validat #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31450.md b/2026/CVE-2026-31450.md index 577dde576c..cf476bf476 100644 --- a/2026/CVE-2026-31450.md +++ b/2026/CVE-2026-31450.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a361293f5fedea0016a10599f409631a15d47ee7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: publish #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31451.md b/2026/CVE-2026-31451.md new file mode 100644 index 0000000000..9282cb88bd --- /dev/null +++ b/2026/CVE-2026-31451.md @@ -0,0 +1,20 @@ +### [CVE-2026-31451](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31451) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=46c7f254543dedcf134ad05091ed2b935a9a597d%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ext4: replace BUG_ON with proper error handling in ext4_read_inline_folioReplace BUG_ON() with proper error handling when inline data sizeexceeds PAGE_SIZE. This prevents kernel panic and allows the system tocontinue running while properly reporting the filesystem corruption.The error is logged via ext4_error_inode(), the buffer head is releasedto prevent memory leak, and -EFSCORRUPTED is returned to indicatefilesystem corruption. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31452.md b/2026/CVE-2026-31452.md index 2bd55eeda1..ce1ed41f29 100644 --- a/2026/CVE-2026-31452.md +++ b/2026/CVE-2026-31452.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=67cf5b09a46f72e048501b84996f2f77bc42e947%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: convert #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31466.md b/2026/CVE-2026-31466.md index 2e69c2ed7d..1c2f16bdaa 100644 --- a/2026/CVE-2026-31466.md +++ b/2026/CVE-2026-31466.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e9b61f19858a5d6c42ce2298cf138279375d0d9b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:mm/huge_memor #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31469.md b/2026/CVE-2026-31469.md index 969a94d4a4..6b8f6025c6 100644 --- a/2026/CVE-2026-31469.md +++ b/2026/CVE-2026-31469.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.26%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f2fc6a54585a1be6669613a31fbaba2ecbadcd36%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:virtio_net: F #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31485.md b/2026/CVE-2026-31485.md index 0be0c73917..364f809462 100644 --- a/2026/CVE-2026-31485.md +++ b/2026/CVE-2026-31485.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5314987de5e5f5e38436ef4a69328bc472bbd63e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:spi: spi-fsl- #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31488.md b/2026/CVE-2026-31488.md new file mode 100644 index 0000000000..9e87e70fe9 --- /dev/null +++ b/2026/CVE-2026-31488.md @@ -0,0 +1,20 @@ +### [CVE-2026-31488](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31488) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Do not skip unrelated mode changes in DSC validationStarting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation inatomic check"), amdgpu resets the CRTC state mode_changed flag to false whenrecomputing the DSC configuration results in no timing change for a particularstream.However, this is incorrect in scenarios where a change in MST/DSC configurationhappens in the same KMS commit as another (unrelated) mode change. For example,the integrated panel of a laptop may be configured differently (e.g., HDRenabled/disabled) depending on whether external screens are attached. In thiscase, plugging in external DP-MST screens may result in the mode_changed flagbeing dropped incorrectly for the integrated panel if its DSC configurationdid not change during precomputation in pre_validate_dsc().At this point, however, dm_update_crtc_state() has already created new streamsfor CRTCs with DSC-independent mode changes. In turn,amdgpu_dm_commit_streams() will never release the old stream, resulting in amemory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference tothe new stream either, which manifests as a use-after-free when the stream getsdisabled later on:BUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu]Write of size 4 at addr ffff88813d836524 by task kworker/9:9/29977Workqueue: events drm_mode_rmfb_work_fnCall Trace: dump_stack_lvl+0x6e/0xa0 print_address_description.constprop.0+0x88/0x320 ? dc_stream_release+0x25/0x90 [amdgpu] print_report+0xfc/0x1ff ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x225/0x4e0 ? dc_stream_release+0x25/0x90 [amdgpu] kasan_report+0xe1/0x180 ? dc_stream_release+0x25/0x90 [amdgpu] kasan_check_range+0x125/0x200 dc_stream_release+0x25/0x90 [amdgpu] dc_state_destruct+0x14d/0x5c0 [amdgpu] dc_state_release.part.0+0x4e/0x130 [amdgpu] dm_atomic_destroy_state+0x3f/0x70 [amdgpu] drm_atomic_state_default_clear+0x8ee/0xf30 ? drm_mode_object_put.part.0+0xb1/0x130 __drm_atomic_state_free+0x15c/0x2d0 atomic_remove_fb+0x67e/0x980Since there is no reliable way of figuring out whether a CRTC has unrelatedmode changes pending at the time of DSC validation, remember the value of themode_changed flag from before the point where a CRTC was marked as potentiallyaffected by a change in DSC configuration. Reset the mode_changed flag to thisearlier value instead in pre_validate_dsc().(cherry picked from commit cc7c7121ae082b7b82891baa7280f1ff2608f22b) + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31494.md b/2026/CVE-2026-31494.md index f40d682e63..1d08eaf9a6 100644 --- a/2026/CVE-2026-31494.md +++ b/2026/CVE-2026-31494.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: macb: us #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31495.md b/2026/CVE-2026-31495.md index c5e2a09f89..b307b355b4 100644 --- a/2026/CVE-2026-31495.md +++ b/2026/CVE-2026-31495.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.22%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: ct #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31496.md b/2026/CVE-2026-31496.md index d2c40fdc29..5fb218b8c1 100644 --- a/2026/CVE-2026-31496.md +++ b/2026/CVE-2026-31496.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=9b03f38d0487f3908696242286d934c9b38f9d2a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31500.md b/2026/CVE-2026-31500.md new file mode 100644 index 0000000000..60076081bb --- /dev/null +++ b/2026/CVE-2026-31500.md @@ -0,0 +1,20 @@ +### [CVE-2026-31500](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31500) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=973bb97e5aee56edddaae3d5c96877101ad509c0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lockbtintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESETand Intel exception-info retrieval) without holdinghci_req_sync_lock(). This lets it race againsthci_dev_do_close() -> btintel_shutdown_combined(), which also runs__hci_cmd_sync() under the same lock. When both paths manipulatehdev->req_status/req_rsp concurrently, the close path may free theresponse skb first, and the still-running hw_error path hits aslab-use-after-free in kfree_skb().Wrap the whole recovery sequence in hci_req_sync_lock/unlock so itis serialized with every other synchronous HCI command issuer.Below is the data race report and the kasan report: BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined read of hdev->req_rsp at net/bluetooth/hci_sync.c:199 by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254 hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030 write/free by task ioctl/22580: btintel_shutdown_combined+0xd0/0x360 drivers/bluetooth/btintel.c:3648 hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246 hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526 BUG: KASAN: slab-use-after-free in sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202 Read of size 4 at addr ffff888144a738dc by task kworker/u17:1/83: __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200 __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223 btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260 + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31503.md b/2026/CVE-2026-31503.md index d07d89fe10..9a34df47d1 100644 --- a/2026/CVE-2026-31503.md +++ b/2026/CVE-2026-31503.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=30fff9231fad757c061285e347b33c5149c2c2e4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:udp: Fix wild #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31504.md b/2026/CVE-2026-31504.md index 423636e3c4..a03572cb4a 100644 --- a/2026/CVE-2026-31504.md +++ b/2026/CVE-2026-31504.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ce06b03e60fc19c680d1bf873e779bf11c2fc518%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: fix fano #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31507.md b/2026/CVE-2026-31507.md index ea5d809070..476f9c8614 100644 --- a/2026/CVE-2026-31507.md +++ b/2026/CVE-2026-31507.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=9014db202cb764b8e14c53e7bacc81f9a1a2ba7f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/smc: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31508.md b/2026/CVE-2026-31508.md index 886ffb0805..cd411e58f3 100644 --- a/2026/CVE-2026-31508.md +++ b/2026/CVE-2026-31508.md @@ -14,6 +14,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.6.120%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b823c3344d5446b720227ba561df10a4f0add515%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c98263d5ace597c096a7a60aeef790da7b54979e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f31557fb1b35332cca9994aa196cef284bcf3807%20&color=brightgreen) @@ -28,6 +29,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: openvswi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31515.md b/2026/CVE-2026-31515.md index 397db6f3c3..0be42088ac 100644 --- a/2026/CVE-2026-31515.md +++ b/2026/CVE-2026-31515.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.21%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:af_key: valid #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31518.md b/2026/CVE-2026-31518.md index 3d4a0fdabe..254442f4db 100644 --- a/2026/CVE-2026-31518.md +++ b/2026/CVE-2026-31518.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e27cca96cd68fa2c6814c90f9a1cfd36bb68c593%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:esp: fix skb #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31521.md b/2026/CVE-2026-31521.md index be525ce599..861a1c9141 100644 --- a/2026/CVE-2026-31521.md +++ b/2026/CVE-2026-31521.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:module: Fix k #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31532.md b/2026/CVE-2026-31532.md new file mode 100644 index 0000000000..37f3636396 --- /dev/null +++ b/2026/CVE-2026-31532.md @@ -0,0 +1,20 @@ +### [CVE-2026-31532](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31532) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=514ac99c64b22d83b52dfee3b8becaa69a92bc4a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:can: raw: fix ro->uniq use-after-free in raw_rcv()raw_release() unregisters raw CAN receive filters via can_rx_unregister(),but receiver deletion is deferred with call_rcu(). This leaves a windowwhere raw_rcv() may still be running in an RCU read-side critical sectionafter raw_release() frees ro->uniq, leading to a use-after-free of thepercpu uniq storage.Move free_percpu(ro->uniq) out of raw_release() and into a raw-specificsocket destructor. can_rx_unregister() takes an extra reference to thesocket and only drops it from the RCU callback, so freeing uniq fromsk_destruct ensures the percpu area is not released until the relevantcallbacks have drained.[mkl: applied manually] + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31533.md b/2026/CVE-2026-31533.md index e498b99e21..36813b7881 100644 --- a/2026/CVE-2026-31533.md +++ b/2026/CVE-2026-31533.md @@ -11,6 +11,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8590541473188741055d27b955db0777569438e3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ab6397f072e5097f267abf5cb08a8004e6b17694%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cd1bbca03f3c1d845ce274c0d0a66de8e5929f72%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -24,6 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/tls: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31546.md b/2026/CVE-2026-31546.md index 1886a6b010..edaedbb731 100644 --- a/2026/CVE-2026-31546.md +++ b/2026/CVE-2026-31546.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.38%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=caafa84251b886feb6cdf23d50e2cc99dcdaaaf3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: bonding: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31555.md b/2026/CVE-2026-31555.md index 5b76ccb055..aec6d9f94e 100644 --- a/2026/CVE-2026-31555.md +++ b/2026/CVE-2026-31555.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=7874eee0130adf9bee28e8720bb5dd051089def3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cf16e42709aa86aa3e37f3acc3d13d5715d90096%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f2a9957e5c08b1b1caacd18a3dc4c0a1bdb7b463%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fc3b55ef2c840bb2746b2d8121a0788de84f7fac%20&color=brightgreen) @@ -26,6 +27,7 @@ In the Linux kernel, the following vulnerability has been resolved:futex: Clear #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31563.md b/2026/CVE-2026-31563.md index 52acc74a4c..51312fa43e 100644 --- a/2026/CVE-2026-31563.md +++ b/2026/CVE-2026-31563.md @@ -11,6 +11,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=7db8aa3fc4ed0a2928246747b2514b0741a8187e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a4cb0a15ab8e6d06c08229a2c7bdbe1f2454473f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=aeeafeb29b1b270302a9a85a13f7d70a68a3b9e6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -24,6 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: macb: Us #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31565.md b/2026/CVE-2026-31565.md index 060d498355..f58594cfc3 100644 --- a/2026/CVE-2026-31565.md +++ b/2026/CVE-2026-31565.md @@ -10,6 +10,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6ee53f82540769a6d6e77e40b901f9b9edfa5ff2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c8f304d75f6c6cc679a73f89591f9a915da38f09%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -22,6 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:RDMA/irdma: F #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31580.md b/2026/CVE-2026-31580.md new file mode 100644 index 0000000000..37c7f8d399 --- /dev/null +++ b/2026/CVE-2026-31580.md @@ -0,0 +1,20 @@ +### [CVE-2026-31580](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31580) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=cafe563591446cf80bfbc2fe3bc72a2e36cf1060%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:bcache: fix cached_dev.sb_bio use-after-free and crashIn our production environment, we have received multiple crash reportsregarding libceph, which have caught our attention:```[6888366.280350] Call Trace:[6888366.280452] blk_update_request+0x14e/0x370[6888366.280561] blk_mq_end_request+0x1a/0x130[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd][6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd][6888366.280903] __complete_request+0x22/0x70 [libceph][6888366.281032] osd_dispatch+0x15e/0xb40 [libceph][6888366.281164] ? inet_recvmsg+0x5b/0xd0[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph][6888366.281405] ceph_con_process_message+0x79/0x140 [libceph][6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph][6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]```After analyzing the coredump file, we found that the address ofdc->sb_bio has been freed. We know that cached_dev is only freed when itis stopped.Since sb_bio is a part of struct cached_dev, rather than an alloc everytime. If the device is stopped while writing to the superblock, thereleased address will be accessed at endio.This patch hopes to wait for sb_write to complete in cached_dev_free.It should be noted that we analyzed the cause of the problem, then tellall details to the QWEN and adopted the modifications it made. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31583.md b/2026/CVE-2026-31583.md new file mode 100644 index 0000000000..375aebee22 --- /dev/null +++ b/2026/CVE-2026-31583.md @@ -0,0 +1,20 @@ +### [CVE-2026-31583](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31583) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8139a4d583abad45eb987b5a99b3281b6d435b7e%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:media: em28xx: fix use-after-free in em28xx_v4l2_open()em28xx_v4l2_open() reads dev->v4l2 without holding dev->lock,creating a race with em28xx_v4l2_init()'s error path andem28xx_v4l2_fini(), both of which free the em28xx_v4l2 structand set dev->v4l2 to NULL under dev->lock.This race leads to two issues: - use-after-free in v4l2_fh_init() when accessing vdev->ctrl_handler, since the video_device is embedded in the freed em28xx_v4l2 struct. - NULL pointer dereference in em28xx_resolution_set() when accessing v4l2->norm, since dev->v4l2 has been set to NULL.Fix this by moving the mutex_lock() before the dev->v4l2 read andadding a NULL check for dev->v4l2 under the lock. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31586.md b/2026/CVE-2026-31586.md new file mode 100644 index 0000000000..1e2d1c44f8 --- /dev/null +++ b/2026/CVE-2026-31586.md @@ -0,0 +1,20 @@ +### [CVE-2026-31586](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31586) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=59b57717fff8b562825d9d25e0180ad7e8048ca9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesseswb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the lastreference, the blkcg can be freed asynchronously (css_free_rwork_fn ->blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences thepointer to access blkcg->online_pin, resulting in a use-after-free: BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwb_release cgwb_release_workfn Call Trace: blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwb_release_workfn (mm/backing-dev.c:629) process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385) Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) css_free_rwork_fn (kernel/cgroup/cgroup.c:5542) process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385)** Stack based on commit 66672af7a095 ("Add linux-next specific filesfor 20260410")I am seeing this crash sporadically in Meta fleet across multiple kernelversions. A full reproducer is available at:https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh(The race window is narrow. To make it easily reproducible, inject amsleep(100) between css_put() and blkcg_unpin_online() incgwb_release_workfn(). With that delay and a KASAN-enabled kernel, thereproducer triggers the splat reliably in less than a second.)Fix this by moving blkcg_unpin_online() before css_put(), so thecgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online()accesses it. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31611.md b/2026/CVE-2026-31611.md new file mode 100644 index 0000000000..45918c4f3b --- /dev/null +++ b/2026/CVE-2026-31611.md @@ -0,0 +1,20 @@ +### [CVE-2026-31611](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31611) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ksmbd: require 3 sub-authorities before reading sub_auth[2]parse_dacl() compares each ACE SID against sid_unix_NFS_mode and onmatch reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode isthe prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() comparesonly min(num_subauth, 2) sub-authorities so a client SID withnum_subauth = 2 and sub_auth = {88, 3} will match.If num_subauth = 2 and the ACE is placed at the very end of the securitydescriptor, sub_auth[2] will be 4 bytes past end_of_acl. Theout-of-band bytes will then be masked to the low 9 bits and applied asthe file's POSIX mode, probably not something that is good to havehappen.Fix this up by forcing the SID to actually carry a third sub-authoritybefore reading it at all. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31612.md b/2026/CVE-2026-31612.md new file mode 100644 index 0000000000..41bec83b33 --- /dev/null +++ b/2026/CVE-2026-31612.md @@ -0,0 +1,20 @@ +### [CVE-2026-31612](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31612) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ksmbd: validate EaNameLength in smb2_get_ea()smb2_get_ea() reads ea_req->EaNameLength from the client request andpasses it directly to strncmp() as the comparison length withoutverifying that the length of the name really is the size of the inputbuffer received.Fix this up by properly checking the size of the name based on the valuereceived and the overall size of the request, to prevent a laterstrncmp() call to use the length as a "trusted" size of the buffer.Without this check, uninitialized heap values might be slowly leaked tothe client. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31613.md b/2026/CVE-2026-31613.md new file mode 100644 index 0000000000..521d31c3d4 --- /dev/null +++ b/2026/CVE-2026-31613.md @@ -0,0 +1,22 @@ +### [CVE-2026-31613](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31613) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2d046892a493d9760c35fdaefc3017f27f91b621%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=76894f3e2f71177747b8b4763fb180e800279585%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:smb: client: fix OOB reads parsing symlink error responseWhen a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message()returns success without any length validation, leaving the symlinkparsers as the only defense against an untrusted server.symlink_data() walks SMB 3.1.1 error contexts with the loop test "p ErrorId at offset 4 and p->ErrorDataLength at offset0. When the server-controlled ErrorDataLength advances p to within 1-7bytes of end, the next iteration will read past it. When the matchingcontext is found, sym->SymLinkErrorTag is read at offset 4 fromp->ErrorContextData with no check that the symlink header itself fits.smb2_parse_symlink_response() then bounds-checks the substitute nameusing SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer fromiov_base. That value is computed as sizeof(smb2_err_rsp) +sizeof(smb2_symlink_err_rsp), which is correct only whenErrorContextCount == 0.With at least one error context the symlink data sits 8 bytes deeper,and each skipped non-matching context shifts it further by 8 +ALIGN(ErrorDataLength, 8). The check is too short, allowing thesubstitute name read to run past iov_len. The out-of-bound heap bytesare UTF-16-decoded into the symlink target and returned to userspace viareadlink(2).Fix this all up by making the loops test require the full context headerto fit, rejecting sym if its header runs past end, and bound thesubstitute name against the actual position of sym->PathBuffer ratherthan a fixed offset.Because sub_offs and sub_len are 16bits, the pointer math will notoverflow here with the new greater-than. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31617.md b/2026/CVE-2026-31617.md new file mode 100644 index 0000000000..298d053f63 --- /dev/null +++ b/2026/CVE-2026-31617.md @@ -0,0 +1,30 @@ +### [CVE-2026-31617](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31617) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2b74b0a04d3e9f9f08ff026e5663dce88ff94e52%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.14.196%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19.143%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.9.235%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=471b23586387a32857778c511be60ab31c98dcfd%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4f529c4d1e436230d3af7c09a3239677a14d2b46%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.62%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.8.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=b88ad6e714284b33a47834f5f2a294c2b37c66aa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f7e0611e207d8908c4f2858e244370529a76dbf7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()The block_len read from the host-supplied NTB header is checked againstntb_max but has no lower bound. When block_len is smaller thanopts->ndp_size, the bounds check of: ndp_index > (block_len - opts->ndp_size)will underflow producing a huge unsigned value that ndp_index can neverexceed, defeating the check entirely.The same underflow occurs in the datagram index checks against block_len- opts->dpe_size. With those checks neutered, a malicious USB host canchoose ndp_index and datagram offsets that point past the actualtransfer, and the skb_put_data() copies adjacent kernel memory into thenetwork skb.Fix this by rejecting block lengths that cannot hold at least the NTBheader plus one NDP. This will make block_len - opts->ndp_size andblock_len - opts->dpe_size both well-defined.Commit 8d2b1a1ec9f5 ("CDC-NCM: avoid overflow in sanity checking") fixeda related class of issues on the host side of NCM. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31622.md b/2026/CVE-2026-31622.md new file mode 100644 index 0000000000..79d668eacc --- /dev/null +++ b/2026/CVE-2026-31622.md @@ -0,0 +1,20 @@ +### [CVE-2026-31622](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31622) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2c66daecc4092e6049673c281b2e6f0d5e59a94c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:NFC: digital: Bounds check NFC-A cascade depth in SDD response handlerThe NFC-A anti-collision cascade in digital_in_recv_sdd_res() appends 3or 4 bytes to target->nfcid1 on each round, but the number of cascaderounds is controlled entirely by the peer device. The peer sets thecascade tag in the SDD_RES (deciding 3 vs 4 bytes) and thecascade-incomplete bit in the SEL_RES (deciding whether another roundfollows).ISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 issized accordingly (NFC_NFCID1_MAXSIZE = 10), but nothing in the driveractually enforces this. This means a malicious peer can keep thecascade running, writing past the heap-allocated nfc_target with eachround.Fix this by rejecting the response when the accumulated UID would exceedthe buffer.Commit e329e71013c9 ("NFC: nci: Bounds check struct nfc_target arrays")fixed similar missing checks against the same field on the NCI path. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31624.md b/2026/CVE-2026-31624.md new file mode 100644 index 0000000000..46a9fe775c --- /dev/null +++ b/2026/CVE-2026-31624.md @@ -0,0 +1,20 @@ +### [CVE-2026-31624](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31624) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=dde5845a529ff753364a6d1aea61180946270bfa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:HID: core: clamp report_size in s32ton() to avoid undefined shifts32ton() shifts by n-1 where n is the field's report_size, a value thatcomes directly from a HID device. The HID parser bounds report_sizeonly to <= 256, so a broken HID device can supply a report descriptorwith a wide field that triggers shift exponents up to 256 on a 32-bittype when an output report is built via hid_output_field() orhid_set_field().Commit ec61b41918587 ("HID: core: fix shift-out-of-bounds inhid_report_raw_event") added the same n > 32 clamp to the functionsnto32(), but s32ton() was never given the same fix as I guess syzbothadn't figured out how to fuzz a device the same way.Fix this up by just clamping the max value of n, just like snto32()does. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31625.md b/2026/CVE-2026-31625.md new file mode 100644 index 0000000000..0007ee0c25 --- /dev/null +++ b/2026/CVE-2026-31625.md @@ -0,0 +1,20 @@ +### [CVE-2026-31625](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31625) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=73196ebe134d11a68a2e27814c489d685cfc8b03%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:HID: alps: fix NULL pointer dereference in alps_raw_event()Commit ecfa6f34492c ("HID: Add HID_CLAIMED_INPUT guards in raw_eventcallbacks missing them") attempted to fix up the HID drivers that hadmissed the previous fix that was done in 2ff5baa9b527 ("HID: appleir:Fix potential NULL dereference at raw event handle"), but the alpsdriver was missed.Fix this up by properly checking in the hid-alps driver that it had beenclaimed correctly before attempting to process the raw event. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31628.md b/2026/CVE-2026-31628.md index 4e02516038..1123869cbb 100644 --- a/2026/CVE-2026-31628.md +++ b/2026/CVE-2026-31628.md @@ -10,6 +10,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5abd1583e06b3963e5c9d915760367de86808b78%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -22,6 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:x86/CPU: Fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31629.md b/2026/CVE-2026-31629.md new file mode 100644 index 0000000000..d01ad93a89 --- /dev/null +++ b/2026/CVE-2026-31629.md @@ -0,0 +1,20 @@ +### [CVE-2026-31629](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31629) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d646960f7986fefb460a2b062d5ccc8ccfeacc3a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:nfc: llcp: add missing return after LLCP_CLOSED checksIn nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socketstate is LLCP_CLOSED, the code correctly calls release_sock() andnfc_llcp_sock_put() but fails to return. Execution falls through tothe remainder of the function, which calls release_sock() andnfc_llcp_sock_put() again. This results in a double release_sock()and a refcount underflow via double nfc_llcp_sock_put(), leading toa use-after-free.Add the missing return statements after the LLCP_CLOSED branchesin both functions to prevent the fall-through. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31630.md b/2026/CVE-2026-31630.md new file mode 100644 index 0000000000..4c80271be5 --- /dev/null +++ b/2026/CVE-2026-31630.md @@ -0,0 +1,20 @@ +### [CVE-2026-31630](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31630) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=75b54cb57ca34cbe7a87c6ac757c55360a624590%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:rxrpc: proc: size address buffers for %pISpc outputThe AF_RXRPC procfs helpers format local and remote socket addresses intofixed 50-byte stack buffers with "%pISpc".That is too small for the longest current-tree IPv6-with-port form theformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses adotted-quad tail not only for v4mapped addresses, but also for ISATAPaddresses via ipv6_addr_is_isatap().As a result, a case such as [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535is possible with the current formatter. That is 50 visible characters, so51 bytes including the trailing NUL, which does not fit in the existingchar[50] buffers used by net/rxrpc/proc.c.Size the buffers from the formatter's maximum textual form and switch thecall sites to scnprintf().Changes since v1:- correct the changelog to cite the actual maximum current-tree case explicitly- frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31634.md b/2026/CVE-2026-31634.md index db5c4afead..f871d11ca5 100644 --- a/2026/CVE-2026-31634.md +++ b/2026/CVE-2026-31634.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.22%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:rxrpc: fix re #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31637.md b/2026/CVE-2026-31637.md new file mode 100644 index 0000000000..1ec37bba5e --- /dev/null +++ b/2026/CVE-2026-31637.md @@ -0,0 +1,20 @@ +### [CVE-2026-31637](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31637) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=17926a79320afa9b95df6b977b40cca6d8713cea%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.22%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:rxrpc: reject undecryptable rxkad response ticketsrxkad_decrypt_ticket() decrypts the RXKAD response ticket and thenparses the buffer as plaintext without checking whethercrypto_skcipher_decrypt() succeeded.A malformed RESPONSE can therefore use a non-block-aligned ticketlength, make the decrypt operation fail, and still drive the ticketparser with attacker-controlled bytes.Check the decrypt result and abort the connection with RXKADBADTICKETwhen ticket decryption fails. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31642.md b/2026/CVE-2026-31642.md new file mode 100644 index 0000000000..6bcbc8a908 --- /dev/null +++ b/2026/CVE-2026-31642.md @@ -0,0 +1,20 @@ +### [CVE-2026-31642](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31642) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2baec2c3f854d1f79c7bb28386484e144e864a14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:rxrpc: Fix call removal to use RCU safe deletionFix rxrpc call removal from the rxnet->calls list to use list_del_rcu()rather than list_del_init() to prevent stuffing up reading/proc/net/rxrpc/calls from potentially getting into an infinite loop.This, however, means that list_empty() no longer works on an entry that'sbeen deleted from the list, making it harder to detect prior deletion. Fixthis by:Firstly, make rxrpc_destroy_all_calls() only dump the first ten calls thatare unexpectedly still on the list. Limiting the number of steps meansthere's no need to call cond_resched() or to remove calls from the listhere, thereby eliminating the need for rxrpc_put_call() to check for that.rxrpc_put_call() can then be fixed to unconditionally delete the call fromthe list as it is the only place that the deletion occurs. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31649.md b/2026/CVE-2026-31649.md index 2487cebdf3..a96a441578 100644 --- a/2026/CVE-2026-31649.md +++ b/2026/CVE-2026-31649.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: stmmac: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31651.md b/2026/CVE-2026-31651.md index 1d4b2fa3d9..39227ae312 100644 --- a/2026/CVE-2026-31651.md +++ b/2026/CVE-2026-31651.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=88095e7b473a3d9ec3b9c60429576e9cbd327c89%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:mmc: vub300: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31658.md b/2026/CVE-2026-31658.md index b0e5db6031..8da4a9ac78 100644 --- a/2026/CVE-2026-31658.md +++ b/2026/CVE-2026-31658.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bbd2190ce96d8fce031f0526c1f970b68adc9d1a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: altera-t #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31664.md b/2026/CVE-2026-31664.md index c8fcb029eb..81a67a9831 100644 --- a/2026/CVE-2026-31664.md +++ b/2026/CVE-2026-31664.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:xfrm: clear t #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31665.md b/2026/CVE-2026-31665.md index ce15560f4e..fa34b85ea2 100644 --- a/2026/CVE-2026-31665.md +++ b/2026/CVE-2026-31665.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=7e0b2b57f01d183e1c84114f1f2287737358d748%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31669.md b/2026/CVE-2026-31669.md index ac8c62fb7c..f6df5a2e5d 100644 --- a/2026/CVE-2026-31669.md +++ b/2026/CVE-2026-31669.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b19bc2945b40b9fd38e835700907ffe8534ef0de%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:mptcp: fix sl #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31670.md b/2026/CVE-2026-31670.md index 0e802b1aec..8fd586c839 100644 --- a/2026/CVE-2026-31670.md +++ b/2026/CVE-2026-31670.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.31%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c64fb01627e24725d1f9d535e4426475a4415753%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: rfkill: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31671.md b/2026/CVE-2026-31671.md index f9d4a96815..f76dd0c8bd 100644 --- a/2026/CVE-2026-31671.md +++ b/2026/CVE-2026-31671.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:xfrm_user: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31673.md b/2026/CVE-2026-31673.md new file mode 100644 index 0000000000..902ad9a77b --- /dev/null +++ b/2026/CVE-2026-31673.md @@ -0,0 +1,20 @@ +### [CVE-2026-31673](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31673) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5f7b0569460b7d8d01ca776430a00505a68b7584%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:af_unix: read UNIX_DIAG_VFS data under unix_state_lockExact UNIX diag lookups hold a reference to the socket, but not tou->path. Meanwhile, unix_release_sock() clears u->path underunix_state_lock() and drops the path reference after unlocking.Read the inode and device numbers for UNIX_DIAG_VFS while holdingunix_state_lock(), then emit the netlink attribute after dropping thelock.This keeps the VFS data stable while the reply is being built. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31674.md b/2026/CVE-2026-31674.md index b2e8861860..d87cb3483c 100644 --- a/2026/CVE-2026-31674.md +++ b/2026/CVE-2026-31674.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: ip #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31676.md b/2026/CVE-2026-31676.md new file mode 100644 index 0000000000..0257b1378f --- /dev/null +++ b/2026/CVE-2026-31676.md @@ -0,0 +1,20 @@ +### [CVE-2026-31676](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31676) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=17926a79320afa9b95df6b977b40cca6d8713cea%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.22%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:rxrpc: only handle RESPONSE during service challengeOnly process RESPONSE packets while the service connection is still inRXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock beforerunning response verification and security initialization, then use a localsecured flag to decide whether to queue the secured-connection work afterthe state transition. This keeps duplicate or late RESPONSE packets fromre-running the setup path and removes the unlocked post-transition statetest. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31680.md b/2026/CVE-2026-31680.md index 59307dfba2..7869057070 100644 --- a/2026/CVE-2026-31680.md +++ b/2026/CVE-2026-31680.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d3aedd5ebd4b0b925b0bcda548066803e1318499%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: ipv6: fl #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31681.md b/2026/CVE-2026-31681.md index 1db02fae05..85cfe804df 100644 --- a/2026/CVE-2026-31681.md +++ b/2026/CVE-2026-31681.md @@ -1,8 +1,10 @@ ### [CVE-2026-31681](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31681) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a89ecb6a2ef732d04058d87801e2b6bd7e5c7089%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: xt #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31682.md b/2026/CVE-2026-31682.md index 91f1205b2e..f736af027d 100644 --- a/2026/CVE-2026-31682.md +++ b/2026/CVE-2026-31682.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ed842faeb2bd49256f00485402f3113205f91d30%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:bridge: br_nd #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31685.md b/2026/CVE-2026-31685.md new file mode 100644 index 0000000000..1aa8fbd582 --- /dev/null +++ b/2026/CVE-2026-31685.md @@ -0,0 +1,20 @@ +### [CVE-2026-31685](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31685) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:netfilter: ip6t_eui64: reject invalid MAC header for all packets`eui64_mt6()` derives a modified EUI-64 from the Ethernet source addressand compares it with the low 64 bits of the IPv6 source address.The existing guard only rejects an invalid MAC header when`par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()`can still reach `eth_hdr(skb)` even when the MAC header is not valid.Fix this by removing the `par->fragoff != 0` condition so that packetswith an invalid MAC header are rejected before accessing `eth_hdr(skb)`. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31694.md b/2026/CVE-2026-31694.md new file mode 100644 index 0000000000..38a2cd598b --- /dev/null +++ b/2026/CVE-2026-31694.md @@ -0,0 +1,20 @@ +### [CVE-2026-31694](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31694) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=27992ef80770d61a57f6c3a551735b08cefdffa3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:fuse: reject oversized dirents in page cachefuse_add_dirent_to_cache() computes a serialized dirent size from theserver-controlled namelen field and copies the dirent into a singlepage-cache page. The existing logic only checks whether the dirent fitsin the remaining space of the current page and advances to a fresh pageif not. It never checks whether the dirent itself exceeds PAGE_SIZE.As a result, a malicious FUSE server can return a dirent withnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiBpage systems this causes memcpy() to overflow the cache page by 24 bytesinto the following kernel page.Reject dirents that cannot fit in a single page before copying them intothe readdir cache. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31696.md b/2026/CVE-2026-31696.md new file mode 100644 index 0000000000..32c8769e07 --- /dev/null +++ b/2026/CVE-2026-31696.md @@ -0,0 +1,20 @@ +### [CVE-2026-31696](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31696) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:rxrpc: Fix missing validation of ticket length in non-XDR key preparsingIn rxrpc_preparse(), there are two paths for parsing key payloads: theXDR path (for large payloads) and the non-XDR path (for payloads <= 28bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctlyvalidates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDRpath fails to do so.This allows an unprivileged user to provide a very large ticket length.When this key is later read via rxrpc_read(), the totaltoken size (toksize) calculation results in a value that exceedsAFSTOKEN_LENGTH_MAX, triggering a WARN_ON().[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]Fix this by adding a check in the non-XDR parsing path of rxrpc_preparse()to ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,bringing it into parity with the XDR parsing logic. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31697.md b/2026/CVE-2026-31697.md new file mode 100644 index 0000000000..d6fe299ac0 --- /dev/null +++ b/2026/CVE-2026-31697.md @@ -0,0 +1,20 @@ +### [CVE-2026-31697](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31697) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d6112ea0cb344d6f5ed519991e24f69ba4b43d0e%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:crypto: ccp: Don't attempt to copy ID to userspace if PSP command failedWhen retrieving the ID for the CPU, don't attempt to copy the ID blob touserspace if the firmware command failed. If the failure was due to aninvalid length, i.e. the userspace buffer+length was too small, copyingthe number of bytes _firmware_ requires will overflow the kernel-allocatedbuffer and leak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388 CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 Call Trace: dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 copy_to_user ../include/linux/uaccess.h:236 [inline] sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222 sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575 vfs_ioctl ../fs/ioctl.c:51 [inline] __do_sys_ioctl ../fs/ioctl.c:597 [inline] __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e WARN if the driver says the command succeeded, but the firmware error codesays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on anyfirwmware error. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31698.md b/2026/CVE-2026-31698.md new file mode 100644 index 0000000000..295064de46 --- /dev/null +++ b/2026/CVE-2026-31698.md @@ -0,0 +1,20 @@ +### [CVE-2026-31698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31698) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=76a2b524a4b1d6dc0f2421f9854a01d55d5e5436%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failedWhen retrieving the PDH cert, don't attempt to copy the blobs to userspaceif the firmware command failed. If the failure was due to an invalidlength, i.e. the userspace buffer+length was too small, copying the numberof bytes _firmware_ requires will overflow the kernel-allocated buffer andleak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033 CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025 Call Trace: dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 copy_to_user ../include/linux/uaccess.h:236 [inline] sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347 sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568 vfs_ioctl ../fs/ioctl.c:51 [inline] __do_sys_ioctl ../fs/ioctl.c:597 [inline] __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e WARN if the driver says the command succeeded, but the firmware error codesays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on anyfirwmware error. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31699.md b/2026/CVE-2026-31699.md new file mode 100644 index 0000000000..75431e8273 --- /dev/null +++ b/2026/CVE-2026-31699.md @@ -0,0 +1,20 @@ +### [CVE-2026-31699](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31699) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e799035609e1526761aa2f896a974b233d04d36d%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failedWhen retrieving the PEK CSR, don't attempt to copy the blob to userspaceif the firmware command failed. If the failure was due to an invalidlength, i.e. the userspace buffer+length was too small, copying the numberof bytes _firmware_ requires will overflow the kernel-allocated buffer andleak data to userspace. BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405 CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G U O 7.0.0-smp-DEV #28 PREEMPTLAZY Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 Call Trace: dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120 print_address_description ../mm/kasan/report.c:378 [inline] print_report+0xbc/0x260 ../mm/kasan/report.c:482 kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595 check_region_inline ../mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200 instrument_copy_to_user ../include/linux/instrumented.h:129 [inline] _inline_copy_to_user ../include/linux/uaccess.h:205 [inline] _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26 copy_to_user ../include/linux/uaccess.h:236 [inline] sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872 sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562 vfs_ioctl ../fs/ioctl.c:51 [inline] __do_sys_ioctl ../fs/ioctl.c:597 [inline] __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583 do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e WARN if the driver says the command succeeded, but the firmware error codesays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on anyfirwmware error. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31700.md b/2026/CVE-2026-31700.md index 22747c8e0c..ed71cd4e02 100644 --- a/2026/CVE-2026-31700.md +++ b/2026/CVE-2026-31700.md @@ -1,9 +1,11 @@ ### [CVE-2026-31700](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31700) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1d036d25e5609ba73fee6a88db01c306b140d512%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:net/packet: f #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31704.md b/2026/CVE-2026-31704.md new file mode 100644 index 0000000000..5e201adef1 --- /dev/null +++ b/2026/CVE-2026-31704.md @@ -0,0 +1,20 @@ +### [CVE-2026-31704](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31704) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ksmbd: use check_add_overflow() to prevent u16 DACL size overflowset_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizesin u16 variables. When a file has many POSIX ACL entries, theaccumulated size can wrap past 65535, causing the pointer arithmetic(char *)pndace + *size to land within already-written ACEs. Subsequentwrites then overwrite earlier entries, and pndacl->size gets atruncated value.Use check_add_overflow() at each accumulation point to detect thewrap before it corrupts the buffer, consistent with existingcheck_mul_overflow() usage elsewhere in smbacl.c. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31705.md b/2026/CVE-2026-31705.md new file mode 100644 index 0000000000..766973eb81 --- /dev/null +++ b/2026/CVE-2026-31705.md @@ -0,0 +1,24 @@ +### [CVE-2026-31705](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31705) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.145%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.71%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9f297df20d93411c0b4ddad7f88ba04a7cd36e77%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f2283680a80571ca82d710bc6ecd8f8beac67d63%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignmentsmb2_get_ea() applies 4-byte alignment padding via memset() afterwriting each EA entry. The bounds check on buf_free_len is performedbefore the value memcpy, but the alignment memset fires unconditionallyafterward with no check on remaining space.When the EA value exactly fills the remaining buffer (buf_free_len == 0after value subtraction), the alignment memset writes 1-3 NUL bytespast the buf_free_len boundary. In compound requests where the responsebuffer is shared across commands, the first command (e.g., READ) canconsume most of the buffer, leaving a tight remainder for the QUERY_INFOEA response. The alignment memset then overwrites past the physicalkvmalloc allocation into adjacent kernel heap memory.Add a bounds check before the alignment memset to ensure buf_free_lencan accommodate the padding bytes.This is the same bug pattern fixed by commit beef2634f81f ("ksmbd: fixpotencial OOB in get_file_all_info() for compound requests") andcommit fda9522ed6af ("ksmbd: fix OOB write in QUERY_INFO for compoundrequests"), both of which added bounds checks before unconditionalwrites in QUERY_INFO response handlers. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31708.md b/2026/CVE-2026-31708.md new file mode 100644 index 0000000000..a9f16aa66b --- /dev/null +++ b/2026/CVE-2026-31708.md @@ -0,0 +1,20 @@ +### [CVE-2026-31708](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31708) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f5778c398713692a16150ae96e5c8270bab8399f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO pathsmb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTLand the default QUERY_INFO path. The QUERY_INFO branch clampsqi.input_buffer_length to the server-reported OutputBufferLength and thencopies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, butit never verifies that the flexible-array payload actually fits withinrsp_iov[1].iov_len.A malicious server can return OutputBufferLength larger than the actualQUERY_INFO response, causing copy_to_user() to walk past the responsebuffer and expose adjacent kernel heap to userspace.Guard the QUERY_INFO copy with a bounds check on the actual Bufferpayload. Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)rather than an open-coded addition so the guard cannot overflow on32-bit builds. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31709.md b/2026/CVE-2026-31709.md new file mode 100644 index 0000000000..d7c13f44f1 --- /dev/null +++ b/2026/CVE-2026-31709.md @@ -0,0 +1,20 @@ +### [CVE-2026-31709](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31709) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=bc3e9dd9d104ca1b75644eab87b38ce8a924aef4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:smb: client: validate the whole DACL before rewriting it in cifsaclbuild_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from aserver-supplied dacloffset and then use the incoming ACL to rebuild thechmod/chown security descriptor.The original fix only checked that the struct smb_acl header fits beforereading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediateheader-field OOB read, but the rewrite helpers still walk ACEs based onpdacl->num_aces with no structural validation of the incoming DACL body.A malicious server can return a truncated DACL that still contains aheader, claims one or more ACEs, and then drivereplace_sids_and_copy_aces() or set_chmod_dacl() past the validatedextent while they compare or copy attacker-controlled ACEs.Factor the DACL structural checks into validate_dacl(), extend them tovalidate each ACE against the DACL bounds, and use the shared validatorbefore the chmod/chown rebuild paths. parse_dacl() reuses the samevalidator so the read-side parser and write-side rewrite paths agree onwhat constitutes a well-formed incoming DACL. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31711.md b/2026/CVE-2026-31711.md new file mode 100644 index 0000000000..a602b0b5e5 --- /dev/null +++ b/2026/CVE-2026-31711.md @@ -0,0 +1,24 @@ +### [CVE-2026-31711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31711) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0d0d4680db22eda1eea785c47bbf66a9b33a8b16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4210c3555db4b38bade92331b153e583261f05f9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.91%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d5d7847e57ac69fa99c18b363a34419bcdb5a281%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:smb: server: fix active_num_conn leak on transport allocation failureCommit 77ffbcac4e56 ("smb: server: fix leak of active_num_conn inksmbd_tcp_new_connection()") addressed the kthread_run() failurepath. The earlier alloc_transport() == NULL path in the samefunction has the same leak, is reachable pre-authentication via anyTCP connect to port 445, and was empirically reproduced on UML(ARCH=um, v7.0-rc7): a small number of forced allocation failureswere sufficient to put ksmbd into a state where every subsequentconnection attempt was rejected for the remainder of the boot.ksmbd_kthread_fn() increments active_num_conn before callingksmbd_tcp_new_connection() and discards the return value, so whenalloc_transport() returns NULL the socket is released and -ENOMEMreturned without decrementing the counter. Each such failurepermanently consumes one slot from the max_connections pool; oncecumulative failures reach the cap, atomic_inc_return() hits thethreshold on every subsequent accept and every new connection isrejected. The counter is only reset by module reload.An unauthenticated remote attacker can drive the server toward thememory pressure that makes alloc_transport() fail by holding openconnections with large RFC1002 lengths up to MAX_STREAM_PROT_LEN(0x00FFFFFF); natural transient allocation failures on a loadedhost produce the same drift more slowly.Mirror the existing rollback pattern in ksmbd_kthread_fn(): on thealloc_transport() failure path, decrement active_num_conn gated onserver_conf.max_connections.Repro details: with the patch reverted, forced alloc_transport()NULL returns leaked counter slots and subsequent connectionattempts -- including legitimate connects issued after theforced-fail window had closed -- were all rejected with "Limit themaximum number of connections". With this patch applied, the sameconnect sequence produces no rejections and the counter cyclescleanly between zero and one on every accept. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31712.md b/2026/CVE-2026-31712.md new file mode 100644 index 0000000000..a429f2c751 --- /dev/null +++ b/2026/CVE-2026-31712.md @@ -0,0 +1,20 @@ +### [CVE-2026-31712](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31712) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ksmbd: require minimum ACE size in smb_check_perm_dacl()Both ACE-walk loops in smb_check_perm_dacl() only guard against anunder-sized remaining buffer, not against an ACE whose declared`ace->size` is smaller than the struct it claims to describe: if (offsetof(struct smb_ace, access_req) > aces_size) break; ace_size = le16_to_cpu(ace->size); if (ace_size > aces_size) break;The first check only requires the 4-byte ACE header to be in bounds;it does not require access_req (4 bytes at offset 4) to be readable.An attacker who has set a crafted DACL on a file they own can declareace->size == 4 with aces_size == 4, pass both checks, and then granted |= le32_to_cpu(ace->access_req); /* upper loop */ compare_sids(&sid, &ace->sid); /* lower loop */reads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid atoffset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES* 4 bytes).Tighten both loops to require ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZEwhich is the smallest valid on-wire ACE layout (4-byte header +4-byte access_req + 8-byte sid base with zero sub-auths). Alsoreject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIESbefore letting compare_sids() dereference sub_auth[] entries.parse_sec_desc() already enforces an equivalent check (lines 441-448);smb_check_perm_dacl() simply grew weaker validation over time.Reachability: authenticated SMB client with permission to set an ACLon a file. On a subsequent CREATE against that file, the kernelwalks the stored DACL via smb_check_perm_dacl() and triggers theOOB read. Not pre-auth, and the OOB read is not reflected to theattacker, but KASAN reports and kernel state corruption arepossible. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-31737.md b/2026/CVE-2026-31737.md index 1d2abd1ddf..15885498a8 100644 --- a/2026/CVE-2026-31737.md +++ b/2026/CVE-2026-31737.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: ftgmac10 #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31752.md b/2026/CVE-2026-31752.md index de08679672..d91f687618 100644 --- a/2026/CVE-2026-31752.md +++ b/2026/CVE-2026-31752.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ed842faeb2bd49256f00485402f3113205f91d30%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:bridge: br_nd #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31761.md b/2026/CVE-2026-31761.md index 5b8385c878..434db6b562 100644 --- a/2026/CVE-2026-31761.md +++ b/2026/CVE-2026-31761.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:iio: gyro: mp #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-31768.md b/2026/CVE-2026-31768.md index 4871880499..980f3f7c35 100644 --- a/2026/CVE-2026-31768.md +++ b/2026/CVE-2026-31768.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4d671b71beefbfc145b971a11e0c3cabde94b673%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:iio: adc: ti- #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-32077.md b/2026/CVE-2026-32077.md index b63b409322..15fa996dd8 100644 --- a/2026/CVE-2026-32077.md +++ b/2026/CVE-2026-32077.md @@ -6,7 +6,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2023H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2024H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2025H2&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2022H3&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2023H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2026H1&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202012%20(Server%20Core%20installation)&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202012%20R2%20(Server%20Core%20installation)&color=blue) diff --git a/2026/CVE-2026-32181.md b/2026/CVE-2026-32181.md index e72231448b..8756d99913 100644 --- a/2026/CVE-2026-32181.md +++ b/2026/CVE-2026-32181.md @@ -4,7 +4,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2023H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2024H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2025H2&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2022H3&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2023H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2026H1&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202022%2C%2023H2%20Edition%20(Server%20Core%20installation)&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202022&color=blue) diff --git a/2026/CVE-2026-33058.md b/2026/CVE-2026-33058.md new file mode 100644 index 0000000000..745a8ab862 --- /dev/null +++ b/2026/CVE-2026-33058.md @@ -0,0 +1,17 @@ +### [CVE-2026-33058](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33058) +![](https://img.shields.io/static/v1?label=Product&message=kanboard&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.2.51%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard database. Version 1.2.51 fixes the issue. + +### POC + +#### Reference +- https://github.com/kanboard/kanboard/security/advisories/GHSA-f62r-m4mr-2xhh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33152.md b/2026/CVE-2026-33152.md new file mode 100644 index 0000000000..f786ab0cea --- /dev/null +++ b/2026/CVE-2026-33152.md @@ -0,0 +1,17 @@ +### [CVE-2026-33152](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33152) +![](https://img.shields.io/static/v1?label=Product&message=recipes&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-307%3A%20Improper%20Restriction%20of%20Excessive%20Authentication%20Attempts&color=brightgreen) + +### Description + +Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, Tandoor Recipes configures Django REST Framework with BasicAuthentication as one of the default authentication backends. The AllAuth rate limiting configuration (ACCOUNT_RATE_LIMITS: login: 5/m/ip) only applies to the HTML-based login endpoint at /accounts/login/. Any API endpoint that accepts authenticated requests can be targeted via Authorization: Basic headers with zero rate limiting, zero account lockout, and unlimited attempts. An attacker can perform high-speed password guessing against any known username. Version 2.6.0 patches the issue. + +### POC + +#### Reference +- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-7m7c-jjqc-r522 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33153.md b/2026/CVE-2026-33153.md new file mode 100644 index 0000000000..79efadcafb --- /dev/null +++ b/2026/CVE-2026-33153.md @@ -0,0 +1,17 @@ +### [CVE-2026-33153](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33153) +![](https://img.shields.io/static/v1?label=Product&message=recipes&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the Recipe API endpoint exposes a hidden `?debug=true` query parameter that returns the complete raw SQL query being executed, including all table names, column names, JOIN relationships, WHERE conditions (revealing access control logic), and multi-tenant space IDs. This parameter works even when Django's `DEBUG=False` (production mode) and is accessible to any authenticated user regardless of their privilege level. This allows a low-privilege attacker to map the entire database schema and reverse-engineer the authorization model. Version 2.6.0 patches the issue. + +### POC + +#### Reference +- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f83r-v3h5-pchf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33154.md b/2026/CVE-2026-33154.md new file mode 100644 index 0000000000..7d3a52cb06 --- /dev/null +++ b/2026/CVE-2026-33154.md @@ -0,0 +1,18 @@ +### [CVE-2026-33154](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33154) +![](https://img.shields.io/static/v1?label=Product&message=dynaconf&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.2.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1336%3A%20Improper%20Neutralization%20of%20Special%20Elements%20Used%20in%20a%20Template%20Engine&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13. + +### POC + +#### Reference +- https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33232.md b/2026/CVE-2026-33232.md new file mode 100644 index 0000000000..bea2cc0f37 --- /dev/null +++ b/2026/CVE-2026-33232.md @@ -0,0 +1,19 @@ +### [CVE-2026-33232](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33232) +![](https://img.shields.io/static/v1?label=Product&message=AutoGPT&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.4.2%2C%20%3C%200.6.52%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-459%3A%20Incomplete%20Cleanup&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen) + +### Description + +AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vulnerable to an unauthenticated Denial of Service (DoS) through the server due to uncontrolled disk space consumption. The download_agent_file endpoint creates persistent temporary files for every request but fails to delete them after they are served. An unauthenticated attacker can repeatedly call this endpoint to exhaust the server's disk space, causing the database or other system services to fail due to "No space left on device" errors, rendering the entire AutoGPT Platform backend unavailable to all users. This issue has been patched in version 0.6.52. + +### POC + +#### Reference +- https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-374w-2pxq-c9jp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33287.md b/2026/CVE-2026-33287.md new file mode 100644 index 0000000000..137d1166dd --- /dev/null +++ b/2026/CVE-2026-33287.md @@ -0,0 +1,18 @@ +### [CVE-2026-33287](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33287) +![](https://img.shields.io/static/v1?label=Product&message=liquidjs&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2010.25.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) + +### Description + +LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript's `String.prototype.replace()` which interprets `$&` as a back reference to the matched substring. The filter only charges `memoryLimit` for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the `memoryLimit` budget, leading to denial of service. Version 10.25.1 patches the issue. + +### POC + +#### Reference +- https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33316.md b/2026/CVE-2026-33316.md new file mode 100644 index 0000000000..0c6d4a96a1 --- /dev/null +++ b/2026/CVE-2026-33316.md @@ -0,0 +1,19 @@ +### [CVE-2026-33316](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33316) +![](https://img.shields.io/static/v1?label=Product&message=vikunja&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The `ResetPassword()` function sets the user’s status to `StatusActive` after a successful password reset without verifying whether the account was previously disabled. By requesting a reset token through `/api/v1/user/password/token` and completing the reset via `/api/v1/user/password/reset`, a disabled user can reactivate their account and bypass administrator-imposed account disablement. Version 2.2.0 patches the issue. + +### POC + +#### Reference +- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vq4q-79hh-q767 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33396.md b/2026/CVE-2026-33396.md new file mode 100644 index 0000000000..676081e174 --- /dev/null +++ b/2026/CVE-2026-33396.md @@ -0,0 +1,19 @@ +### [CVE-2026-33396](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33396) +![](https://img.shields.io/static/v1?label=Product&message=oneuptime&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2010.0.35%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-184%3A%20Incomplete%20List%20of%20Disallowed%20Inputs&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-693%3A%20Protection%20Mechanism%20Failure&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged authenticated user (ProjectMember) can achieve remote command execution on the Probe container/host by abusing Synthetic Monitor Playwright script execution. Synthetic monitor code is executed in VMRunner.runCodeInNodeVM with a live Playwright page object in context. The sandbox relies on a denylist of blocked properties/methods, but it is incomplete. Specifically, _browserType and launchServer are not blocked, so attacker code can traverse `page.context().browser()._browserType.launchServer(...)` and spawn arbitrary processes. Version 10.0.35 contains a patch. + +### POC + +#### Reference +- https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cqpg-phpp-9jjg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33437.md b/2026/CVE-2026-33437.md new file mode 100644 index 0000000000..c30ee6e808 --- /dev/null +++ b/2026/CVE-2026-33437.md @@ -0,0 +1,17 @@ +### [CVE-2026-33437](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33437) +![](https://img.shields.io/static/v1?label=Product&message=Stirling-PDF&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to access browser-session data or modify page content. This issue is fixed in version 2.0.0. + +### POC + +#### Reference +- https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-qc47-qgh9-xj63 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33480.md b/2026/CVE-2026-33480.md new file mode 100644 index 0000000000..a8c1dcd674 --- /dev/null +++ b/2026/CVE-2026-33480.md @@ -0,0 +1,17 @@ +### [CVE-2026-33480](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33480) +![](https://img.shields.io/static/v1?label=Product&message=AVideo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%2026.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services. Commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373 contains a patch. + +### POC + +#### Reference +- https://github.com/WWBN/AVideo/security/advisories/GHSA-p3gr-g84w-g8hh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33484.md b/2026/CVE-2026-33484.md new file mode 100644 index 0000000000..a2b3e2fbb8 --- /dev/null +++ b/2026/CVE-2026-33484.md @@ -0,0 +1,19 @@ +### [CVE-2026-33484](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33484) +![](https://img.shields.io/static/v1?label=Product&message=langflow&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.0.0%2C%20%3C%201.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flow_id and file_name returns the image with HTTP 200. In a multi-tenant deployment, any attacker who can discover or guess a `flow_id` (UUIDs can be leaked through other API responses) can download any user's uploaded images without credentials. Version 1.9.0 contains a patch. + +### POC + +#### Reference +- https://github.com/langflow-ai/langflow/security/advisories/GHSA-7grx-3xcx-2xv5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33485.md b/2026/CVE-2026-33485.md new file mode 100644 index 0000000000..d1e5e967b7 --- /dev/null +++ b/2026/CVE-2026-33485.md @@ -0,0 +1,17 @@ +### [CVE-2026-33485](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33485) +![](https://img.shields.io/static/v1?label=Product&message=AVideo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%2026.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `plugin/Live/on_publish.php` is accessible without authentication. The `$_POST['name']` parameter (stream key) is interpolated directly into SQL queries in two locations — `LiveTransmitionHistory::getLatest()` and `LiveTransmition::keyExists()` — without parameterized binding or escaping. An unauthenticated attacker can exploit time-based blind SQL injection to extract all database contents including user password hashes, email addresses, and other sensitive data. Commit af59eade82de645b20183cc3d74467a7eac76549 contains a patch. + +### POC + +#### Reference +- https://github.com/WWBN/AVideo/security/advisories/GHSA-8p58-35c3-ccxx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33639.md b/2026/CVE-2026-33639.md new file mode 100644 index 0000000000..5e8f98471e --- /dev/null +++ b/2026/CVE-2026-33639.md @@ -0,0 +1,17 @@ +### [CVE-2026-33639](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33639) +![](https://img.shields.io/static/v1?label=Product&message=InvoicePlane&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.7.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled tax_rate_decimal_places setting into an ALTER TABLE statement for ip_tax_rates in Settings::index() without strict integer validation. A crafted setting value can add clauses to the schema-changing statement and remove or alter required database columns. The resulting schema corruption can permanently modify financial data structures and make the application unavailable. This vulnerability is fixed in 1.7.2. + +### POC + +#### Reference +- https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-34g5-4hfc-g983 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33640.md b/2026/CVE-2026-33640.md new file mode 100644 index 0000000000..5cc06973a0 --- /dev/null +++ b/2026/CVE-2026-33640.md @@ -0,0 +1,17 @@ +### [CVE-2026-33640](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33640) +![](https://img.shields.io/static/v1?label=Product&message=outline&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.86.0%2C%20%3C%201.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-307%3A%20Improper%20Restriction%20of%20Excessive%20Authentication%20Attempts&color=brightgreen) + +### Description + +Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users not associated with an Identity Provider. Starting in version 0.86.0 and prior to version 1.6.0, Outline does not invalidate OTP codes based on amount or frequency of invalid submissions, rather it relies on the rate limiter to restrict attempts. Consequently, identified bypasses in the rate limiter permit unrestricted OTP code submissions within the codes lifetime. This allows attackers to perform brute force attacks which enable account takeover. Version 1.6.0 fixes the issue. + +### POC + +#### Reference +- https://github.com/outline/outline/security/advisories/GHSA-cwhc-53hw-qqx6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33651.md b/2026/CVE-2026-33651.md new file mode 100644 index 0000000000..b11516f11b --- /dev/null +++ b/2026/CVE-2026-33651.md @@ -0,0 +1,17 @@ +### [CVE-2026-33651](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33651) +![](https://img.shields.io/static/v1?label=Product&message=AVideo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%2026.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `remindMe.json.php` endpoint passes `$_REQUEST['live_schedule_id']` through multiple functions without sanitization until it reaches `Scheduler_commands::getAllActiveOrToRepeat()`, which directly concatenates it into a SQL `LIKE` clause. Although intermediate functions (`new Live_schedule()`, `getUsers_idOrCompany()`) apply `intval()` internally, they do so on local copies within `ObjectYPT::getFromDb()`, leaving the original tainted variable unchanged. Any authenticated user can perform time-based blind SQL injection to extract arbitrary database contents. Commit 75d45780728294ededa1e3f842f95295d3e7d144 contains a patch. + +### POC + +#### Reference +- https://github.com/WWBN/AVideo/security/advisories/GHSA-pvw4-p2jm-chjm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33686.md b/2026/CVE-2026-33686.md new file mode 100644 index 0000000000..729478bede --- /dev/null +++ b/2026/CVE-2026-33686.md @@ -0,0 +1,17 @@ +### [CVE-2026-33686](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33686) +![](https://img.shields.io/static/v1?label=Product&message=sharp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%209.20.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension. + +### POC + +#### Reference +- https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33693.md b/2026/CVE-2026-33693.md index a5468faf58..d2204d1010 100644 --- a/2026/CVE-2026-33693.md +++ b/2026/CVE-2026-33693.md @@ -11,6 +11,7 @@ Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-b #### Reference - https://github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35 +- https://github.com/advisories/GHSA-7723-35v7-qcxw #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-33711.md b/2026/CVE-2026-33711.md new file mode 100644 index 0000000000..5bd5444ef7 --- /dev/null +++ b/2026/CVE-2026-33711.md @@ -0,0 +1,17 @@ +### [CVE-2026-33711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33711) +![](https://img.shields.io/static/v1?label=Product&message=incus&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%206.23.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-61%3A%20UNIX%20Symbolic%20Link%20(Symlink)%20Following&color=brightgreen) + +### Description + +Incus is a system container and virtual machine manager. Incus provides an API to retrieve VM screenshots. That API relies on the use of a temporary file for QEMU to write the screenshot to which is then picked up and sent to the user prior to deletion. As versions prior to 6.23.0 use predictable paths under /tmp for this, an attacker with local access to the system can abuse this mechanism by creating their own symlinks ahead of time. On the vast majority of Linux systems, this will result in a "Permission denied" error when requesting a screenshot. That's because the Linux kernel has a security feature designed to block such attacks, `protected_symlinks`. On the rare systems with this purposefully disabled, it's then possible to trick Incus intro truncating and altering the mode and permissions of arbitrary files on the filesystem, leading to a potential denial of service or possible local privilege escalation. Version 6.23.0 fixes the issue. + +### POC + +#### Reference +- https://github.com/lxc/incus/security/advisories/GHSA-q9vp-3wcg-8p4x + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33740.md b/2026/CVE-2026-33740.md new file mode 100644 index 0000000000..72a1ab5198 --- /dev/null +++ b/2026/CVE-2026-33740.md @@ -0,0 +1,17 @@ +### [CVE-2026-33740](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33740) +![](https://img.shields.io/static/v1?label=Product&message=espocrm&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%209.3.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Email/importEml endpoint contains an Insecure Direct Object Reference (IDOR) vulnerability where the attacker-supplied fileId parameter is used to fetch any attachment directly from the repository without verifying that the current user has authorization to access it. Any authenticated user with Email:create and Import permissions can exploit this to read another user's .eml attachment contents by importing them as a new email into the attacker's mailbox, while the original victim attachment record is deleted as a side effect of the import flow. This is inconsistent with the standard attachment download path, which enforces ACL checks before returning file data, and is practically exploitable because attachment IDs are commonly exposed in normal UI and API workflows such as stream payloads and download links. This issue is fixed in version 9.3.4. + +### POC + +#### Reference +- https://github.com/espocrm/espocrm/security/advisories/GHSA-wr7j-hxf8-hc4w + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33752.md b/2026/CVE-2026-33752.md new file mode 100644 index 0000000000..e427e70b77 --- /dev/null +++ b/2026/CVE-2026-33752.md @@ -0,0 +1,17 @@ +### [CVE-2026-33752](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33752) +![](https://img.shields.io/static/v1?label=Product&message=curl_cffi&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.15.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not restrict requests to internal IP ranges, and follows redirects automatically via the underlying libcurl. Because of this, an attacker-controlled URL can redirect requests to internal services such as cloud metadata endpoints. In addition, curl_cffi’s TLS impersonation feature can make these requests appear as legitimate browser traffic, which may bypass certain network controls. This vulnerability is fixed in 0.15.0. + +### POC + +#### Reference +- https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmpp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33829.md b/2026/CVE-2026-33829.md index fc3b8efabe..397fd1c9ef 100644 --- a/2026/CVE-2026-33829.md +++ b/2026/CVE-2026-33829.md @@ -6,7 +6,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2023H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2024H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2025H2&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2022H3&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2023H2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2026H1&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202012%20(Server%20Core%20installation)&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202012%20R2%20(Server%20Core%20installation)&color=blue) diff --git a/2026/CVE-2026-33867.md b/2026/CVE-2026-33867.md new file mode 100644 index 0000000000..5851089f76 --- /dev/null +++ b/2026/CVE-2026-33867.md @@ -0,0 +1,17 @@ +### [CVE-2026-33867](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33867) +![](https://img.shields.io/static/v1?label=Product&message=AVideo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%2026.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-312%3A%20Cleartext%20Storage%20of%20Sensitive%20Information&color=brightgreen) + +### Description + +WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext. Commit f2d68d2adbf73588ea61be2b781d93120a819e36 contains a patch. + +### POC + +#### Reference +- https://github.com/WWBN/AVideo/security/advisories/GHSA-363v-5rh8-23wg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33955.md b/2026/CVE-2026-33955.md new file mode 100644 index 0000000000..adef5f61f7 --- /dev/null +++ b/2026/CVE-2026-33955.md @@ -0,0 +1,18 @@ +### [CVE-2026-33955](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33955) +![](https://img.shields.io/static/v1?label=Product&message=Notesnook%20Web%2FDesktop&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.3.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when an attacker-controlled note header is displayed using `dangerouslySetInnerHTML` without secure handling. When combined with the full backup and restore feature in the desktop application, this becomes remote code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 patches the issue. + +### POC + +#### Reference +- https://github.com/streetwriters/notesnook/security/advisories/GHSA-45g3-cv93-q59v + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33975.md b/2026/CVE-2026-33975.md new file mode 100644 index 0000000000..b8529d7adc --- /dev/null +++ b/2026/CVE-2026-33975.md @@ -0,0 +1,17 @@ +### [CVE-2026-33975](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33975) +![](https://img.shields.io/static/v1?label=Product&message=twenty&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%201.18.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be bypassed using IPv4-mapped IPv6 addresses in URL IP literals. Node.js's URL parser normalizes IPv4-mapped IPv6 addresses to compressed hex form (e.g., ::ffff:169.254.169.254 becomes ::ffff:a9fe:a9fe), but the isPrivateIp utility only recognizes the dotted-decimal notation. As a result, the hex form passes the SSRF check unchecked. Additionally, the socket lookup validation event does not fire for IP literal addresses, bypassing the second validation layer. An authenticated user can reach any internal IP, including cloud metadata endpoints, to exfiltrate credentials such as IAM keys. + +### POC + +#### Reference +- https://github.com/twentyhq/twenty/security/advisories/GHSA-vrcj-hv2q-c58m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-3497.md b/2026/CVE-2026-3497.md index 6960cc04ff..93176b5c30 100644 --- a/2026/CVE-2026-3497.md +++ b/2026/CVE-2026-3497.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1%3A8.9p1-3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1%3A9.6p1-3ubuntu13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-908%20Use%20of%20Uninitialized%20Resource&color=brightgreen) ### Description @@ -15,6 +16,7 @@ Vulnerability in the OpenSSH GSSAPI delta included in various Linux distribution #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-35033.md b/2026/CVE-2026-35033.md new file mode 100644 index 0000000000..563e14dedd --- /dev/null +++ b/2026/CVE-2026-35033.md @@ -0,0 +1,18 @@ +### [CVE-2026-35033](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35033) +![](https://img.shields.io/static/v1?label=Product&message=jellyfin&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2010.11.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-88%3A%20Improper%20Neutralization%20of%20Argument%20Delimiters%20in%20a%20Command%20('Argument%20Injection')&color=brightgreen) + +### Description + +Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any lowercase query parameter to a dictionary without validation, bypassing the RegularExpression attribute on the level controller parameter, and the unsanitized value is concatenated directly into the ffmpeg command line. By injecting a drawtext filter with a textfile argument, an attacker can read arbitrary server files such as /etc/shadow and exfiltrate their contents as text rendered in the video stream response. The vulnerable /Videos/{itemId}/stream endpoint has no Authorize attribute, making this exploitable without authentication, though item GUIDs are pseudorandom and require an authenticated user to obtain. This issue has been fixed in version 10.11.7. + +### POC + +#### Reference +- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-jh22-fw8w-2v9x + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35036.md b/2026/CVE-2026-35036.md new file mode 100644 index 0000000000..db5de9776b --- /dev/null +++ b/2026/CVE-2026-35036.md @@ -0,0 +1,17 @@ +### [CVE-2026-35036](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35036) +![](https://img.shields.io/static/v1?label=Product&message=Ech0&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.2.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts a fully attacker-controlled URL, performs a server-side GET, reads the entire response body into memory (io.ReadAll). There is no host allowlist, no SSRF filter, and InsecureSkipVerify: true on the outbound client. Anyone who can reach the instance can force the Ech0 server to open HTTP/HTTPS URLs of their choice as seen from the server’s network position (Docker bridge, VPC, localhost from the process view). This vulnerability is fixed in 4.2.8. + +### POC + +#### Reference +- https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3p + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35037.md b/2026/CVE-2026-35037.md new file mode 100644 index 0000000000..c1a3c3fe13 --- /dev/null +++ b/2026/CVE-2026-35037.md @@ -0,0 +1,17 @@ +### [CVE-2026-35037](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35037) +![](https://img.shields.io/static/v1?label=Product&message=Ech0&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.2.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the website_url query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. The endpoint requires no authentication. An attacker can use this to reach internal network services, cloud metadata endpoints (169.254.169.254), and localhost-bound services, with partial response data exfiltrated via the HTML tag extraction This vulnerability is fixed in 4.2.8. + +### POC + +#### Reference +- https://github.com/lin-snow/Ech0/security/advisories/GHSA-cqgf-f4x7-g6wc + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35046.md b/2026/CVE-2026-35046.md new file mode 100644 index 0000000000..685cd574ca --- /dev/null +++ b/2026/CVE-2026-35046.md @@ -0,0 +1,17 @@ +### [CVE-2026-35046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35046) +![](https://img.shields.io/static/v1?label=Product&message=recipes&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.6.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, Tandoor Recipes allows authenticated users to inject arbitrary <style> tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the <style> tag, causing the backend to persist and serve unsanitized CSS payloads via the API. Any client consuming instructions_markdown from the API and rendering it as HTML without additional sanitization will execute attacker-controlled CSS — enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration. This vulnerability is fixed in 2.6.4. + +### POC + +#### Reference +- https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9hhh-g2fc-r8x2 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35072.md b/2026/CVE-2026-35072.md index 6837bc9399..b90d50bef1 100644 --- a/2026/CVE-2026-35072.md +++ b/2026/CVE-2026-35072.md @@ -5,7 +5,7 @@ ### Description -Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain animproper neutralization of special elements used in an OS command ('OS command injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. +Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command ('OS command injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. ### POC diff --git a/2026/CVE-2026-35073.md b/2026/CVE-2026-35073.md index af08bf7dc3..14d0ad6ca2 100644 --- a/2026/CVE-2026-35073.md +++ b/2026/CVE-2026-35073.md @@ -5,7 +5,7 @@ ### Description -Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain animproper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. +Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. ### POC diff --git a/2026/CVE-2026-35074.md b/2026/CVE-2026-35074.md index 36c5a7db2f..9ee1c026e9 100644 --- a/2026/CVE-2026-35074.md +++ b/2026/CVE-2026-35074.md @@ -5,7 +5,7 @@ ### Description -Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain animproper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. +Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. ### POC diff --git a/2026/CVE-2026-35153.md b/2026/CVE-2026-35153.md index 31c6da70b3..2a247684bd 100644 --- a/2026/CVE-2026-35153.md +++ b/2026/CVE-2026-35153.md @@ -5,7 +5,7 @@ ### Description -Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain animproper neutralization of argument delimiters in a command ('argument injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. +Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of argument delimiters in a command ('argument injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. ### POC diff --git a/2026/CVE-2026-35154.md b/2026/CVE-2026-35154.md index 9ff81be54b..fb7670adc4 100644 --- a/2026/CVE-2026-35154.md +++ b/2026/CVE-2026-35154.md @@ -5,7 +5,7 @@ ### Description -Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain animproper privilege management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation. +Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation. ### POC diff --git a/2026/CVE-2026-35176.md b/2026/CVE-2026-35176.md new file mode 100644 index 0000000000..c3218e60d7 --- /dev/null +++ b/2026/CVE-2026-35176.md @@ -0,0 +1,17 @@ +### [CVE-2026-35176](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35176) +![](https://img.shields.io/static/v1?label=Product&message=openFPGALoader&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%201.1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) + +### Description + +openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in POFParser::parseSection() that allows out-of-bounds heap memory access when parsing a crafted .pof file. No FPGA hardware is required to trigger this vulnerability. + +### POC + +#### Reference +- https://github.com/trabucayre/openFPGALoader/security/advisories/GHSA-9x7m-m8gv-px2j + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35181.md b/2026/CVE-2026-35181.md new file mode 100644 index 0000000000..13f8831a36 --- /dev/null +++ b/2026/CVE-2026-35181.md @@ -0,0 +1,17 @@ +### [CVE-2026-35181](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35181) +![](https://img.shields.io/static/v1?label=Product&message=AVideo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%2026.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%3A%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) + +### Description + +WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform. + +### POC + +#### Reference +- https://github.com/WWBN/AVideo/security/advisories/GHSA-4q27-4rrq-fx95 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35196.md b/2026/CVE-2026-35196.md new file mode 100644 index 0000000000..ddf3c1ea81 --- /dev/null +++ b/2026/CVE-2026-35196.md @@ -0,0 +1,17 @@ +### [CVE-2026-35196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35196) +![](https://img.shields.io/static/v1?label=Product&message=chamilo-lms&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.0.0-RC.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sanitization or escaping using escapeshellarg(). If an attacker can manipulate or poison their session data to inject shell metacharacters into the _cid variable, they can achieve arbitrary command execution on the underlying server. Successful exploitation grants full access to read system files and credentials, alters the application and database, or disrupts server availability. This issue has been fixed in version 2.0.0-RC.3. + +### POC + +#### Reference +- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35368.md b/2026/CVE-2026-35368.md new file mode 100644 index 0000000000..d6873b8cec --- /dev/null +++ b/2026/CVE-2026-35368.md @@ -0,0 +1,17 @@ +### [CVE-2026-35368](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35368) +![](https://img.shields.io/static/v1?label=Product&message=coreutils&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-426%3A%20Untrusted%20Search%20Path&color=brightgreen) + +### Description + +A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation. + +### POC + +#### Reference +- https://github.com/uutils/coreutils/issues/10327 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35448.md b/2026/CVE-2026-35448.md new file mode 100644 index 0000000000..0b17675124 --- /dev/null +++ b/2026/CVE-2026-35448.md @@ -0,0 +1,17 @@ +### [CVE-2026-35448](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35448) +![](https://img.shields.io/static/v1?label=Product&message=AVideo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%2026.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated invoice.php page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform. + +### POC + +#### Reference +- https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35449.md b/2026/CVE-2026-35449.md new file mode 100644 index 0000000000..f8c0d618ab --- /dev/null +++ b/2026/CVE-2026-35449.md @@ -0,0 +1,17 @@ +### [CVE-2026-35449](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35449) +![](https://img.shields.io/static/v1?label=Product&message=AVideo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%2026.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) + +### Description + +WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors. + +### POC + +#### Reference +- https://github.com/WWBN/AVideo/security/advisories/GHSA-hg8q-8wqr-35xx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35453.md b/2026/CVE-2026-35453.md new file mode 100644 index 0000000000..11259a4675 --- /dev/null +++ b/2026/CVE-2026-35453.md @@ -0,0 +1,21 @@ +### [CVE-2026-35453](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35453) +![](https://img.shields.io/static/v1?label=Product&message=PhpSpreadsheet&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%201.30.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.0.0%2C%20%3C%3D%202.1.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.2.0%2C%20%3C%3D%202.4.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.3.0%2C%20%3C%3D%203.10.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.0.0%2C%20%3C%3D%205.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0, the HTML Writer skips htmlspecialchars() output escaping when a cell uses a custom number format containing the @ text placeholder with additional literal text (e.g., @ "items"). The escaping is only applied when the formatted output strictly equals the original cell value. When the format code contains @ with quoted literal text, the formatter substitutes the raw cell value into the format string and returns early without invoking the escaping callback. An attacker who can control cell content in a spreadsheet processed by the HTML Writer can inject arbitrary HTML and JavaScript into the generated output. This issue has been fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0. + +### POC + +#### Reference +- https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6wpp-88cp-7q68 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35458.md b/2026/CVE-2026-35458.md new file mode 100644 index 0000000000..feb92800e4 --- /dev/null +++ b/2026/CVE-2026-35458.md @@ -0,0 +1,17 @@ +### [CVE-2026-35458](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35458) +![](https://img.shields.io/static/v1?label=Product&message=gotenberg&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%208.29.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1333%3A%20Inefficient%20Regular%20Expression%20Complexity&color=brightgreen) + +### Description + +Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely. + +### POC + +#### Reference +- https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fmwg-qcqh-m992 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35461.md b/2026/CVE-2026-35461.md new file mode 100644 index 0000000000..5c3b307e24 --- /dev/null +++ b/2026/CVE-2026-35461.md @@ -0,0 +1,17 @@ +### [CVE-2026-35461](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35461) +![](https://img.shields.io/static/v1?label=Product&message=papra&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2026.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs, including localhost, internal network ranges, and cloud provider metadata endpoints, on every document event. This vulnerability is fixed in 26.4.0. + +### POC + +#### Reference +- https://github.com/papra-hq/papra/security/advisories/GHSA-cjw7-qg95-58mq + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35464.md b/2026/CVE-2026-35464.md index 5fb23e8fee..415ccb54a9 100644 --- a/2026/CVE-2026-35464.md +++ b/2026/CVE-2026-35464.md @@ -11,6 +11,7 @@ pyLoad is a free and open-source download manager written in Python. The fix for ### POC #### Reference +- https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j - https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxx #### Github diff --git a/2026/CVE-2026-35472.md b/2026/CVE-2026-35472.md new file mode 100644 index 0000000000..1f2a05df33 --- /dev/null +++ b/2026/CVE-2026-35472.md @@ -0,0 +1,17 @@ +### [CVE-2026-35472](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35472) +![](https://img.shields.io/static/v1?label=Product&message=WeGIA&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.6.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-601%3A%20URL%20Redirection%20to%20Untrusted%20Site%20('Open%20Redirect')&color=brightgreen) + +### Description + +WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9. + +### POC + +#### Reference +- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-h8wm-6xhv-r547 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35490.md b/2026/CVE-2026-35490.md new file mode 100644 index 0000000000..582ef4739f --- /dev/null +++ b/2026/CVE-2026-35490.md @@ -0,0 +1,17 @@ +### [CVE-2026-35490](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35490) +![](https://img.shields.io/static/v1?label=Product&message=changedetection.io&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.54.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost decorator because it registers the function it receives. When the order is reversed, @route() registers the original undecorated function, and the auth wrapper is never in the call chain. This silently disables authentication on these routes. This vulnerability is fixed in 0.54.8. + +### POC + +#### Reference +- https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-jmrh-xmgh-x9j4 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35492.md b/2026/CVE-2026-35492.md new file mode 100644 index 0000000000..61b6978396 --- /dev/null +++ b/2026/CVE-2026-35492.md @@ -0,0 +1,17 @@ +### [CVE-2026-35492](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35492) +![](https://img.shields.io/static/v1?label=Product&message=kedro-plugins&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%209.3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +Kedro-Datasets is a Kendo plugin providing data connectors. Prior to 9.3.0, PartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or malicious input containing .. components in a partition ID could cause files to be written outside the configured dataset directory, potentially overwriting arbitrary files on the filesystem. Users of PartitionedDataset with any storage backend (local filesystem, S3, GCS, etc.) are affected. This vulnerability is fixed in 9.3.0. + +### POC + +#### Reference +- https://github.com/kedro-org/kedro/issues/5452 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35514.md b/2026/CVE-2026-35514.md new file mode 100644 index 0000000000..bab8609c36 --- /dev/null +++ b/2026/CVE-2026-35514.md @@ -0,0 +1,17 @@ +### [CVE-2026-35514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35514) +![](https://img.shields.io/static/v1?label=Product&message=chartbrew&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3D%204.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) + +### Description + +Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, the endpoint POST /user/invited does not validate any invite token, authentication header, or session. Any unauthenticated attacker can call this endpoint directly to create a fully active account and receive a valid JWT — even when the instance has existing users and signupRestricted is enabled. This bypass is distinct from the normal registration endpoint (POST /user) which enforces signupRestricted and sets active: false pending verification. This issue has been patched in version 5.0.0. + +### POC + +#### Reference +- https://github.com/chartbrew/chartbrew/security/advisories/GHSA-g47g-v5cp-j8hp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35519.md b/2026/CVE-2026-35519.md new file mode 100644 index 0000000000..6387f897ad --- /dev/null +++ b/2026/CVE-2026-35519.md @@ -0,0 +1,18 @@ +### [CVE-2026-35519](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35519) +![](https://img.shields.io/static/v1?label=Product&message=FTL&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%206.0%2C%20%3C%206.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-93%3A%20Improper%20Neutralization%20of%20CRLF%20Sequences%20('CRLF%20Injection')&color=brightgreen) + +### Description + +FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the DNS host record configuration parameter (dns.hostRecord). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6. + +### POC + +#### Reference +- https://github.com/pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35575.md b/2026/CVE-2026-35575.md new file mode 100644 index 0000000000..cd00c52695 --- /dev/null +++ b/2026/CVE-2026-35575.md @@ -0,0 +1,18 @@ +### [CVE-2026-35575](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35575) +![](https://img.shields.io/static/v1?label=Product&message=CRM&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%206.5.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1004%3A%20Sensitive%20Cookie%20Without%20'HttpOnly'%20Flag&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting (Stored XSS) vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator views the page. This enables attackers to steal the administrator’s session cookies, potentially leading to full administrative account takeover. This vulnerability is fixed in 6.5.3. + +### POC + +#### Reference +- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-gc8q-2gw7-qj7w + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35579.md b/2026/CVE-2026-35579.md new file mode 100644 index 0000000000..9a7ef2b44e --- /dev/null +++ b/2026/CVE-2026-35579.md @@ -0,0 +1,18 @@ +### [CVE-2026-35579](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35579) +![](https://img.shields.io/static/v1?label=Product&message=coredns&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.14.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%3A%20Improper%20Authentication&color=brightgreen) + +### Description + +CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the configuration but never calls dns.TsigVerify() to validate the HMAC. If the key name matches a configured key, the tsigStatus field remains nil and the tsig plugin treats the request as successfully authenticated regardless of the MAC value. For DoH and DoH3, the issue is more severe: the DoHWriter.TsigStatus() method unconditionally returns nil, and the server never inspects the TSIG record at all. Any request containing a TSIG record is treated as authenticated over DoH and DoH3, even if the key name is invalid and the MAC is arbitrary.An unauthenticated network attacker can exploit this to bypass TSIG-protected functionality such as AXFR/IXFR zone transfers, dynamic DNS updates, or other TSIG-gated plugin behavior. The DoH and DoH3 variants have a lower exploitation bar because the attacker does not need to know a valid TSIG key name.This issue has been fixed in version 1.14.3. As a workaround, disable gRPC, QUIC, DoH, and DoH3 listeners where TSIG authentication is required, or restrict network-level access to affected transport ports to trusted sources only. + +### POC + +#### Reference +- https://github.com/coredns/coredns/security/advisories/GHSA-vp29-5652-4fw9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35585.md b/2026/CVE-2026-35585.md new file mode 100644 index 0000000000..9ef3f702f4 --- /dev/null +++ b/2026/CVE-2026-35585.md @@ -0,0 +1,18 @@ +### [CVE-2026-35585](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35585) +![](https://img.shields.io/static/v1?label=Product&message=filebrowser&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.0.0-rc.1%2C%20%3C%202.33.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-88%3A%20Improper%20Neutralization%20of%20Argument%20Delimiters%20in%20a%20Command%20('Argument%20Injection')&color=brightgreen) + +### Description + +File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell commands on file events such as upload, rename, and delete — is vulnerable to OS command injection. Variable substitution for values like $FILE and $USERNAME is performed via os.Expand without sanitization. An attacker with file write permission can craft a malicious filename containing shell metacharacters, causing the server to execute arbitrary OS commands when the hook fires. This results in Remote Code Execution (RCE). This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations. + +### POC + +#### Reference +- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35586.md b/2026/CVE-2026-35586.md new file mode 100644 index 0000000000..36c79dc150 --- /dev/null +++ b/2026/CVE-2026-35586.md @@ -0,0 +1,17 @@ +### [CVE-2026-35586](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35586) +![](https://img.shields.io/static/v1?label=Product&message=pyload&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.5.0b3.dev97%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() uses incorrect option names ssl_cert and ssl_key, while the actual configuration option names are ssl_certfile and ssl_keyfile. This name mismatch causes the admin-only check to always evaluate to False, allowing any user with SETTINGS permission to overwrite the SSL certificate and key file paths. Additionally, the ssl_certchain option was never added to the admin-only set at all. This vulnerability is fixed in 0.5.0b3.dev97. + +### POC + +#### Reference +- https://github.com/pyload/pyload/security/advisories/GHSA-ppvx-rwh9-7rj7 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35587.md b/2026/CVE-2026-35587.md new file mode 100644 index 0000000000..cf3adbe595 --- /dev/null +++ b/2026/CVE-2026-35587.md @@ -0,0 +1,17 @@ +### [CVE-2026-35587](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35587) +![](https://img.shields.io/static/v1?label=Product&message=glances&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.5.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery (SSRF) vulnerability exists in the Glances IP plugin due to improper validation of the public_api configuration parameter. The value of public_api is used directly in outbound HTTP requests without any scheme restriction or hostname/IP validation. An attacker who can modify the Glances configuration can force the application to send requests to arbitrary internal or external endpoints. Additionally, when public_username and public_password are set, Glances automatically includes these credentials in the Authorization: Basic header, resulting in credential leakage to attacker-controlled servers. This vulnerability can be exploited to access internal network services, retrieve sensitive data from cloud metadata endpoints, and/or exfiltrate credentials via outbound HTTP requests. The issue arises because public_api is passed directly to the HTTP client (urlopen_auth) without validation, allowing unrestricted outbound connections and unintended disclosure of sensitive information. Version 4.5.4 contains a patch. + +### POC + +#### Reference +- https://github.com/nicolargo/glances/security/advisories/GHSA-g5pq-48mj-jvw8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35596.md b/2026/CVE-2026-35596.md new file mode 100644 index 0000000000..466fbb621e --- /dev/null +++ b/2026/CVE-2026-35596.md @@ -0,0 +1,18 @@ +### [CVE-2026-35596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35596) +![](https://img.shields.io/static/v1?label=Product&message=vikunja&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator precedence bug that allows any authenticated user to read any label that has at least one task association, regardless of project access. Label titles, descriptions, colors, and creator information are exposed. This vulnerability is fixed in 2.3.0. + +### POC + +#### Reference +- https://github.com/go-vikunja/vikunja/commit/fc216c38afaa51dd56dde7a97343d2148ecf24c1 +- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hj5c-mhh2-g7jq + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35602.md b/2026/CVE-2026-35602.md new file mode 100644 index 0000000000..5d3616e1d3 --- /dev/null +++ b/2026/CVE-2026-35602.md @@ -0,0 +1,17 @@ +### [CVE-2026-35602](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35602) +![](https://img.shields.io/static/v1?label=Product&message=vikunja&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen) + +### Description + +Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file content length for the file size enforcement check. By setting Size to 0 in the JSON while including large compressed file entries in the zip, an attacker bypasses the configured maximum file size limit. This vulnerability is fixed in 2.3.0. + +### POC + +#### Reference +- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35605.md b/2026/CVE-2026-35605.md new file mode 100644 index 0000000000..7f15e467ab --- /dev/null +++ b/2026/CVE-2026-35605.md @@ -0,0 +1,17 @@ +### [CVE-2026-35605](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35605) +![](https://img.shields.io/static/v1?label=Product&message=filebrowser&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.63.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the Matches() function in rules/rules.go uses strings.HasPrefix() without a trailing directory separator when matching paths against access rules. A rule for /uploads also matches /uploads_backup/, granting or denying access to unintended directories. This vulnerability is fixed in 2.63.1. + +### POC + +#### Reference +- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5q48-q4fm-g3m6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35667.md b/2026/CVE-2026-35667.md new file mode 100644 index 0000000000..202e447bb6 --- /dev/null +++ b/2026/CVE-2026-35667.md @@ -0,0 +1,18 @@ +### [CVE-2026-35667](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35667) +![](https://img.shields.io/static/v1?label=Product&message=OpenClaw&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-404%20Improper%20Resource%20Shutdown%20or%20Release&color=brightgreen) + +### Description + +OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched killProcessTree function from shell-utils.ts that sends SIGKILL immediately without graceful SIGTERM shutdown. Attackers can trigger process termination via the !stop command, causing data corruption, resource leaks, and skipped security-sensitive cleanup operations. + +### POC + +#### Reference +- https://github.com/openclaw/openclaw/security/advisories/GHSA-3298-56p6-rpw2 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35668.md b/2026/CVE-2026-35668.md new file mode 100644 index 0000000000..d658731030 --- /dev/null +++ b/2026/CVE-2026-35668.md @@ -0,0 +1,18 @@ +### [CVE-2026-35668](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35668) +![](https://img.shields.io/static/v1?label=Product&message=OpenClaw&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit incomplete parameter validation in normalizeSandboxMediaParams and missing mediaLocalRoots context to access sensitive files including API keys and configuration data outside designated sandbox roots. + +### POC + +#### Reference +- https://github.com/openclaw/openclaw/security/advisories/GHSA-hr5v-j9h9-xjhg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35676.md b/2026/CVE-2026-35676.md new file mode 100644 index 0000000000..2f12127f0a --- /dev/null +++ b/2026/CVE-2026-35676.md @@ -0,0 +1,18 @@ +### [CVE-2026-35676](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35676) +![](https://img.shields.io/static/v1?label=Product&message=phpMyFAQ&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Weak%20Password%20Recovery%20Mechanism%20for%20Forgotten%20Password&color=brightgreen) + +### Description + +phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials. + +### POC + +#### Reference +- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9qv9-8xv6-5p35 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-35904.md b/2026/CVE-2026-35904.md new file mode 100644 index 0000000000..46b7b5d175 --- /dev/null +++ b/2026/CVE-2026-35904.md @@ -0,0 +1,17 @@ +### [CVE-2026-35904](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35904) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allows unauthorized attackers to enable the Telnet service via sending a crafted request to a vulnerable CGI component. + +### POC + +#### Reference +- https://github.com/PwnOnu/T3-Technology-CPE-Advisories/blob/main/CVE-2026-35904.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-36537.md b/2026/CVE-2026-36537.md new file mode 100644 index 0000000000..bd9abccb16 --- /dev/null +++ b/2026/CVE-2026-36537.md @@ -0,0 +1,17 @@ +### [CVE-2026-36537](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-36537) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote attacker can bypass authentication and gain full access to any existing user account on the platform without possessing the target user's credentials. This results in a complete account takeover. + +### POC + +#### Reference +- https://gist.github.com/KKC73/b9d4efda05693882f1e613c0e0fac78d + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-40355.md b/2026/CVE-2026-40355.md index f5eff21c9a..950a803502 100644 --- a/2026/CVE-2026-40355.md +++ b/2026/CVE-2026-40355.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476%20NULL%20Pointer%20Dereference&color=brightgreen) ### Description @@ -15,6 +16,7 @@ In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference - https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-41989.md b/2026/CVE-2026-41989.md index 30ec4b71f7..67e5283d97 100644 --- a/2026/CVE-2026-41989.md +++ b/2026/CVE-2026-41989.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1.8.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%20Out-of-bounds%20Write&color=brightgreen) ### Description @@ -16,6 +17,7 @@ Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html - https://dev.gnupg.org/T8211 #### Github diff --git a/2026/CVE-2026-42789.md b/2026/CVE-2026-42789.md index 43486a6288..2576bfdfe1 100644 --- a/2026/CVE-2026-42789.md +++ b/2026/CVE-2026-42789.md @@ -9,7 +9,7 @@ ### Description -Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement.Any party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.This issue affects OTP from OTP 17.0 before OTP 26.2.5.21, OTP 27.3.4.12, OTP 28.5.0.1, and OTP 29.0.1, corresponding to public_key from 0.22 before 1.15.1.7, 1.17.1.3, 1.20.3.1, and 1.21.1. Whether OTP before OTP 17.0, corresponding to public_key before 0.22, is affected is unknown. +Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery.In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement.Any party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers.This issue affects OTP from OTP 17.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to public_key from 0.22 before 1.17.1.7, 1.20.3.6, and 1.21.8. Whether OTP before OTP 17.0, corresponding to public_key before 0.22, is affected is unknown. ### POC diff --git a/2026/CVE-2026-43011.md b/2026/CVE-2026-43011.md index b006220f99..388ea3cfaa 100644 --- a/2026/CVE-2026-43011.md +++ b/2026/CVE-2026-43011.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/x25: Fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43024.md b/2026/CVE-2026-43024.md index 8629a4a87b..8b58c36355 100644 --- a/2026/CVE-2026-43024.md +++ b/2026/CVE-2026-43024.md @@ -17,6 +17,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=960cf4f812530f01f6acc6878ceaa5404c06af7b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f05a497e7bc8851eeeb3a58da180ba469efebb05%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f342de4e2f33e0e39165d8639387aa6c19dff660%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -30,6 +31,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43025.md b/2026/CVE-2026-43025.md index baf31f3d30..9118124b41 100644 --- a/2026/CVE-2026-43025.md +++ b/2026/CVE-2026-43025.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bd0779370588386e4a67ba5d0b176cfded8e6a53%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: ct #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43026.md b/2026/CVE-2026-43026.md index bc3ee0cb2b..187f51facd 100644 --- a/2026/CVE-2026-43026.md +++ b/2026/CVE-2026-43026.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: ct #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43027.md b/2026/CVE-2026-43027.md index 7a17d582c6..71e4639a7d 100644 --- a/2026/CVE-2026-43027.md +++ b/2026/CVE-2026-43027.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ac7b848390036dadd4351899d2a23748075916bd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43028.md b/2026/CVE-2026-43028.md index c3f710ffaf..4443bf4707 100644 --- a/2026/CVE-2026-43028.md +++ b/2026/CVE-2026-43028.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c38c4597e4bf3e99860eac98211748e1ecb0e139%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: x_ #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43030.md b/2026/CVE-2026-43030.md index c15c110298..b697e09b26 100644 --- a/2026/CVE-2026-43030.md +++ b/2026/CVE-2026-43030.md @@ -7,6 +7,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=95b6ec733752b31bfd166c4609d2c1b5cdde9b47%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Fix regs #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43033.md b/2026/CVE-2026-43033.md index 447a4f40b9..06c3f2b011 100644 --- a/2026/CVE-2026-43033.md +++ b/2026/CVE-2026-43033.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: authe #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43035.md b/2026/CVE-2026-43035.md index 767a6075c9..b509b68de5 100644 --- a/2026/CVE-2026-43035.md +++ b/2026/CVE-2026-43035.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: sched: c #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43038.md b/2026/CVE-2026-43038.md index 121def86b1..3199fc5aa0 100644 --- a/2026/CVE-2026-43038.md +++ b/2026/CVE-2026-43038.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ca15a078bd907df5fc1c009477869c5cbde3b753%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: icmp: c #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43040.md b/2026/CVE-2026-43040.md index af512e88f9..d004c24a1e 100644 --- a/2026/CVE-2026-43040.md +++ b/2026/CVE-2026-43040.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=31910575a9de61e78065e93846e8e7a4894a18bf%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: ipv6: nd #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43052.md b/2026/CVE-2026-43052.md new file mode 100644 index 0000000000..5d05d6a1b1 --- /dev/null +++ b/2026/CVE-2026-43052.md @@ -0,0 +1,20 @@ +### [CVE-2026-43052](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43052) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=941c93cd039852b7ab02c74f4698c99d82bd6cfe%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: mac80211: check tdls flag in ieee80211_tdls_operWhen NL80211_TDLS_ENABLE_LINK is called, the code only checks if thestation exists but not whether it is actually a TDLS station. Thisallows the operation to proceed for non-TDLS stations, causingunintended side effects like modifying channel context and HTprotection before failing.Add a check for sta->sta.tdls early in the ENABLE_LINK case, beforeany side effects occur, to ensure the operation is only allowed foractual TDLS peers. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43057.md b/2026/CVE-2026-43057.md index f3c3e7e651..63fdafda26 100644 --- a/2026/CVE-2026-43057.md +++ b/2026/CVE-2026-43057.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=864e3396976ef41de6cc7bc366276bf4e084fff2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a0478d7e888028f85fa7785ea838ce0ca09398e2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -24,6 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: correctl #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43071.md b/2026/CVE-2026-43071.md index 778edfafe7..d9dbab23ab 100644 --- a/2026/CVE-2026-43071.md +++ b/2026/CVE-2026-43071.md @@ -1,6 +1,7 @@ ### [CVE-2026-43071](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43071) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.10.55%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.12.29%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.14.19%20&color=brightgreen) @@ -8,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=3.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=99d263d4c5b2f541dfacb5391e22e8c91ea982a6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a8be8af18485f9fade90e1743d940252a39eec84%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b5cf3193759f7cd1cfbeef11f5cf067bbce22e55%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=be2378cbffe50ce0161f0fdee914adee98af53dc%20&color=brightgreen) @@ -22,6 +24,8 @@ In the Linux kernel, the following vulnerability has been resolved:dcache: Limit #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43074.md b/2026/CVE-2026-43074.md new file mode 100644 index 0000000000..de398fdd21 --- /dev/null +++ b/2026/CVE-2026-43074.md @@ -0,0 +1,22 @@ +### [CVE-2026-43074](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43074) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=58c9b016e12855286370dfb704c08498edbc857a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a1f93804449d13f97dabd4b996817de4bf1ed67a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f2451def095c1743adcfcb0cb5dadc86034e162a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:eventpoll: defer struct eventpoll free to RCU grace periodIn certain situations, ep_free() in eventpoll.c will kfree the epi->epeventpoll struct while it still being used by another concurrent thread.Defer the kfree() to an RCU callback to prevent UAF. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43080.md b/2026/CVE-2026-43080.md new file mode 100644 index 0000000000..df87dba391 --- /dev/null +++ b/2026/CVE-2026-43080.md @@ -0,0 +1,20 @@ +### [CVE-2026-43080](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43080) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.23%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3557baabf28088f49bdf72a048fd33ab62e205b1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:l2tp: Drop large packets with UDP encapsyzbot reported a WARN on my patch series [1]. The actual issue is anoverflow of 16-bit UDP length field, and it exists in the upstream code.My series added a debug WARN with an overflow check that exposed theissue, that's why syzbot tripped on my patches, rather than on upstreamcode.syzbot's repro:r0 = socket$pppl2tp(0x18, 0x1, 0x1)r1 = socket$inet6_udp(0xa, 0x2, 0x0)connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c)connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32)writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="ee", 0x34000}], 0x1)It basically sends an oversized (0x34000 bytes) PPPoL2TP packet with UDPencapsulation, and l2tp_xmit_core doesn't check for overflows when itassigns the UDP length field. The value gets trimmed to 16 bites.Add an overflow check that drops oversized packets and avoids sendingpackets with trimmed UDP length to the wire.syzbot's stack trace (with my patch applied):len >= 65536uWARNING: ./include/linux/udp.h:38 at udp_set_len_short include/linux/udp.h:38 [inline], CPU#1: syz.0.17/5957WARNING: ./include/linux/udp.h:38 at l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline], CPU#1: syz.0.17/5957WARNING: ./include/linux/udp.h:38 at l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327, CPU#1: syz.0.17/5957Modules linked in:CPU: 1 UID: 0 PID: 5957 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014RIP: 0010:udp_set_len_short include/linux/udp.h:38 [inline]RIP: 0010:l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline]RIP: 0010:l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327Code: 0f 0b 90 e9 21 f9 ff ff e8 e9 05 ec f6 90 0f 0b 90 e9 8d f9 ff ff e8 db 05 ec f6 90 0f 0b 90 e9 cc f9 ff ff e8 cd 05 ec f6 90 <0f> 0b 90 e9 de fa ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 4fRSP: 0018:ffffc90003d67878 EFLAGS: 00010293RAX: ffffffff8ad985e3 RBX: ffff8881a6400090 RCX: ffff8881697f0000RDX: 0000000000000000 RSI: 0000000000034010 RDI: 000000000000ffffRBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004R10: dffffc0000000000 R11: fffff520007acf00 R12: ffff8881baf20900R13: 0000000000034010 R14: ffff8881a640008e R15: ffff8881760f7000FS: 000055557e81f500(0000) GS:ffff8882a9467000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000200000033000 CR3: 00000001612f4000 CR4: 00000000000006f0Call Trace: <TASK> pppol2tp_sendmsg+0x40a/0x5f0 net/l2tp/l2tp_ppp.c:302 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] sock_write_iter+0x503/0x550 net/socket.c:1195 do_iter_readv_writev+0x619/0x8c0 fs/read_write.c:-1 vfs_writev+0x33c/0x990 fs/read_write.c:1059 do_writev+0x154/0x2e0 fs/read_write.c:1105 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7fRIP: 0033:0x7f636479c629Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007ffffd4241c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014RAX: ffffffffffffffda RBX: 00007f6364a15fa0 RCX: 00007f636479c629RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003RBP: 00007f6364832b39 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000R13: 00007f6364a15fac R14: 00007f6364a15fa0 R15: 00007f6364a15fa0 </TASK>[1]: https://lore.kernel.org/all/20260226201600.222044-1-alice.kernel@fastmail.im/ + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43085.md b/2026/CVE-2026-43085.md index 39c1f0bf1b..84939d839f 100644 --- a/2026/CVE-2026-43085.md +++ b/2026/CVE-2026-43085.md @@ -1,9 +1,11 @@ ### [CVE-2026-43085](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43085) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.23%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=29c5d4afba51c71cfeadd3f74f3c42e064483fb0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43089.md b/2026/CVE-2026-43089.md index af6d0e3373..1bf613f16f 100644 --- a/2026/CVE-2026-43089.md +++ b/2026/CVE-2026-43089.md @@ -1,9 +1,11 @@ ### [CVE-2026-43089](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43089) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.29%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:xfrm_user: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43093.md b/2026/CVE-2026-43093.md new file mode 100644 index 0000000000..2cc577f1c5 --- /dev/null +++ b/2026/CVE-2026-43093.md @@ -0,0 +1,26 @@ +### [CVE-2026-43093](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43093) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=25c9cdef57488578da21d99eb614b97ffcf6e59f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19.118%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.35%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.6.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=98d3c852e63b49129515dd18c875999efaf8530a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=99e3a236dd43d06c65af0a2ef9cb44306aef6e02%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ad8fb61c184fe0f8d1e0b5b954d010fb9f94a6ee%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:xsk: tighten UMEM headroom validation to account for tailroom and min frameThe current headroom validation in xdp_umem_reg() could leave us withinsufficient space dedicated to even receive minimum-sized ethernetframe. Furthermore if multi-buffer would come to play thenskb_shared_info stored at the end of XSK frame would be corrupted.HW typically works with 128-aligned sizes so let us provide this valueas bare minimum.Multi-buffer setting is known later in the configuration process sobesides accounting for 128 bytes, let us also take care of tailroom spaceupfront. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43094.md b/2026/CVE-2026-43094.md new file mode 100644 index 0000000000..dd8f6fbbcf --- /dev/null +++ b/2026/CVE-2026-43094.md @@ -0,0 +1,28 @@ +### [CVE-2026-43094](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43094) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.158%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.12.55%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.17.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.6.114%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=871ac1cd4ce4804defcb428cbb003fd84c415ff4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a376e29b1b196dc90b50df7e5e3947e3026300c4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a7075f501bd33c93570af759b6f4302ef0175168%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=bf580112ed61736c2645a893413a04732505d4b1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ixgbevf: add missing negotiate_features op to Hyper-V ops tableCommit a7075f501bd3 ("ixgbevf: fix mailbox API compatibility bynegotiating supported features") added the .negotiate_features callbackto ixgbe_mac_operations and populated it in ixgbevf_mac_ops, but forgotto add it to ixgbevf_hv_mac_ops. This leaves the function pointer NULLon Hyper-V VMs.During probe, ixgbevf_negotiate_api() calls ixgbevf_set_features(),which unconditionally dereferences hw->mac.ops.negotiate_features().On Hyper-V this results in a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine [...] Workqueue: events work_for_cpu_fn RIP: 0010:0x0 [...] Call Trace: ixgbevf_negotiate_api+0x66/0x160 [ixgbevf] ixgbevf_sw_init+0xe4/0x1f0 [ixgbevf] ixgbevf_probe+0x20f/0x4a0 [ixgbevf] local_pci_probe+0x50/0xa0 work_for_cpu_fn+0x1a/0x30 [...]Add ixgbevf_hv_negotiate_features_vf() that returns -EOPNOTSUPP andwire it into ixgbevf_hv_mac_ops. The caller already handles -EOPNOTSUPPgracefully. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43099.md b/2026/CVE-2026-43099.md new file mode 100644 index 0000000000..49bc2934ce --- /dev/null +++ b/2026/CVE-2026-43099.md @@ -0,0 +1,20 @@ +### [CVE-2026-43099](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43099) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d329ea5bd8845f0b196bf41b18b6173340d6e0e4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ipv4: icmp: fix null-ptr-deref in icmp_build_probe()ipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when theIPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passingthis error pointer to dev_hold() will cause a kernel crash withnull-ptr-deref.Instead, silently discard the request. RFC 8335 does not appear todefine a specific response for the case where an IPv6 interfaceidentifier is syntactically valid but the implementation cannot performthe lookup at runtime, and silently dropping the request may safer thanmisreporting "No Such Interface". + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43110.md b/2026/CVE-2026-43110.md new file mode 100644 index 0000000000..db8e8bbab4 --- /dev/null +++ b/2026/CVE-2026-43110.md @@ -0,0 +1,20 @@ +### [CVE-2026-43110](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43110) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2880b86859967af710c72f7d34fb421a86a71e22%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: brcmfmac: validate bsscfg indices in IF eventsbrcmf_fweh_handle_if_event() validates the firmware-provided interfaceindex before it touches drvr->iflist[], but it still uses the rawbsscfgidx field as an array index without a matching range check.Reject IF events whose bsscfg index does not fit in drvr->iflist[]before indexing the interface array.[add missing wifi prefix] + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43111.md b/2026/CVE-2026-43111.md new file mode 100644 index 0000000000..39aa9bf47f --- /dev/null +++ b/2026/CVE-2026-43111.md @@ -0,0 +1,20 @@ +### [CVE-2026-43111](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43111) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.35%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:HID: roccat: fix use-after-free in roccat_report_eventroccat_report_event() iterates over the device->readers list withoutholding the readers_lock. This allows a concurrent roccat_release() toremove and free a reader while it's still being accessed, leading to ause-after-free.Protect the readers list traversal with the readers_lock mutex. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43112.md b/2026/CVE-2026-43112.md new file mode 100644 index 0000000000..8fa5c2313c --- /dev/null +++ b/2026/CVE-2026-43112.md @@ -0,0 +1,22 @@ +### [CVE-2026-43112](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43112) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a31080899d5fdafcccf7f39dd214a814a2c82626%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c63433a09d6ae4c226fcbc66da4c58fc189fd746%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepathWhen cifs_sanitize_prepath is called with an empty string or a stringcontaining only delimiters (e.g., "/"), the current logic attempts tocheck *(cursor2 - 1) before cursor2 has advanced. This results in anout-of-bounds read.This patch adds an early exit check after stripping prependeddelimiters. If no path content remains, the function returns NULL.The bug was identified via manual audit and verified using astandalone test case compiled with AddressSanitizer, whichtriggered a SEGV on affected inputs. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43114.md b/2026/CVE-2026-43114.md new file mode 100644 index 0000000000..9e819b733d --- /dev/null +++ b/2026/CVE-2026-43114.md @@ -0,0 +1,20 @@ +### [CVE-2026-43114](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43114) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7400b063969bdca4a06cd97f1294d765c8eecbe1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiryNew test case fails unexpectedly when avx2 matching functions are used.The test first loads a ranomly generated pipapo setwith 'ipv4 . port' key, i.e. nft -f foo.This works. Then, it reloads the set after a flush:(echo flush set t s; cat foo) | nft -f -This is expected to work, because its the same set after all and it wasalready loaded once.But with avx2, this fails: nft reports a clashing element.The reported clash is of following form: We successfully re-inserted a . b c . dThen we try to insert a . davx2 finds the already existing a . d, which (due to 'flush set') is markedas invalid in the new generation. It skips the element and moves to next.Due to incorrect masking, the skip-step finds the next matchingelement *only considering the first field*,i.e. we return the already reinserted "a . b", even though thelast field is different and the entry should not have been matched.No such error is reported for the generic c implementation (no avx2) or whenthe last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.Bisection points to7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection")but that fix merely uncovers this bug.Before this commit, the wrong element is returned, but erronouslyreported as a full, identical duplicate.The root-cause is too early return in the avx2 match functions.When we process the last field, we should continue to process datauntil the entire input size has been consumed to make sure no stalebits remain in the map. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43116.md b/2026/CVE-2026-43116.md index 35567f63da..891bd900c1 100644 --- a/2026/CVE-2026-43116.md +++ b/2026/CVE-2026-43116.md @@ -1,8 +1,10 @@ ### [CVE-2026-43116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43116) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.16%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c1d10adb4a521de5760112853f42aaeefcec96eb%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: ct #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43117.md b/2026/CVE-2026-43117.md new file mode 100644 index 0000000000..c8d9ad55b0 --- /dev/null +++ b/2026/CVE-2026-43117.md @@ -0,0 +1,20 @@ +### [CVE-2026-43117](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43117) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=bc074524e123ded281cde25ebc5661910f9679e3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()If overlay is used on top of btrfs, dentry->d_sb translates to overlay'ssuper block and fsid assignment will lead to a crash.Use file_inode(file)->i_sb to always get btrfs_sb. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43216.md b/2026/CVE-2026-43216.md index 6c240f02db..213cf76bcc 100644 --- a/2026/CVE-2026-43216.md +++ b/2026/CVE-2026-43216.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b245be1f4db1a0394e4b6eb66059814b46670ac3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: Drop the #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43303.md b/2026/CVE-2026-43303.md index 21a60d36ae..d1de376a26 100644 --- a/2026/CVE-2026-43303.md +++ b/2026/CVE-2026-43303.md @@ -1,9 +1,11 @@ ### [CVE-2026-43303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43303) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3b8000ae185cb068adbda5f966a3835053c85fd4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:mm/page_alloc #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43350.md b/2026/CVE-2026-43350.md new file mode 100644 index 0000000000..19fae4b267 --- /dev/null +++ b/2026/CVE-2026-43350.md @@ -0,0 +1,20 @@ +### [CVE-2026-43350](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43350) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e2f8fbfb8d09c06decde162090fac3ee220aa280%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:smb: client: require a full NFS mode SID before reading mode bitsparse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFSmode SID and reads sid.sub_auth[2] to recover the mode bits.That assumes the ACE carries three subauthorities, but compare_sids()only compares min(a, b) subauthorities. A malicious server can returnan ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which stillmatches sid_unix_NFS_mode and then drives the sub_auth[2] read fourbytes past the end of the ACE.Require num_subauth >= 3 before treating the ACE as an NFS mode SID.This keeps the fix local to the special-SID mode path without changingcompare_sids() semantics for the rest of cifsacl. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43421.md b/2026/CVE-2026-43421.md new file mode 100644 index 0000000000..dca4d4069a --- /dev/null +++ b/2026/CVE-2026-43421.md @@ -0,0 +1,20 @@ +### [CVE-2026-43421](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43421) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=40d133d7f542616cf9538508a372306e626a16e9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:usb: gadget: f_ncm: Fix net_device lifecycle with device_moveThe network device outlived its parent gadget device duringdisconnection, resulting in dangling sysfs links and null pointerdereference problems.A prior attempt to solve this by removing SET_NETDEV_DEV entirely [1]was reverted due to power management ordering concerns and a NO-CARRIERregression.A subsequent attempt to defer net_device allocation to bind [2] broke1:1 mapping between function instance and network device, making itimpossible for configfs to report the resolved interface name. Thisresults in a regression where the DHCP server fails on pmOS.Use device_move to reparent the net_device between the gadget device and/sys/devices/virtual/ across bind/unbind cycles. This preserves thenetwork interface across USB reconnection, allowing the DHCP server toretain their binding.Introduce gether_attach_gadget()/gether_detach_gadget() helpers and use__free(detach_gadget) macro to undo attachment on bind failure. Thebind_count ensures device_move executes only on the first bind.[1] https://lore.kernel.org/lkml/f2a4f9847617a0929d62025748384092e5f35cce.camel@crapouillou.net/[2] https://lore.kernel.org/linux-usb/795ea759-7eaf-4f78-81f4-01ffbf2d7961@ixit.cz/ + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43492.md b/2026/CVE-2026-43492.md index e908624e3c..625b26c6d5 100644 --- a/2026/CVE-2026-43492.md +++ b/2026/CVE-2026-43492.md @@ -1,9 +1,11 @@ ### [CVE-2026-43492](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43492) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2d4d1eea540b27c72488fd1914674c42473d53df%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:lib/crypto: m #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43493.md b/2026/CVE-2026-43493.md new file mode 100644 index 0000000000..377f1d11b1 --- /dev/null +++ b/2026/CVE-2026-43493.md @@ -0,0 +1,20 @@ +### [CVE-2026-43493](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43493) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.34%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5a1436beec5744029f3ac90b6fe71a698dcd6155%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:crypto: pcrypt - Fix handling of MAY_BACKLOG requestsMAY_BACKLOG requests can return EBUSY. Handle them by checkingfor that value and filtering out EINPROGRESS notifications. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43496.md b/2026/CVE-2026-43496.md new file mode 100644 index 0000000000..d6485edbfb --- /dev/null +++ b/2026/CVE-2026-43496.md @@ -0,0 +1,20 @@ +### [CVE-2026-43496](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43496) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.29%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=77be155cba4e163e8bba9fd27222a8b6189ec4f7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peekedWhen red qdisc has children (eg qfq qdisc) whose peek() callback isqdisc_peek_dequeued(), we could get a kernel panic. When the parent of suchqdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb fromits child (red in this case), it will do the following: 1a. do a peek() - and when sensing there's an skb the child can offer, then - the child in this case(red) calls its child's (qfq) peek. qfq does the right thing and will return the gso_skb queue packet. Note: if there wasnt a gso_skb entry then qfq will store it there. 1b. invoke a dequeue() on the child (red). And herein lies the problem. - red will call the child's dequeue() which will essentially just try to grab something of qfq's queue.[ 78.667668][ T363] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f][ 78.667927][ T363] CPU: 1 UID: 0 PID: 363 Comm: ping Not tainted 7.1.0-rc1-00033-g46f74a3f7d57-dirty #790 PREEMPT(full)[ 78.668263][ T363] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011[ 78.668486][ T363] RIP: 0010:qfq_dequeue+0x446/0xc90 [sch_qfq][ 78.668718][ T363] Code: 54 c0 e8 dd 90 00 f1 48 c7 c7 e0 03 54 c0 48 89 de e8 ce 90 00 f1 48 8d 7b 48 b8 ff ff 37 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 <80> 3c 02 00 74 05 e8 ef a1 e1 f1 48 8b 7b 48 48 8d 54 24 58 48 8d[ 78.669312][ T363] RSP: 0018:ffff88810de573e0 EFLAGS: 00010216[ 78.669533][ T363] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000[ 78.669790][ T363] RDX: 0000000000000009 RSI: 0000000000000004 RDI: 0000000000000048[ 78.670044][ T363] RBP: ffff888110dc4000 R08: ffffffffb1b0885a R09: fffffbfff6ba9078[ 78.670297][ T363] R10: 0000000000000003 R11: ffff888110e31c80 R12: 0000001880000000[ 78.670560][ T363] R13: ffff888110dc4150 R14: ffff888110dc42b8 R15: 0000000000000200[ 78.670814][ T363] FS: 00007f66a8f09c40(0000) GS:ffff888163428000(0000) knlGS:0000000000000000[ 78.671110][ T363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033[ 78.671324][ T363] CR2: 000055db4c6a30a8 CR3: 000000010da67000 CR4: 0000000000750ef0[ 78.671585][ T363] PKRU: 55555554[ 78.671713][ T363] Call Trace:[ 78.671843][ T363] <TASK>[ 78.671936][ T363] ? __pfx_qfq_dequeue+0x10/0x10 [sch_qfq][ 78.672148][ T363] ? __pfx__printk+0x10/0x10[ 78.672322][ T363] ? srso_alias_return_thunk+0x5/0xfbef5[ 78.672496][ T363] ? lockdep_hardirqs_on_prepare+0xa8/0x1a0[ 78.672706][ T363] ? srso_alias_return_thunk+0x5/0xfbef5[ 78.672875][ T363] ? trace_hardirqs_on+0x19/0x1a0[ 78.673047][ T363] red_dequeue+0x65/0x270 [sch_red][ 78.673217][ T363] ? srso_alias_return_thunk+0x5/0xfbef5[ 78.673385][ T363] tbf_dequeue.cold+0xb0/0x70c [sch_tbf][ 78.673566][ T363] __qdisc_run+0x169/0x1900The right thing to do in #1b is to grab the skb off gso_skb queue.This patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked()method instead. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43499.md b/2026/CVE-2026-43499.md index 7ee6bc1b95..204e3645c5 100644 --- a/2026/CVE-2026-43499.md +++ b/2026/CVE-2026-43499.md @@ -1,9 +1,11 @@ ### [CVE-2026-43499](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43499) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.39%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8161239a8bcce9ad6b537c04a1fa3b5c68bae693%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -15,6 +17,8 @@ In the Linux kernel, the following vulnerability has been resolved:rtmutex: Use #### Reference - http://www.openwall.com/lists/oss-security/2026/07/08/12 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43501.md b/2026/CVE-2026-43501.md index e3aefd25d7..54f4a14b04 100644 --- a/2026/CVE-2026-43501.md +++ b/2026/CVE-2026-43501.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -15,6 +16,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: rpl: re #### Reference - https://bugzilla.redhat.com/show_bug.cgi?id=2480457 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-43502.md b/2026/CVE-2026-43502.md new file mode 100644 index 0000000000..d32fdf31bd --- /dev/null +++ b/2026/CVE-2026-43502.md @@ -0,0 +1,20 @@ +### [CVE-2026-43502](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43502) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net/rds: handle zerocopy send cleanup before the message is queuedA zerocopy send can fail after user pages have been pinned but beforethe message is attached to the sending socket.The purge path currently infers zerocopy state from rm->m_rs, so anunqueued message can be cleaned up as if it owned normal payload pages.However, zerocopy ownership is really determined by the presence ofop_mmp_znotifier, regardless of whether the message has reached thesocket queue.Capture op_mmp_znotifier up front in rds_message_purge() and use it asthe cleanup discriminator. If the message is already associated with asocket, keep the existing completion path. Otherwise, drop the pinnedpage accounting directly and release the notifier before putting thepayload pages.This keeps early send failure cleanup consistent with the zerocopylifetime rules without changing the normal queued completion path. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43503.md b/2026/CVE-2026-43503.md new file mode 100644 index 0000000000..a66d71132b --- /dev/null +++ b/2026/CVE-2026-43503.md @@ -0,0 +1,20 @@ +### [CVE-2026-43503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43503) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=cef401de7be8c4e155c6746bfccf721a4fa5fab9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: skbuff: propagate shared-frag marker through frag-transfer helpersTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) failto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags whenmoving frags from source to destination. __pskb_copy_fclone() defersthe rest of the shinfo metadata to skb_copy_header() after copyingfrag descriptors, but that helper only carries over gso_{size,segs,type} and never touches skb_shinfo()->flags; skb_shift() moves fragdescriptors directly and leaves flags untouched. As a result, thedestination skb keeps a reference to the same externally-owned orpage-cache-backed pages while reporting skb_has_shared_frag() asfalse.The mismatch is harmful in any in-place writer that usesskb_has_shared_frag() to decide whether shared pages must be detouredthrough skb_cow_data(). ESP input is one such writer (esp4.c,esp6.c), and a single nft 'dup to <local>' rule -- or any othernf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'dskb in esp_input() with the marker stripped, letting an unprivilegeduser write into the page cache of a root-owned read-only file viaauthencesn-ESN stray writes.Set SKBFL_SHARED_FRAG on the destination whenever frag descriptorswere actually moved from the source. skb_copy() and skb_copy_expand()share skb_copy_header() too but linearize all paged data into freshlyallocated head storage and emerge with nr_frags == 0, soskb_has_shared_frag() returns false on its own; they need no change.The same omission exists in skb_gro_receive() and skb_gro_receive_list().The former moves the incoming skb's frag descriptors into theaccumulator's last sub-skb via two paths (a direct frag-move loop andthe head_frag + memcpy path); the latter chains the incoming skb wholeonto p's frag_list. Downstream skb_segment() reads onlyskb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb'sshinfo as the nskb -- both p and lp must carry the marker.The same omission also exists in tcp_clone_payload(), which builds anMTU probe skb by moving frag descriptors from skbs on sk_write_queueinto a freshly allocated nskb. The helper falls into the same familyand warrants the same fix for consistency; no TCP TX-side in-placewriter is currently known to reach a user page through this gap, buta future consumer depending on the marker would regress silently.The same omission exists in skb_segment(): the per-iteration flagmerge takes only head_skb's flag, and the inner switch that rebindsfrag_skb to list_skb on head_skb-frags exhaustion does not fold thenew frag_skb's flag into nskb. Fold frag_skb's flag at both sitesso segments drawing frags from frag_list members carry the marker. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-43966.md b/2026/CVE-2026-43966.md index c4de272fbe..7252806c2a 100644 --- a/2026/CVE-2026-43966.md +++ b/2026/CVE-2026-43966.md @@ -6,7 +6,7 @@ ### Description -Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.This issue affects cowlib from 2.9.0. +Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting via non-VCHAR bytes in structured-fields string values.cow_http_struct_hd:escape_string/2 in cowlib only escapes \ and ", passing all other bytes through verbatim. This creates an encoder/decoder asymmetry: the matching parser accepts only printable ASCII (0x20–0x7E, excluding " and \), but the encoder emits any byte including CR and LF. An application that builds a structured HTTP header via cow_http_struct_hd:item/1 (or a higher-level wrapper such as cow_http_hd:wt_protocol/1) from attacker-controlled input can have \r\n injected into the serialized header value. Once on the wire, the injected CRLF terminates the current header and any following bytes are interpreted as a new header, enabling HTTP response splitting.This issue affects cowlib: from 2.9.0 onward. ### POC diff --git a/2026/CVE-2026-44252.md b/2026/CVE-2026-44252.md new file mode 100644 index 0000000000..65673265f3 --- /dev/null +++ b/2026/CVE-2026-44252.md @@ -0,0 +1,17 @@ +### [CVE-2026-44252](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44252) +![](https://img.shields.io/static/v1?label=Product&message=wazuh&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.0.0%2C%20%3C%204.14.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET /manager/configuration?raw=true. An attacker with network access to TCP port 1516 can use the disclosed Fernet key to impersonate a cluster worker and submit distributed API requests containing attacker-controlled rbac_permissions with rbac_mode set to black. Because the master trusts the worker-supplied authorization context, the attacker can create users, assign administrator roles, access credentials and API tokens, modify configuration, and execute actions across agents. This issue is fixed in version 4.14.5. + +### POC + +#### Reference +- https://github.com/wazuh/wazuh/security/advisories/GHSA-34fx-c2xw-xcpg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-44300.md b/2026/CVE-2026-44300.md new file mode 100644 index 0000000000..bb35c96d1b --- /dev/null +++ b/2026/CVE-2026-44300.md @@ -0,0 +1,18 @@ +### [CVE-2026-44300](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44300) +![](https://img.shields.io/static/v1?label=Product&message=opencost&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.121.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-309%3A%20Use%20of%20Password%20System%20for%20Primary%20Authentication&color=brightgreen) + +### Description + +OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP service-account key.json file returned by GetGCPAuthSecretFilePath in core/pkg/env/core.go. The attacker controls the file contents but not the CONFIG_PATH-derived directory, the key.json filename, or the file mode. Replacing the credential contents can disrupt GCP cost collection or cause OpenCost to use attacker-selected credentials, and the wildcard Access-Control-Allow-Origin response permits browser-assisted requests when the service is reachable from a browser. This issue is fixed in version 1.121.0. + +### POC + +#### Reference +- https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-44642.md b/2026/CVE-2026-44642.md new file mode 100644 index 0000000000..3466b5522a --- /dev/null +++ b/2026/CVE-2026-44642.md @@ -0,0 +1,17 @@ +### [CVE-2026-44642](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44642) +![](https://img.shields.io/static/v1?label=Product&message=Piwigo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2016.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade.php conditionally escapes the submitted username only when the removed get_magic_quotes_gpc function exists, so PHP 8 and later concatenate an unauthenticated username directly into the upgrade authentication SQL query. When database upgrades are pending, a crafted query result can satisfy the status and password checks, set PHPWG_IN_UPGRADE, and authorize upgrade execution without valid administrator credentials. This can cause unauthorized database integrity changes and service disruption. This vulnerability is fixed in 16.4.0. + +### POC + +#### Reference +- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45019.md b/2026/CVE-2026-45019.md index 586fa450fd..5a5bb64049 100644 --- a/2026/CVE-2026-45019.md +++ b/2026/CVE-2026-45019.md @@ -10,8 +10,10 @@ Chainlit is a Python framework for building production-ready conversational AI a ### POC #### Reference +- https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-002--ssrf-via-mcp-streamable-http--sse - https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9 - https://github.com/Chainlit/chainlit/releases/tag/2.12.0 +- https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-45103.md b/2026/CVE-2026-45103.md new file mode 100644 index 0000000000..a8d4ec9cd6 --- /dev/null +++ b/2026/CVE-2026-45103.md @@ -0,0 +1,18 @@ +### [CVE-2026-45103](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45103) +![](https://img.shields.io/static/v1?label=Product&message=opensips&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.4.0%2C%20%3C%203.6.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.0.0-beta%2C%20%3C%204.0.0-rc1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-190%3A%20Integer%20Overflow%20or%20Wraparound&color=brightgreen) + +### Description + +OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned int (e.g., 4294967296), the framing layer computes a wrapped-around value (e.g., 0) and splits the TCP stream at the wrong boundary, causing the body of the first SIP message to be processed as a separate message and enabling SIP message smuggling. Because Content-Length is parsed in the transport layer before authentication, an unauthenticated, network-based attacker can smuggle arbitrary SIP messages over any TCP-based transport (proto_tcp, proto_tls, proto_ws, proto_wss) on any instance with TCP enabled, with no routing-script preconditions. This allows smuggled messages to bypass front-end SBC/proxy security policies, inherit the connection's authentication context, and evade rate limiting. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1. + +### POC + +#### Reference +- https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jv35-555v-54jh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45161.md b/2026/CVE-2026-45161.md new file mode 100644 index 0000000000..2ada0e5b7e --- /dev/null +++ b/2026/CVE-2026-45161.md @@ -0,0 +1,17 @@ +### [CVE-2026-45161](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45161) +![](https://img.shields.io/static/v1?label=Product&message=wger&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%3A%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) + +### Description + +wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login()` without any CSRF protection, because Django's `CsrfViewMiddleware` only enforces tokens on unsafe methods (POST/PUT/PATCH/DELETE). An attacker can embed a single `<img>` tag on a malicious page; when an authenticated trainer loads that page, their browser auto-issues the GET with the session cookie, forcibly rebinding the trainer's session to an arbitrary user account. Version 2.6 fixes the issue. + +### POC + +#### Reference +- https://github.com/wger-project/wger/security/advisories/GHSA-xf64-4pmc-h8qf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45302.md b/2026/CVE-2026-45302.md new file mode 100644 index 0000000000..6bed64c3a5 --- /dev/null +++ b/2026/CVE-2026-45302.md @@ -0,0 +1,17 @@ +### [CVE-2026-45302](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45302) +![](https://img.shields.io/static/v1?label=Product&message=parse-nested-form-data&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1321%3A%20Improperly%20Controlled%20Modification%20of%20Object%20Prototype%20Attributes%20('Prototype%20Pollution')&color=brightgreen) + +### Description + +parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1. + +### POC + +#### Reference +- https://github.com/milamer/parse-nested-form-data/commit/527ad58eb486e32438f7198fb88315c20449d792 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45331.md b/2026/CVE-2026-45331.md new file mode 100644 index 0000000000..8c4ca4fa2f --- /dev/null +++ b/2026/CVE-2026-45331.md @@ -0,0 +1,17 @@ +### [CVE-2026-45331](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45331) +![](https://img.shields.io/static/v1?label=Product&message=open-webui&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, validate_url() in backend/open_webui/retrieval/web/utils.py calls validators.ipv6(ip, private=True), but the validators library does NOT implement the private keyword for IPv6 — the call raises a ValidationError (which is falsy in a boolean context), so every IPv6 address passes the filter. In addition, IPv4-mapped IPv6 (::ffff:10.0.0.1) bypasses the IPv4 check entirely, and several reserved IPv4 ranges (0.0.0.0/8, 100.64.0.0/10, 192.0.0.0/24, etc.) are not blocked. This vulnerability is fixed in 0.9.0. + +### POC + +#### Reference +- https://github.com/open-webui/open-webui/security/advisories/GHSA-4v7r-f4w8-8972 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45370.md b/2026/CVE-2026-45370.md new file mode 100644 index 0000000000..8711f6a006 --- /dev/null +++ b/2026/CVE-2026-45370.md @@ -0,0 +1,17 @@ +### [CVE-2026-45370](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45370) +![](https://img.shields.io/static/v1?label=Product&message=python-utcp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.1.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-526%3A%20Cleartext%20Storage%20of%20Sensitive%20Information%20in%20an%20Environment%20Variable&color=brightgreen) + +### Description + +python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This vulnerability is fixed in 1.1.3. + +### POC + +#### Reference +- https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-5v57-8rxj-3p2r + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45537.md b/2026/CVE-2026-45537.md new file mode 100644 index 0000000000..40e50dabca --- /dev/null +++ b/2026/CVE-2026-45537.md @@ -0,0 +1,18 @@ +### [CVE-2026-45537](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45537) +![](https://img.shields.io/static/v1?label=Product&message=opensips&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.4.0%2C%20%3C%203.6.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.0.0-beta%2C%20%3C%204.0.0-rc1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-120%3A%20Buffer%20Copy%20without%20Checking%20Size%20of%20Input%20('Classic%20Buffer%20Overflow')&color=brightgreen) + +### Description + +OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function's data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1. + +### POC + +#### Reference +- https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45680.md b/2026/CVE-2026-45680.md new file mode 100644 index 0000000000..b4ab9eb99c --- /dev/null +++ b/2026/CVE-2026-45680.md @@ -0,0 +1,18 @@ +### [CVE-2026-45680](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45680) +![](https://img.shields.io/static/v1?label=Product&message=opentelemetry-ebpf-instrumentation&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-834%3A%20Excessive%20Iteration&color=brightgreen) + +### Description + +OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI replays BPF probe hits into histogram observations by looping once per recorded run count. On busy systems, the run-count delta can become very large, causing the metrics exporter to spend excessive CPU time in a tight loop every collection interval. This issue has been patched in version 0.9.0. + +### POC + +#### Reference +- https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-89c6-vpcj-7vj4 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45711.md b/2026/CVE-2026-45711.md new file mode 100644 index 0000000000..e857f7d3ad --- /dev/null +++ b/2026/CVE-2026-45711.md @@ -0,0 +1,18 @@ +### [CVE-2026-45711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45711) +![](https://img.shields.io/static/v1?label=Product&message=mailpit&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.30.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-829%3A%20Inclusion%20of%20Functionality%20from%20Untrusted%20Control%20Sphere&color=brightgreen) + +### Description + +Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message from a remote Mailpit instance and writes each one as <id>.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch. + +### POC + +#### Reference +- https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45730.md b/2026/CVE-2026-45730.md new file mode 100644 index 0000000000..41af6ff07d --- /dev/null +++ b/2026/CVE-2026-45730.md @@ -0,0 +1,17 @@ +### [CVE-2026-45730](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45730) +![](https://img.shields.io/static/v1?label=Product&message=nuclio&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.16.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its associated resources (functions, API gateways, etc.). This issue has been patched in version 1.16.0. + +### POC + +#### Reference +- https://github.com/nuclio/nuclio/security/advisories/GHSA-m8xg-8xg9-mxhm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45806.md b/2026/CVE-2026-45806.md new file mode 100644 index 0000000000..1076c1280c --- /dev/null +++ b/2026/CVE-2026-45806.md @@ -0,0 +1,17 @@ +### [CVE-2026-45806](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45806) +![](https://img.shields.io/static/v1?label=Product&message=penpot&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.15.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in backend/src/app/rpc/commands/media.clj, where media/download-image in backend/src/app/media.clj used the shared HTTP client without destination filtering, allowing an authenticated file editor to reach internal-only endpoints. This issue is fixed in version 2.15.0. + +### POC + +#### Reference +- https://github.com/penpot/penpot/security/advisories/GHSA-35g2-w7f6-8v9h + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45834.md b/2026/CVE-2026-45834.md new file mode 100644 index 0000000000..cbba61eafc --- /dev/null +++ b/2026/CVE-2026-45834.md @@ -0,0 +1,20 @@ +### [CVE-2026-45834](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45834) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=89bc500e41fc5b48e0573e6b0d927fc97b8951dc%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()Add the same NULL guard already present inl2cap_sock_resume_cb() and l2cap_sock_ready_cb(). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45835.md b/2026/CVE-2026-45835.md new file mode 100644 index 0000000000..d424d1721b --- /dev/null +++ b/2026/CVE-2026-45835.md @@ -0,0 +1,20 @@ +### [CVE-2026-45835](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45835) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=80808e431e1ef25856457de82ce141bed6a6313a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()Add the same NULL guard already present inl2cap_sock_resume_cb() and l2cap_sock_ready_cb(). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45836.md b/2026/CVE-2026-45836.md new file mode 100644 index 0000000000..6fac079eec --- /dev/null +++ b/2026/CVE-2026-45836.md @@ -0,0 +1,20 @@ +### [CVE-2026-45836](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45836) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8d836d71e2223b8961b21112bb4ce89ef8231682%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()Add the same NULL guard already present inl2cap_sock_resume_cb() and l2cap_sock_ready_cb(). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45838.md b/2026/CVE-2026-45838.md new file mode 100644 index 0000000000..3ac485cc37 --- /dev/null +++ b/2026/CVE-2026-45838.md @@ -0,0 +1,20 @@ +### [CVE-2026-45838](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45838) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=de9cbbaadba5adf88a19e46df61f7054000838f6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:bpf: fix end-of-list detection in cgroup_storage_get_next_key()list_next_entry() never returns NULL -- when the current element is thelast entry it wraps to the list head via container_of(). The subsequentNULL check is therefore dead code and get_next_key() never returns-ENOENT for the last element, instead reading storage->key from a boguspointer that aliases internal map fields and copying the result touserspace.Replace it with list_entry_is_head() so the function correctly returns-ENOENT when there are no more entries. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45839.md b/2026/CVE-2026-45839.md new file mode 100644 index 0000000000..5e9de3779e --- /dev/null +++ b/2026/CVE-2026-45839.md @@ -0,0 +1,20 @@ +### [CVE-2026-45839](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45839) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ddc7c3042614e273044f698d2beab25cc3842d45%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()CO-RE accessor strings are colon-separated indices that describe a pathfrom a root BTF type to a target field, e.g. "0:1:2" walks throughnested struct members. bpf_core_parse_spec() parses each component withsscanf("%d"), so negative values like -1 are silently accepted. Thesubsequent bounds checks (access_idx >= btf_vlen(t)) only guard theupper bound and always pass for negative values because C integerpromotion converts the __u16 btf_vlen result to int, making thecomparison (int)(-1) >= (int)(N) false for any positive N.When -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff,producing an out-of-bounds read far past the members array. A craftedBPF program with a negative CO-RE accessor on any struct that exists invmlinux BTF (e.g. task_struct) crashes the kernel deterministicallyduring BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y(default on major distributions). The bug is reachable with CAP_BPF: BUG: unable to handle page fault for address: ffffed11818b6626 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full) RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354) RAX: 00000000ffffffff Call Trace: <TASK> bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321) bpf_core_apply (kernel/bpf/btf.c:9507) check_core_relo (kernel/bpf/verifier.c:19475) bpf_check (kernel/bpf/verifier.c:26031) bpf_prog_load (kernel/bpf/syscall.c:3089) __sys_bpf (kernel/bpf/syscall.c:6228) </TASK>CO-RE accessor indices are inherently non-negative (struct member index,array element index, or enumerator index), so reject them immediatelyafter parsing. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45840.md b/2026/CVE-2026-45840.md new file mode 100644 index 0000000000..e4bc05efa7 --- /dev/null +++ b/2026/CVE-2026-45840.md @@ -0,0 +1,20 @@ +### [CVE-2026-45840](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45840) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5cd667b0a4567048bb555927d6ee564f4e5620a9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:openvswitch: cap upcall PID array size and pre-size vport repliesThe vport netlink reply helpers allocate a fixed-size skb withnlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PIDarray via ovs_vport_get_upcall_portids(). Sinceovs_vport_set_upcall_portids() accepts any non-zero multiple ofsizeof(u32) with no upper bound, a CAP_NET_ADMIN user can install a PIDarray large enough to overflow the reply buffer, causing nla_put() tofail with -EMSGSIZE and hitting BUG_ON(err < 0). On systems withunprivileged user namespaces enabled (e.g., Ubuntu default), this isreachable via unshare -Urn since OVS vport mutation operations useGENL_UNS_ADMIN_PERM. kernel BUG at net/openvswitch/datapath.c:2414! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 65 Comm: poc Not tainted 7.0.0-rc7-00195-geb216e422044 #1 RIP: 0010:ovs_vport_cmd_set+0x34c/0x400 Call Trace: <TASK> genl_family_rcv_msg_doit (net/netlink/genetlink.c:1116) genl_rcv_msg (net/netlink/genetlink.c:1194) netlink_rcv_skb (net/netlink/af_netlink.c:2550) genl_rcv (net/netlink/genetlink.c:1219) netlink_unicast (net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) __sys_sendto (net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Kernel panic - not syncing: Fatal exceptionReject attempts to set more PIDs than nr_cpu_ids inovs_vport_set_upcall_portids(), and pre-compute the worst-case replysize in ovs_vport_cmd_msg_size() based on that bound, similar to theexisting ovs_dp_cmd_msg_size(). nr_cpu_ids matches the cap alreadyused by the per-CPU dispatch configuration on the datapath side(ovs_dp_cmd_fill_info() serialises at most nr_cpu_ids PIDs), so thetwo sides stay consistent. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45841.md b/2026/CVE-2026-45841.md index fa23f4b489..e0e63397f9 100644 --- a/2026/CVE-2026-45841.md +++ b/2026/CVE-2026-45841.md @@ -1,9 +1,11 @@ ### [CVE-2026-45841](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45841) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.31%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-45842.md b/2026/CVE-2026-45842.md new file mode 100644 index 0000000000..3e2f2df86a --- /dev/null +++ b/2026/CVE-2026-45842.md @@ -0,0 +1,38 @@ +### [CVE-2026-45842](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45842) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.32.70%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.10.96%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.12.53%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.14.60%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.18.27%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.75%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.4.111%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=354b254af5c1350de9586af75fe5a821b35bfb33%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=42fc512469e78939c1e419d3310c47de55bdcbb8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4ab42d78e37a294ac7bc56901d563c642e03c4ae%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5148857f5d4c812cc918cf4627f7880521e987eb%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6b4fa561e26526c62636414d267342c945084f44%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=82185755d90c8047c6f4b589c39998ff3d4ca3ad%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a1c3860d3c5fc62bd35f089bcb03f18a37242de9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a50a93cc99286dc444c7e5ccc7dfb9d58c2d346d%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=df085f1cb3acd3d75408ff94f366983873bce7d2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f82699de104eaf8a7ffc2849a566a94818dd8a3c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:slip: reject VJ receive packets on instances with no rstate arrayslhc_init() accepts rslots == 0 as a valid configuration, with thedocumented meaning of 'no receive compression'. In that case theallocation loop in slhc_init() is skipped, so comp->rstate staysNULL and comp->rslot_limit stays 0 (from the kzalloc of structslcompress).The receive helpers do not defend against that configuration.slhc_uncompress() dereferences comp->rstate[x] when the VJ headercarries an explicit connection ID, and slhc_remember() later assignscs = &comp->rstate[...] after only comparing the packet's slot numberto comp->rslot_limit. Because rslot_limit is 0, slot 0 passes therange check, and the code dereferences a NULL rstate.The configuration is reachable in-tree through PPP. PPPIOCSMAXCIDstores its argument in a signed int, and (val >> 16) uses arithmeticshift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because/dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole pathis reachable from an unprivileged user namespace. Once the malformedVJ state is installed, any inbound VJ-compressed or VJ-uncompressedframe that selects slot 0 crashes the kernel in softirq context: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519) Call Trace: <TASK> ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466) ppp_input (drivers/net/ppp/ppp_generic.c:2359) ppp_async_process (drivers/net/ppp/ppp_async.c:492) tasklet_action_common (kernel/softirq.c:926) handle_softirqs (kernel/softirq.c:623) run_ksoftirqd (kernel/softirq.c:1055) smpboot_thread_fn (kernel/smpboot.c:160) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) </TASK>Reject the receive side on such instances instead of touching rstate.slhc_uncompress() falls through to its existing 'bad' label, whichbumps sls_i_error and enters the toss state. slhc_remember() mirrorsthat with an explicit sls_i_error increment followed by slhc_toss();the sls_i_runt counter is not used here because a missing rstate isan internal configuration state, not a runt packet.The transmit path is unaffected: the only in-tree caller that picksrslots from userspace (ppp_generic.c) still supplies tslots >= 1, andslip.c always calls slhc_init(16, 16), so comp->tstate remains validand slhc_compress() continues to work. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45843.md b/2026/CVE-2026-45843.md new file mode 100644 index 0000000000..516e6e5aed --- /dev/null +++ b/2026/CVE-2026-45843.md @@ -0,0 +1,20 @@ +### [CVE-2026-45843](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45843) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:slip: bound decode() reads against the compressed packet lengthslhc_uncompress() parses a VJ-compressed TCP header by advancing apointer through the packet via decode() and pull16(). Neither helperbounds-checks against isize, and decode() masks its return with& 0xffff so it can never return the -1 that callers test for -- thoseerror paths are dead code.A short compressed frame whose change byte requests optional fieldslets decode() read past the end of the packet. The over-read bytesare folded into the cached cstate and reflected into subsequentreconstructed packets.Make decode() and pull16() take the packet end pointer and return -1when exhausted. Add a bounds check before the TCP-checksum read.The existing == -1 tests now do what they were always meant to. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45844.md b/2026/CVE-2026-45844.md new file mode 100644 index 0000000000..cb7ec06f01 --- /dev/null +++ b/2026/CVE-2026-45844.md @@ -0,0 +1,20 @@ +### [CVE-2026-45844](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45844) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6752c8db8e0cfedb44ba62806dd15b383ed64000%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:netfilter: arp_tables: fix IEEE1394 ARP payload parsingWeiming Shi says:"arp_packet_match() unconditionally parses the ARP payload assuming twohardware addresses are present (source and target). However,IPv4-over-IEEE1394 ARP (RFC 2734) omits the target hardware addressfield, and arp_hdr_len() already accounts for this by returning ashorter length for ARPHRD_IEEE1394 devices.As a result, on IEEE1394 interfaces arp_packet_match() advances past anonexistent target hardware address and reads the wrong bytes for boththe target device address comparison and the target IP address. Thiscauses arptables rules to match against garbage data, leading toincorrect filtering decisions: packets that should be accepted may bedropped and vice versa.The ARP stack in net/ipv4/arp.c (arp_create and arp_process) alreadyhandles this correctly by skipping the target hardware address forARPHRD_IEEE1394. Apply the same pattern to arp_packet_match()."Mangle the original patch to always return 0 (no match) in case usermatches on the target hardware address which is never present inIEEE1394.Note that this returns 0 (no match) for either normal and inverse matchbecause matching in the target hardware address in ARPHRD_IEEE1394 hasnever been supported by arptables. This is intentional, matching on thetarget hardware address should never evaluate true for ARPHRD_IEEE1394.Moreover, adjust arpt_mangle to drop the packet too as AI suggests:In arpt_mangle, the logic assumes a standard ARP layout. BecauseIEEE1394 (FireWire) omits the target hardware address, the linearpointer arithmetic miscalculates the offset for the target IP address.This causes mangling operations to write to the wrong location, leadingto packet corruption. To ensure safety, this patch drops packets(NF_DROP) when mangling is requested for these fields on IEEE1394devices, as the current implementation cannot correctly map the FireWireARP payload.This omits both mangling target hardware and IP address. Even if IPaddress mangling should be possible in IEEE1394, this would requireto adjust arpt_mangle offset calculation, which has never beensupported.Based on patch from Weiming Shi <bestswngs@gmail.com>. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45850.md b/2026/CVE-2026-45850.md new file mode 100644 index 0000000000..24a5d83b86 --- /dev/null +++ b/2026/CVE-2026-45850.md @@ -0,0 +1,20 @@ +### [CVE-2026-45850](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45850) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0bbdd42b7efa66685b6d74701bcde3a596a3a59d%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.28%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ipvs: skip ipv6 extension headers for csum checksProtocol checksum validation fails for IPv6 if there are extensionheaders before the protocol header. iph->len already contains itsoffset, so use it to fix the problem. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45991.md b/2026/CVE-2026-45991.md new file mode 100644 index 0000000000..1d57c94439 --- /dev/null +++ b/2026/CVE-2026-45991.md @@ -0,0 +1,22 @@ +### [CVE-2026-45991](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.18.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7f401f160a9c7a1ff84ba3cb9b2f636d1f5cfb6b%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ee4af50ca94f58afc3532662779b9cf80bbe27c8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:udf: fix partition descriptor append bookkeepingMounting a crafted UDF image with repeated partition descriptors cantrigger a heap out-of-bounds write in part_descs_loc[].handle_partition_descriptor() deduplicates entries by partition number,but appended slots never record partnum. As a result duplicatePartition Descriptors are appended repeatedly and num_part_descs keepsgrowing.Once the table is full, the growth path still sizes the allocation frompartnum even though inserts are indexed by num_part_descs. If partnum isalready aligned to PART_DESC_ALLOC_STEP, ALIGN(partnum, step) can keepthe old capacity and the next append writes past the end of the table.Store partnum in the appended slot and size growth from the next appendcount so deduplication and capacity tracking follow the same model. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-45997.md b/2026/CVE-2026-45997.md new file mode 100644 index 0000000000..dadb332ddf --- /dev/null +++ b/2026/CVE-2026-45997.md @@ -0,0 +1,34 @@ +### [CVE-2026-45997](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45997) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=265dfe8ebbabae7959060bd1c3f75c2473b697ed%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=350d048cc506368a316f0bc4082426b24a2a9fc0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.14.250%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19.210%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4.288%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.9.286%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4e8e6427319de323f613caa8fd37120df83138d0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.72%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.14.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.152%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=60df9f55562a57173a11b6c7011eee40dfa48157%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a3e5a9208466b63f27a2509a691023b446ea5105%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d56459d361a9a99bead8b594635353053271356c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e95f62013a1159eeea752bb52df0683ee77f70ca%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=eadb60bcc2005247d97dcb3becee57aba4024ff4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:scsi: sd: fix missing put_disk() when device_add(&disk_dev) failsIf device_add(&sdkp->disk_dev) fails, put_device() runsscsi_disk_release(), which frees the scsi_disk but leaves the gendiskreferenced. The device_add_disk() error path in sd_probe() callsput_disk(gd); call put_disk(gd) here to mirror that cleanup. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46003.md b/2026/CVE-2026-46003.md new file mode 100644 index 0000000000..546b024aa0 --- /dev/null +++ b/2026/CVE-2026-46003.md @@ -0,0 +1,20 @@ +### [CVE-2026-46003](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46003) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0c2204a4ad710d95d348ea006f14ba926e842ffd%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: qrtr: ns: Limit the total number of nodesCurrently, the nameserver doesn't limit the number of nodes it handles.This can be an attack vector if a malicious client starts registeringrandom nodes, leading to memory exhaustion.Hence, limit the maximum number of nodes to 64. Note that, limit of 64 ischosen based on the current platform requirements. If requirement changesin the future, this limit can be increased. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46015.md b/2026/CVE-2026-46015.md index 515ec61f2e..2043c5e94a 100644 --- a/2026/CVE-2026-46015.md +++ b/2026/CVE-2026-46015.md @@ -1,9 +1,11 @@ ### [CVE-2026-46015](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46015) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=54b92e84193749c9968aff2dd46e3b0f42643e18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:tcp: call sk_ #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46018.md b/2026/CVE-2026-46018.md new file mode 100644 index 0000000000..65f62db990 --- /dev/null +++ b/2026/CVE-2026-46018.md @@ -0,0 +1,24 @@ +### [CVE-2026-46018](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46018) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.0.81%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=44f059fb742aac78cffdab5e0d8fe0c9910c1ded%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4fa0e81b83503900be277e6273a79651b375e288%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c25a53781f61c78bf2a2fa308bbd35b42ba346f6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATESparse_uac2_sample_rate_range() caps the number of enumeratedrates at MAX_NR_RATES, but it only breaks out of the currentrate loop. A malformed UAC2 RANGE response with additionaltriplets continues parsing the remaining triplets and repeatedlyprints "invalid uac2 rates" while probe still holdsregister_mutex.Stop the whole parse once the cap is reached and return thenumber of rates collected so far. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46021.md b/2026/CVE-2026-46021.md index 425dc06d5a..5663c7e2b0 100644 --- a/2026/CVE-2026-46021.md +++ b/2026/CVE-2026-46021.md @@ -1,8 +1,10 @@ ### [CVE-2026-46021](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46021) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e33df1d2f3a0141cd79e770f31999ba0dd7ebfa8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:thermal: core #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46022.md b/2026/CVE-2026-46022.md new file mode 100644 index 0000000000..93f3c50822 --- /dev/null +++ b/2026/CVE-2026-46022.md @@ -0,0 +1,20 @@ +### [CVE-2026-46022](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46022) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=278d72ae8803ffcd16070c95fe1d53f4466dc741%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()ibmasm_handle_mouse_interrupt() performs an out-of-bounds MMIO readwhen the queue reader or writer index from hardware exceedsREMOTE_QUEUE_SIZE (60).A compromised service processor can trigger this by writing anout-of-range value to the reader or writer MMIO register beforeasserting an interrupt. Since writer is re-read from hardware onevery loop iteration, it can also be set to an out-of-range valueafter the loop has already started.The root cause is that get_queue_reader() and get_queue_writer() returnraw readl() values that are passed directly into get_queue_entry(),which computes: queue_begin + reader * sizeof(struct remote_input)with no bounds check. This unchecked MMIO address is then passed tomemcpy_fromio(), reading 8 bytes from unintended device registers.For sufficiently large values the address falls outside the PCI BARmapping entirely, triggering a machine check exception.Fix by checking both indices against REMOTE_QUEUE_SIZE at the top ofthe loop body, before any call to get_queue_entry(). On an out-of-rangevalue, reset the reader register to 0 via set_queue_reader() beforebreaking, so that normal queue operation can resume if the corruptedhardware state is transient. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46023.md b/2026/CVE-2026-46023.md new file mode 100644 index 0000000000..6fd79b1771 --- /dev/null +++ b/2026/CVE-2026-46023.md @@ -0,0 +1,20 @@ +### [CVE-2026-46023](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46023) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:dm mirror: fix integer overflow in create_dirty_log()The argument count calculation in create_dirty_log() performs`*args_used = 2 + param_count` before validating against argc. When auser provides a param_count close to UINT_MAX via the device mappertable string, this unsigned addition wraps around to a small value,causing the subsequent `argc < *args_used` check to be bypassed.The overflowed param_count is then passed as argc to dm_dirty_log_create(),where it can cause out-of-bounds reads on the argv array.Fix by comparing param_count against argc - 2 before performing theaddition, following the same pattern used by parse_features() in thesame file. Since argc >= 2 is already guaranteed, the subtraction issafe. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46026.md b/2026/CVE-2026-46026.md new file mode 100644 index 0000000000..85d0c7b5df --- /dev/null +++ b/2026/CVE-2026-46026.md @@ -0,0 +1,20 @@ +### [CVE-2026-46026](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46026) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0c2204a4ad710d95d348ea006f14ba926e842ffd%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: qrtr: ns: Limit the maximum number of lookupsCurrent code does no bound checking on the number of lookups a client canperform. Though the code restricts the lookups to local clients, there isstill a possibility of a malicious local client sending a flood ofNEW_LOOKUP messages over the same socket.Fix this issue by limiting the maximum number of lookups to 64 globally.Since the nameserver allows only atmost one local observer, this globallookup count will ensure that the lookups stay within the limit.Note that, limit of 64 is chosen based on the current platformrequirements. If requirement changes in the future, this limit can beincreased. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46033.md b/2026/CVE-2026-46033.md index 3705c95b96..1220136b3f 100644 --- a/2026/CVE-2026-46033.md +++ b/2026/CVE-2026-46033.md @@ -1,8 +1,10 @@ ### [CVE-2026-46033](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46033) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f15f05b0a5de667c821a9727c33bce9d1d9b26dd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: authe #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46037.md b/2026/CVE-2026-46037.md index 0294febe68..6d1a778352 100644 --- a/2026/CVE-2026-46037.md +++ b/2026/CVE-2026-46037.md @@ -1,8 +1,10 @@ ### [CVE-2026-46037](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46037) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d329ea5bd8845f0b196bf41b18b6173340d6e0e4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:ipv4: icmp: v #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46038.md b/2026/CVE-2026-46038.md new file mode 100644 index 0000000000..e93a1d6655 --- /dev/null +++ b/2026/CVE-2026-46038.md @@ -0,0 +1,20 @@ +### [CVE-2026-46038](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46038) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0c2204a4ad710d95d348ea006f14ba926e842ffd%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: qrtr: ns: Free the node during ctrl_cmd_bye()A node sends the BYE packet when it is about to go down. So the nameservershould advertise the removal of the node to all remote and local observersand free the node finally. But currently, the nameserver doesn't free thenode memory even after processing the BYE packet. This causes the nodememory to leak.Hence, remove the node from Xarray list and free the node memory duringboth success and failure case of ctrl_cmd_bye(). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46040.md b/2026/CVE-2026-46040.md index a8e5a6528a..e17c5793e3 100644 --- a/2026/CVE-2026-46040.md +++ b/2026/CVE-2026-46040.md @@ -1,9 +1,11 @@ ### [CVE-2026-46040](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46040) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1cce1eea0aff51201753fcaca421df825b0813b6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:inotify: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46044.md b/2026/CVE-2026-46044.md new file mode 100644 index 0000000000..70a0c5d4e4 --- /dev/null +++ b/2026/CVE-2026-46044.md @@ -0,0 +1,20 @@ +### [CVE-2026-46044](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46044) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=259307074bfcf1ff88016e12c68f057aee6cb694%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ipmi:ssif: Clean up kthread on errorsIf an error occurs after the ssif kthread is created, but before themain IPMI code starts the ssif interface, the ssif kthread will notbe stopped.So make sure the kthread is stopped on an error condition if it isrunning. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46046.md b/2026/CVE-2026-46046.md index cc37ec50b0..2e9dd2e503 100644 --- a/2026/CVE-2026-46046.md +++ b/2026/CVE-2026-46046.md @@ -1,6 +1,7 @@ ### [CVE-2026-46046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46046) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=362a90cecd36e8a5c415966d0b75b04a0270e4dd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3bc6317033f365ce578eb6039445fb66162722fd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.10.237%20&color=brightgreen) @@ -16,6 +17,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=76c365fa7e2a8bb85f0190cdb4b8cdc99b2fdce3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=836e625b03a666cf93ff5be328c8cb30336db872%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c8e008b60492cf6fd31ef127aea6d02fd3d314cd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cf9291a3449b04688b81e32621e88de8f4314b54%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=eb59cc31b6ea076021d14b04e7faab1636b87d0e%20&color=brightgreen) @@ -30,6 +32,8 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: fix mis #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46047.md b/2026/CVE-2026-46047.md new file mode 100644 index 0000000000..451b41bd9f --- /dev/null +++ b/2026/CVE-2026-46047.md @@ -0,0 +1,20 @@ +### [CVE-2026-46047](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46047) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0c2204a4ad710d95d348ea006f14ba926e842ffd%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: qrtr: ns: Fix use-after-free in driver remove()In the remove callback, if a packet arrives after destroy_workqueue() iscalled, but before sock_release(), the qrtr_ns_data_ready() callback willtry to queue the work, causing use-after-free issue.Fix this issue by saving the default 'sk_data_ready' callback duringqrtr_ns_init() and use it to replace the qrtr_ns_data_ready() callback atthe start of remove(). This ensures that even if a packet arrives afterdestroy_workqueue(), the work struct will not be dereferenced.Note that it is also required to ensure that the RX threads are completedbefore destroying the workqueue, because the threads could be using theqrtr_ns_data_ready() callback. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46050.md b/2026/CVE-2026-46050.md new file mode 100644 index 0000000000..8e7900e71b --- /dev/null +++ b/2026/CVE-2026-46050.md @@ -0,0 +1,30 @@ +### [CVE-2026-46050](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46050) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10c6021a609deb95f23f0cc2f89aa9d4bffb14c7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2941155d9a5ae098b480d551f3a5f8605d4f9af5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.189%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.146%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.12.39%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.15.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.6.99%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8fc3d7b23d139e3cbc944c15d99b3cdbed797d2d%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9af149ca9d0dab6e59e813519d309eff62499864%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ed7bcd9f617e4107ac0813c516e72e6b8f6029bd%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:md/raid10: fix deadlock with check operation and nowait requestsWhen an array check is running it will raise the barrier at which pointnormal requests will become blocked and increment the nr_pending value tosignal there is work pending inside of wait_barrier(). NOWAIT requestsdo not block and so will return immediately with an error, and additionallydo not increment nr_pending in wait_barrier(). Upstream change commit43806c3d5b9b ("raid10: cleanup memleak at raid10_make_request") added acall to raid_end_bio_io() to fix a memory leak when NOWAIT requests hitthis condition. raid_end_bio_io() eventually calls allow_barrier() andit will unconditionally do an atomic_dec_and_test(&conf->nr_pending) eventhough the corresponding increment on nr_pending didn't happen in theNOWAIT case.This can be easily seen by starting a check operation while an applicationis doing nowait IO on the same array. This results in a deadlocked statedue to nr_pending value underflowing and so the md resync thread gets stuckwaiting for nr_pending to == 0.Output of r10conf state of the array when we hit this condition:crash> struct r10conf barrier = 1, nr_pending = { counter = -41 }, nr_waiting = 15, nr_queued = 0,Example of md_sync thread stuck waiting on raise_barrier() and otherrequests stuck in wait_barrier():md1_resync[<0>] raise_barrier+0xce/0x1c0[<0>] raid10_sync_request+0x1ca/0x1ed0[<0>] md_do_sync+0x779/0x1110[<0>] md_thread+0x90/0x160[<0>] kthread+0xbe/0xf0[<0>] ret_from_fork+0x34/0x50[<0>] ret_from_fork_asm+0x1a/0x30kworker/u1040:2+flush-253:4[<0>] wait_barrier+0x1de/0x220[<0>] regular_request_wait+0x30/0x180[<0>] raid10_make_request+0x261/0x1000[<0>] md_handle_request+0x13b/0x230[<0>] __submit_bio+0x107/0x1f0[<0>] submit_bio_noacct_nocheck+0x16f/0x390[<0>] ext4_io_submit+0x24/0x40[<0>] ext4_do_writepages+0x254/0xc80[<0>] ext4_writepages+0x84/0x120[<0>] do_writepages+0x7a/0x260[<0>] __writeback_single_inode+0x3d/0x300[<0>] writeback_sb_inodes+0x1dd/0x470[<0>] __writeback_inodes_wb+0x4c/0xe0[<0>] wb_writeback+0x18b/0x2d0[<0>] wb_workfn+0x2a1/0x400[<0>] process_one_work+0x149/0x330[<0>] worker_thread+0x2d2/0x410[<0>] kthread+0xbe/0xf0[<0>] ret_from_fork+0x34/0x50[<0>] ret_from_fork_asm+0x1a/0x30 + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46051.md b/2026/CVE-2026-46051.md new file mode 100644 index 0000000000..0ebd90bf79 --- /dev/null +++ b/2026/CVE-2026-46051.md @@ -0,0 +1,20 @@ +### [CVE-2026-46051](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46051) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:md/raid5: fix soft lockup in retry_aligned_read()When retry_aligned_read() encounters an overlapped stripe, it releasesthe stripe via raid5_release_stripe() which puts it on the locklessreleased_stripes llist. In the next raid5d loop iteration,release_stripe_list() drains the stripe onto handle_list (sinceSTRIPE_HANDLE is set by the original IO), but retry_aligned_read()runs before handle_active_stripes() and removes the stripe fromhandle_list via find_get_stripe() -> list_del_init(). This preventshandle_stripe() from ever processing the stripe to resolve theoverlap, causing an infinite loop and soft lockup.Fix this by using __release_stripe() with temp_inactive_list insteadof raid5_release_stripe() in the failure path, so the stripe does notgo through the released_stripes llist. This allows raid5d to break outof its loop, and the overlap will be resolved when the stripe iseventually processed by handle_stripe(). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46056.md b/2026/CVE-2026-46056.md new file mode 100644 index 0000000000..349956f67a --- /dev/null +++ b/2026/CVE-2026-46056.md @@ -0,0 +1,20 @@ +### [CVE-2026-46056](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46056) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=92a25256f142d55e25f9959441cea6ddeabae57e%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: hci_event: fix potential UAF in SSP passkey handlershci_conn lookup and field access must be covered by hdev lock inhci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwisethe connection can be freed concurrently.Extend the hci_dev_lock critical section to cover all conn usage in bothhandlers.Keep the existing keypress notification behavior unchanged by routingthe early exits through a common unlock path. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46064.md b/2026/CVE-2026-46064.md new file mode 100644 index 0000000000..7a83abe8c3 --- /dev/null +++ b/2026/CVE-2026-46064.md @@ -0,0 +1,20 @@ +### [CVE-2026-46064](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46064) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ibmasm: fix heap over-read in ibmasm_send_i2o_message()The ibmasm_send_i2o_message() function uses get_dot_command_size() tocompute the byte count for memcpy_toio(), but this value is derived fromuser-controlled fields in the dot_command_header (command_size: u8,data_size: u16) and is never validated against the actual allocation size.A root user can write a small buffer with inflated header fields, causingmemcpy_toio() to read up to ~65 KB past the end of the allocation intoadjacent kernel heap, which is then forwarded to the service processorover MMIO.Silently clamping the copy size is not sufficient: if the header fieldsclaim a larger size than the buffer, the SP receives a dot command whoseown header is inconsistent with the I2O message length, which can causethe SP to desynchronize. Reject such commands outright by returningfailure.Validate command_size before calling get_mfa_inbound() to avoid leakingan I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardwareframe from the controller's free pool, and returning without acorresponding set_mfa_inbound() call would permanently exhaust it.Additionally, clamp command_size to I2O_COMMAND_SIZE before thememcpy_toio() so the MMIO write stays within the I2O message frame,consistent with the clamping already performed by outgoing_message_size()for the header field. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46065.md b/2026/CVE-2026-46065.md new file mode 100644 index 0000000000..dad647c931 --- /dev/null +++ b/2026/CVE-2026-46065.md @@ -0,0 +1,20 @@ +### [CVE-2026-46065](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46065) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.22%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=60b59beafba875aef6d378078bce0baf2287ae14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_infoHold state of deferred I/O in struct fb_deferred_io_state. Allocate aninstance as part of initializing deferred I/O and remove it only afterthe final mapping has been closed. If the fb_info and the containeddeferred I/O meanwhile goes away, clear struct fb_deferred_io_state.infoto invalidate the mapping. Any access will then result in a SIGBUSsignal.Fixes a long-standing problem, where a device hot-unplug happens whileuser space still has an active mapping of the graphics memory. The hot-unplug frees the instance of struct fb_info. Accessing the memory willoperate on undefined state. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46069.md b/2026/CVE-2026-46069.md new file mode 100644 index 0000000000..c29cff960b --- /dev/null +++ b/2026/CVE-2026-46069.md @@ -0,0 +1,20 @@ +### [CVE-2026-46069](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46069) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4636187da60b6e33526050235c610409d9cc00e8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()The mwifiex_adapter_cleanup() function uses timer_delete()(non-synchronous) for the wakeup_timer before the adapter structure isfreed. This is incorrect because timer_delete() does not wait for anyrunning timer callback to complete.If the wakeup_timer callback (wakeup_timer_fn) is executing whenmwifiex_adapter_cleanup() is called, the callback will continue toaccess adapter fields (adapter->hw_status, adapter->if_ops.card_reset,etc.) which may be freed by mwifiex_free_adapter() called later in themwifiex_remove_card() path.Use timer_delete_sync() instead to ensure any running timer callback hascompleted before returning. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46070.md b/2026/CVE-2026-46070.md new file mode 100644 index 0000000000..991614ef52 --- /dev/null +++ b/2026/CVE-2026-46070.md @@ -0,0 +1,20 @@ +### [CVE-2026-46070](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46070) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=b4c625c67362b3940f619c1a836b4e8329106658%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:md/raid5: validate payload size before accessing journal metadatar5c_recovery_analyze_meta_block() andr5l_recovery_verify_data_checksum_for_mb() iterate over payloads in ajournal metadata block using on-disk payload size fields withoutvalidating them against the remaining space in the metadata block.A corrupted journal contains payload sizes extending beyond the PAGE_SIZEboundary can cause out-of-bounds reads when accessing payload fields orcomputing offsets.Add bounds validation for each payload type to ensure the full payloadfits within meta_size before processing. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46083.md b/2026/CVE-2026-46083.md new file mode 100644 index 0000000000..3fd07e9274 --- /dev/null +++ b/2026/CVE-2026-46083.md @@ -0,0 +1,26 @@ +### [CVE-2026-46083](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46083) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3e7c190475d98099231ee8ae486d31b1e2e7535a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4b8b7bc3a726268e5c15d9bafe27863a85fdfc8e%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.44%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.12.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.126%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c7299fea67696db5bd09d924d1f1080d894f92ef%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e92ac9263b06c39f05526ad15c90d228cdab60fd%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:spi: fix resource leaks on device setup failureMake sure to call controller cleanup() if spi_setup() fails whileregistering a device to avoid leaking any resources allocated bysetup(). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46086.md b/2026/CVE-2026-46086.md index 63e8e37c94..bdaf5c8a33 100644 --- a/2026/CVE-2026-46086.md +++ b/2026/CVE-2026-46086.md @@ -1,9 +1,11 @@ ### [CVE-2026-46086](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46086) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=960b589f86c74ce582922fcb996103271081f4de%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: bridge: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46088.md b/2026/CVE-2026-46088.md new file mode 100644 index 0000000000..47109b5c42 --- /dev/null +++ b/2026/CVE-2026-46088.md @@ -0,0 +1,20 @@ +### [CVE-2026-46088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46088) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()snd_ctl_elem_init_enum_names() advances pointer p through the namesbuffer while decrementing buf_len. If buf_len reaches zero but itemsremain, the next iteration calls strnlen(p, 0).While strnlen(p, 0) returns 0 and would hit the existing name_len == 0error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checksmaxlen against __builtin_dynamic_object_size(). When Clang loses trackof p's object size inside the loop, this triggers a BRK exception panicbefore the return value is examined.Add a buf_len == 0 guard at the loop entry to prevent calling fortifiedstrnlen() on an exhausted buffer.Found by kernel fuzz testing through Xiaomi Smartphone. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46092.md b/2026/CVE-2026-46092.md new file mode 100644 index 0000000000..207d77fa58 --- /dev/null +++ b/2026/CVE-2026-46092.md @@ -0,0 +1,24 @@ +### [CVE-2026-46092](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46092) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=24f5e38a13b5ae2b6105cda8bb47c19108e62a9a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.16.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=617339466fda09916c4b4151fa5e6a9c1fdae353%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f21e8cb927fa9da49490b74ddda3856a828b82d6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: rtw88: check for PCI upstream bridge existencepci_upstream_bridge() returns NULL if the device is on a root bus. If8821CE is installed in the system with such a PCI topology, the probingroutine will crash. This has probably been unnoticed as 8821CE is mostlysupplied in laptops where there is a PCI-to-PCI bridge located upstreamfrom the device. However the card might be installed on a system withdifferent configuration.Check if the bridge does exist for the specific workaround to be applied.Found by Linux Verification Center (linuxtesting.org) with Svace staticanalysis tool. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46099.md b/2026/CVE-2026-46099.md new file mode 100644 index 0000000000..b23b0aa6f9 --- /dev/null +++ b/2026/CVE-2026-46099.md @@ -0,0 +1,20 @@ +### [CVE-2026-46099](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46099) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=af4a2209b1344939eaac11f269c261d347cbc3ee%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnelsseg6_input_core() and rpl_input() call ip6_route_input() which sets aNOREF dst on the skb, then pass it to dst_cache_set_ip6() invokingdst_hold() unconditionally.On PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task canrelease the underlying pcpu_rt between the lookup and the cachingthrough a concurrent FIB lookup on a shared nexthop.Simplified race sequence: ksoftirqd/X higher-prio task (same CPU X) ----------- -------------------------------- seg6_input_core(,skb)/rpl_input(skb) dst_cache_get() -> miss ip6_route_input(skb) -> ip6_pol_route(,skb,flags) [RT6_LOOKUP_F_DST_NOREF in flags] -> FIB lookup resolves fib6_nh [nhid=N route] -> rt6_make_pcpu_route() [creates pcpu_rt, refcount=1] pcpu_rt->sernum = fib6_sernum [fib6_sernum=W] -> cmpxchg(fib6_nh.rt6i_pcpu, NULL, pcpu_rt) [slot was empty, store succeeds] -> skb_dst_set_noref(skb, dst) [dst is pcpu_rt, refcount still 1] rt_genid_bump_ipv6() -> bumps fib6_sernum [fib6_sernum from W to Z] ip6_route_output() -> ip6_pol_route() -> FIB lookup resolves fib6_nh [nhid=N] -> rt6_get_pcpu_route() pcpu_rt->sernum != fib6_sernum [W <> Z, stale] -> prev = xchg(rt6i_pcpu, NULL) -> dst_release(prev) [prev is pcpu_rt, refcount 1->0, dead] dst = skb_dst(skb) [dst is the dead pcpu_rt] dst_cache_set_ip6(dst) -> dst_hold() on dead dst -> WARN / use-after-freeFor the race to occur, ksoftirqd must be preemptible (PREEMPT_RT withoutPREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to releasethe pcpu_rt. Shared nexthop objects provide such a path, as two routespointing to the same nhid share the same fib6_nh and its rt6i_pcpuentry.Fix seg6_input_core() and rpl_input() by calling skb_dst_force() afterip6_route_input() to force the NOREF dst into a refcounted one beforecaching.The output path is not affected as ip6_route_output() already returns arefcounted dst. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46101.md b/2026/CVE-2026-46101.md index 9a98b21ef4..f2f275c2ef 100644 --- a/2026/CVE-2026-46101.md +++ b/2026/CVE-2026-46101.md @@ -1,9 +1,11 @@ ### [CVE-2026-46101](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46101) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=567d746b55bc66d3800c9ae91d50f0c5deb2fd93%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: re #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46102.md b/2026/CVE-2026-46102.md new file mode 100644 index 0000000000..57dc5fb5d5 --- /dev/null +++ b/2026/CVE-2026-46102.md @@ -0,0 +1,20 @@ +### [CVE-2026-46102](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46102) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: strparser: fix skb_head leak in strp_abort_strp()When the stream parser is aborted, for example after a message assembly timeout,it can still hold a reference to a partially assembled message instrp->skb_head.That skb is not released in strp_abort_strp(), which leaks the partiallyassembled message and can be triggered repeatedly to exhaust memory.Fix this by freeing strp->skb_head and resetting the parser state in theabort path. Leave strp_stop() unchanged so final cleanup still happens instrp_done() after the work and timer have been synchronized. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46107.md b/2026/CVE-2026-46107.md new file mode 100644 index 0000000000..c0f837c9c0 --- /dev/null +++ b/2026/CVE-2026-46107.md @@ -0,0 +1,20 @@ +### [CVE-2026-46107](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46107) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3241b1d3e0aaafbfcd320f4d71ade629728cc4f4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:dm-thin: fix metadata refcount underflowThere's a bug in dm-thin in the function rebalance_children. If theinternal btree node has one entry, the code tries to copy all btreeentries from the node's child to the node itself and then decrement thechild's reference count.If the child node is shared (it has reference count > 1), we won't freeit, so there would be two pointers to each of the grandchildren nodes.But the reference counts of the grandchildren is not increased, thus thereference count doesn't match the number of pointers that point to thegrandchildren. This results in "device mapper: space map common: unableto decrement block" errors.Fix this bug by incrementing reference counts on the grandchildren if thebtree node is shared. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46110.md b/2026/CVE-2026-46110.md new file mode 100644 index 0000000000..6cad4e098a --- /dev/null +++ b/2026/CVE-2026-46110.md @@ -0,0 +1,26 @@ +### [CVE-2026-46110](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46110) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.64%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.5.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.6.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7414a28de1b3b028714859078c00a874f9feff52%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=779334e59850f863bf34665e0ff0b6faf126873b%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=b435b4573240b5530830a1a60e005c6fcfd928a0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=b6cb4541853c7ee512111b0e7ddf3cb66c99c137%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: stmmac: Prevent NULL deref when RX memory exhaustedThe CPU receives frames from the MAC through conventional DMA: the CPUallocates buffers for the MAC, then the MAC fills them and returnsownership to the CPU. For each hardware RX queue, the CPU and MACcoordinate through a shared ring array of DMA descriptors: onedescriptor per DMA buffer. Each descriptor includes the buffer'sphysical address and a status flag ("OWN") indicating which side ownsthe buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to setthe flag and the MAC is only allowed to clear it, and both must movethrough the ring in sequence: thus the ring is used for both"submissions" and "completions."In the stmmac driver, stmmac_rx() bookmarks its position in the ringwith the `cur_rx` index. The main receive loop in that function checksfor rx_descs[cur_rx].own=0, gives the corresponding buffer to thenetwork stack (NULLing the pointer), and increments `cur_rx` modulo thering size. After the loop exits, stmmac_rx_refill(), which bookmarks itsposition with `dirty_rx`, allocates fresh buffers and rearms thedescriptors (setting OWN=1). If it fails any allocation, it simply stopsearly (leaving OWN=0) and will retry where it left off when next called.This means descriptors have a three-stage lifecycle (terms my own):- `empty` (OWN=1, buffer valid)- `full` (OWN=0, buffer valid and populated)- `dirty` (OWN=0, buffer NULL)But because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. Inthe past (see 'Fixes:'), there was a bug where the loop could cycle`cur_rx` all the way back to the first descriptor it dirtied, resultingin a NULL dereference when mistaken for `full`. The aforementionedcommit resolved that *specific* failure by capping the loop's iterationlimit at `dma_rx_size - 1`, but this is only a partial fix: if theprevious stmmac_rx_refill() didn't complete, then there are leftover`dirty` descriptors that the loop might encounter without needing tocycle fully around. The current code therefore panics (see 'Closes:')when stmmac_rx_refill() is memory-starved long enough for `cur_rx` tocatch up to `dirty_rx`.Fix this by explicitly checking, before advancing `cur_rx`, if the nextentry is dirty; exit the loop if so. This prevents processing of thefinal, used descriptor until stmmac_rx_refill() succeeds, butfully prevents the `cur_rx == dirty_rx` ambiguity as the previous bugfixintended: so remove the clamp as well. Since stmmac_rx_zc() is acopy-paste-and-tweak of stmmac_rx() and the code structure is identical,any fix to stmmac_rx() will also need a corresponding fix forstmmac_rx_zc(). Therefore, apply the same check there.In stmmac_rx() (not stmmac_rx_zc()), a related bug remains: after theMAC sets OWN=0 on the final descriptor, it will be unable to send anyfurther DMA-complete IRQs until it's given more `empty` descriptors.Currently, the driver simply *hopes* that the next stmmac_rx_refill()succeeds, risking an indefinite stall of the receive process if not. Butthis is not a regression, so it can be addressed in a future change. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46113.md b/2026/CVE-2026-46113.md new file mode 100644 index 0000000000..86d199ac06 --- /dev/null +++ b/2026/CVE-2026-46113.md @@ -0,0 +1,20 @@ +### [CVE-2026-46113](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46113) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:KVM: x86: Fix shadow paging use-after-free due to unexpected GFNThe shadow MMU computes GFNs for direct shadow pages using sp->gfn plusthe SPTE index. This assumption breaks for shadow paging if the guestpage tables are modified between VM entries (similar to commitaad885e77496, "KVM: x86/mmu: Drop/zap existing present SPTE evenwhen creating an MMIO SPTE", 2026-03-27). The flow is as follows:- a PDE is installed for a 2MB mapping, and a page in that area is accessed. KVM creates a kvm_mmu_page consisting of 512 4KB pages; the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because the guest's mapping is a huge page (and thus contiguous).- the PDE mapping is changed from outside the guest.- the guest accesses another page in the same 2MB area. KVM installs a new leaf SPTE and rmap entry; the SPTE uses the "correct" GFN (i.e. based on the new mapping, as changed in the previous step) but that GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore the rmap entry cannot be found and removed when the kvm_mmu_page is zapped.- the memslot that covers the first 2MB mapping is deleted, and the kvm_mmu_page for the now-invalid GPA is zapped. However, rmap_remove() only looks at the [sp->gfn, sp->gfn + 511] range established in step 1, and fails to find the rmap entry that was recorded by step 3.- any operation that causes an rmap walk for the same page accessed by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page. This includes dirty logging or MMU notifier invalidations (e.g., from MADV_DONTNEED).The underlying issue is that KVM's walking of shadow PTEs assumes thatif a SPTE is present when KVM wants to install a non-leaf SPTE, then theexisting kvm_mmu_page must be for the correct gfn. Because the only wayfor the gfn to be wrong is if KVM messed up and failed to zap a SPTE...which shouldn't happen, but *actually* only happens in response to aguest write.That bug dates back literally forever, as even the first version of KVMassumes that the GFN matches and walks into the "wrong" shadow page.However, that was only an imprecision until 2032a93d66fa ("KVM: MMU:Don't allocate gfns page for direct mmu pages") came along.Fix it by checking for a target gfn mismatch and zapping the existingSPTE. That way the old SP and rmap entries are gone, KVM installsthe rmap in the right location, and everyone is happy. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46116.md b/2026/CVE-2026-46116.md index 83a849843c..9ca74c362c 100644 --- a/2026/CVE-2026-46116.md +++ b/2026/CVE-2026-46116.md @@ -1,9 +1,11 @@ ### [CVE-2026-46116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46116) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.19%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7b4dc3600e4877178ba94c7fbf7e520421378aa6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:xfrm: defensi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46120.md b/2026/CVE-2026-46120.md new file mode 100644 index 0000000000..351554b8fd --- /dev/null +++ b/2026/CVE-2026-46120.md @@ -0,0 +1,22 @@ +### [CVE-2026-46120](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2d665034f239412927b1e71329f20f001c92da09%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.16.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c6d72628352c949629af619b77b042e0fb5245e7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ip6_gre: Use cached t->net in ip6erspan_changelink().After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() ofrtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netnsip6gre hash via link_net. ip6erspan_changelink() was not converted inthat series and still uses dev_net(dev), which diverges from thedevice's creation netns after IFLA_NET_NS_FD migration.This re-inserts the tunnel into the wrong per-netns hash. Theoriginal netns keeps a stale entry. When that netns is laterdestroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing aslab-use-after-free reported by KASAN, followed by a kernel BUG atnet/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify().Reachable from an unprivileged user namespace (unshare --user--map-root-user --net).ip6gre_changelink() earlier in the same file already uses the cachedt->net; only ip6erspan_changelink() has the wrong shape. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46122.md b/2026/CVE-2026-46122.md new file mode 100644 index 0000000000..d950aa482f --- /dev/null +++ b/2026/CVE-2026-46122.md @@ -0,0 +1,20 @@ +### [CVE-2026-46122](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46122) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.24%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e4d6b7951812d98417feb10784e400e253caf633%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: b43: enforce bounds check on firmware key index in b43_rx()The firmware-controlled key index in b43_rx() can exceed the dev->key[]array size (58 entries). The existing B43_WARN_ON is non-enforcing inproduction builds, allowing an out-of-bounds read.Make the B43_WARN_ON check enforcing by dropping the frame when thefirmware returns an invalid key index. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46124.md b/2026/CVE-2026-46124.md new file mode 100644 index 0000000000..0cab22cbc9 --- /dev/null +++ b/2026/CVE-2026-46124.md @@ -0,0 +1,34 @@ +### [CVE-2026-46124](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46124) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=007124c896e7d4614ac1f6bd4dedb975c35a2a8e%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0405d4b63d082861f4eaff9d39c78ee9dc34f845%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0fdafdaef796816a9ed0fd7ac812932d569d9beb%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.237%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.181%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.293%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=56dfffea9fd3be0b3795a9ca6401e133a8427e0b%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5e7de55602c61c8ff28db075cc49c8dd6989d7e0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.135%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.12.25%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.14.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.6.88%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=63d5a3e207bf315a32c7d16de6c89753a759f95a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=952e7a7e317f126d0a2b879fc531b716932d5ffa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ee01a309ebf598be1ff8174901ed6e91619f1749%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:isofs: validate block number from NFS file handle in isofs_export_igetisofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker-controlled block number (ifid->block or ifid->parent_block) fromthe NFS file handle to isofs_export_iget(), which only rejectsblock == 0 before calling isofs_iget() and ultimately sb_bread().A crafted file handle with fh_len sufficient to pass the checkadded by commit 0405d4b63d08 ("isofs: Prevent the use of too smallfid") can still drive the server to read any in-range block on thebacking device as if it were an iso_directory_record. That earlierfix was assigned CVE-2025-37780.sb_bread() on an out-of-range block returns NULL cleanly via theEIO path, so there is no memory-safety violation. For in-rangereads of adjacent-partition data on the same block device, theunrelated bytes end up in iso_inode_info fields that reach the NFSclient as dentry metadata. The deployment surface (isofs exportedover NFS from loop-mounted images) is narrow and requires anauthenticated NFS peer, but the malformed-file-handle class isreportable as hardening next to the existing CVE-2025-37780 fix.Reject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() sothe check covers both isofs_fh_to_dentry() and isofs_fh_to_parent()call sites with a single line. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46125.md b/2026/CVE-2026-46125.md new file mode 100644 index 0000000000..012809f4f3 --- /dev/null +++ b/2026/CVE-2026-46125.md @@ -0,0 +1,20 @@ +### [CVE-2026-46125](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46125) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=81151ce462e533551f3284bfdb8e0f461c9220e6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: mac80211: remove station if connection prep failsIf connection preparation fails for MLO connections, then theinterface is completely reset to non-MLD. In this case, we mustnot keep the station since it's related to the link of the vifbeing removed. Delete an existing station. Any "new_sta" isalready being removed, so that doesn't need changes.This fixes a use-after-free/double-free in debugfs if that'senabled, because a vif going from MLD (and to MLD, but that'snot relevant here) recreates its entire debugfs. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46128.md b/2026/CVE-2026-46128.md new file mode 100644 index 0000000000..0a0a897302 --- /dev/null +++ b/2026/CVE-2026-46128.md @@ -0,0 +1,20 @@ +### [CVE-2026-46128](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46128) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ipmi: Check event message buffer response for bad dataThe event message buffer response data size got checked later whenprocessing, but check it right after the response comes back. Itappears some BMCs may return an empty message instead of an errorwhen fetching events.There are apparently some new BMCs that make this error, so we need tocompensate. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46132.md b/2026/CVE-2026-46132.md index 6eb80621c0..6d15e04f0a 100644 --- a/2026/CVE-2026-46132.md +++ b/2026/CVE-2026-46132.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=75345f888f700c4ab2448287e35d48c760b202e6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: rtnetlin #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46136.md b/2026/CVE-2026-46136.md new file mode 100644 index 0000000000..4e3ca2631e --- /dev/null +++ b/2026/CVE-2026-46136.md @@ -0,0 +1,26 @@ +### [CVE-2026-46136](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46136) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0c9318d49e501a5d50b02bd91a4813bde2353488%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15173a1697236793e9e900b82fece6f99d41b2a7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5c8cac512844ad593d31258e215908014381bee2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.75%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.6.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.7.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=fa6ad88e023ddfa6c5dcdb466d159e89f451e305%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: mt76: mt7921: fix a potential clc buffer length underflowThe buf_len is used to limit the iterations for retrieving the countrypower setting and may underflow under certain conditions due to changesin the power table in CLC.This underflow leads to an almost infinite loop or an invalid powersetting resulting in driver initialization failure. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46137.md b/2026/CVE-2026-46137.md new file mode 100644 index 0000000000..b5f22ed924 --- /dev/null +++ b/2026/CVE-2026-46137.md @@ -0,0 +1,20 @@ +### [CVE-2026-46137](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46137) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=00cfd77b9063dcdf3628a7087faba60de85a9cc8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:mptcp: pm: ADD_ADDR rtx: fix potential data-raceThis mptcp_pm_add_timer() helper is executed as a timer callback insoftirq context. To avoid any data races, the socket lock needs to beheld with bh_lock_sock().If the socket is in use, retry again soon after, similar to what is donewith the keepalive timer. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46146.md b/2026/CVE-2026-46146.md new file mode 100644 index 0000000000..bbddd1def4 --- /dev/null +++ b/2026/CVE-2026-46146.md @@ -0,0 +1,36 @@ +### [CVE-2026-46146](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46146) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1034719fdefd26caeec0a44a868bb5a412c2c1a5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=275e37532e8ebe25e8a4069b2d9f955bfd202a46%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=47ab3d820cb0a502bd0074f83bb3cf7ab5d79902%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.241%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.190%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.297%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.149%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.12.43%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.15.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.16.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.6.103%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=786571b10b1ae6d90e1242848ce78ee7e1d493c4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=799c06ad4c9c790c265e8b6b94947213f1fb389c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7ef3fd250f84494fb2f7871f357808edaa1fc6ce%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ae17b3b5e753efc239421d186cd1ff06e5ac296e%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=dfdcbcde5c20df878178245d4449feada7d5b201%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ecfd41166b72b67d3bdeb88d224ff445f6163869%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()The convert_chmap_v3() has a loop with its increment size ofcs_desc->wLength, but we forgot to validate cs_desc->wLength itself,which may lead to potential endless loop by a malformed descriptor.Add a proper size check to abort the loop for plugging the hole. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46149.md b/2026/CVE-2026-46149.md new file mode 100644 index 0000000000..f4d4e313b7 --- /dev/null +++ b/2026/CVE-2026-46149.md @@ -0,0 +1,20 @@ +### [CVE-2026-46149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46149) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.38%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a256-byte stack buffer, then will memcpy() cur_len bytes from thatbuffer. snprintf() returns the length the output would have had, whichcan exceed the buffer size when the fabric WWN is long because iSCSI IQNnames can be up to 223 bytes. The check at the memcpy() site onlyguards the destination page write, not the source read, so memcpy() willread past the stack buffer and copy adjacent stack contents to the sysfsreader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic()will be triggered.Commit 27e06650a5ea ("scsi: target: target_core_configfs: Add lengthcheck to avoid buffer overflow") added the same bound to thetarget_lu_gp_members_show() but the tg_pt_gp variant was missed soresolve that here. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46150.md b/2026/CVE-2026-46150.md new file mode 100644 index 0000000000..5a90b117ea --- /dev/null +++ b/2026/CVE-2026-46150.md @@ -0,0 +1,20 @@ +### [CVE-2026-46150](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46150) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=abc77577a669f424c5d0c185b9994f2621c52aa4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:fanotify: fix false positive on permission eventsfsnotify_get_mark_safe() may return false for a mark on an unrelated group,which results in bypassing the permission check.Fix by skipping over detached marks that are not in the current group. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46151.md b/2026/CVE-2026-46151.md new file mode 100644 index 0000000000..eeb5890757 --- /dev/null +++ b/2026/CVE-2026-46151.md @@ -0,0 +1,20 @@ +### [CVE-2026-46151](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46151) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:usb: usblp: fix heap leak in IEEE 1284 device ID via short responseusblp_ctrl_msg() collapses the usb_control_msg() return value to0/-errno, discarding the actual number of bytes transferred. A brokenprinter can complete the GET_DEVICE_ID control transfer short and thedriver has no way to know.usblp_cache_device_id_string() reads the 2-byte big-endian length prefixfrom the response and trusts it (clamped only to the buffer bounds).The buffer is kmalloc(1024) at probe time. A device that sends exactlytwo bytes (e.g. 0x03 0xFF, claiming a 1023-byte ID) leavesdevice_id_string[2..1022] holding stale kmalloc heap.That stale data is then exposed: - via the ieee1284_id sysfs attribute (sprintf("%s", buf+2), truncated at the first NUL in the stale heap), and - via the IOCNR_GET_DEVICE_ID ioctl, which copy_to_user()s the full claimed length regardless of NULs, up to 1021 bytes of uninitialized heap, with the leak size chosen by the device.Fix this up by just zapping the buffer with zeros before each requestsent to the device. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46159.md b/2026/CVE-2026-46159.md new file mode 100644 index 0000000000..d78b4490b0 --- /dev/null +++ b/2026/CVE-2026-46159.md @@ -0,0 +1,20 @@ +### [CVE-2026-46159](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46159) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.34%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7fde62bffb576d384ea49a3aed3403d5609ee5bc%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leakbtrfs_ioctl_space_info() has a TOCTOU race between two passes over theblock group RAID type lists. The first pass counts entries to determinethe allocation size, then the second pass fills the buffer. Thegroups_sem rwlock is released between passes, allowing concurrent blockgroup removal to reduce the entry count.When the second pass fills fewer entries than the first pass counted,copy_to_user() copies the full alloc_size bytes including trailinguninitialized kmalloc bytes to userspace.Fix by copying only total_spaces entries (the actually-filled count fromthe second pass) instead of alloc_size bytes, and switch to kzalloc soany future copy size mismatch cannot leak heap data. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46161.md b/2026/CVE-2026-46161.md new file mode 100644 index 0000000000..d8d81300d9 --- /dev/null +++ b/2026/CVE-2026-46161.md @@ -0,0 +1,20 @@ +### [CVE-2026-46161](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46161) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=475901aff15841fb0a81e7546517407779a9b061%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:md/raid10: fix divide-by-zero in setup_geo() with zero far_copiessetup_geo() extracts near_copies (nc) and far_copies (fc) from theuser-provided layout parameter without checking for zero. When fc=0with the "improved" far set layout selected, 'geo->far_set_size =disks / fc' triggers a divide-by-zero.Validate nc and fc immediately after extraction, returning -1 ifeither is zero. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46163.md b/2026/CVE-2026-46163.md new file mode 100644 index 0000000000..d97442bb2b --- /dev/null +++ b/2026/CVE-2026-46163.md @@ -0,0 +1,20 @@ +### [CVE-2026-46163](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46163) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.24%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=75388acd0cd827dc1498043daa7d1c760902cd67%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: b43legacy: enforce bounds check on firmware key index in RX pathSame fix as b43: the firmware-controlled key index in b43legacy_rx()can exceed dev->max_nr_keys. The existing B43legacy_WARN_ON isnon-enforcing in production builds, allowing an out-of-bounds read ofdev->key[].Make the check enforcing by dropping the frame for invalid indices. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46165.md b/2026/CVE-2026-46165.md new file mode 100644 index 0000000000..d23a4e8481 --- /dev/null +++ b/2026/CVE-2026-46165.md @@ -0,0 +1,30 @@ +### [CVE-2026-46165](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46165) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=42f0d3d81209654c08ffdde5a34b9b92d2645896%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.168%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.12.80%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.18.21%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.19.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.6.131%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6931d21f87bc6d657f145798fad0bf077b82486c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=98b726ab5e2a4811e27c28e4d041f75bba147eab%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9d56aced21fb9c104e8a3f3be9b21fbafe448ffc%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=b8c56a3fc5d879c0928f207a756b0f067f06c6a8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=bbe7bd722bfaea36aab3da6cc60fb4a05c644643%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:openvswitch: vport: fix self-deadlock on release of tunnel portsvports are used concurrently and protected by RCU, so netdev_put()must happen after the RCU grace period. So, either in an RCU call orafter the synchronize_net(). The rtnl_delete_link() must happen underRTNL and so can't be executed in RCU context. Calling synchronize_net()while holding RTNL is not a good idea for performance and systemstability under load in general, so calling netdev_put() in RCU callis the right solution here.However,when the device is deleted, rtnl_unlock() will call netdev_run_todo()and block until all the references are gone. In the current code thismeans that we never reach the call_rcu() and the vport is never freedand the reference is never released, causing a self-deadlock on deviceremoval.Fix that by moving the rcu_call() before the rtnl_unlock(), so thescheduled RCU callback will be executed when synchronize_net() iscalled from the rtnl_unlock()->netdev_run_todo() while the RTNL itselfis already released. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46167.md b/2026/CVE-2026-46167.md new file mode 100644 index 0000000000..c81cce27ab --- /dev/null +++ b/2026/CVE-2026-46167.md @@ -0,0 +1,20 @@ +### [CVE-2026-46167](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46167) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctlJust like in a previous problem in this driver, usblp_ctrl_msg() willcollapse the usb_control_msg() return value to 0/-errno, discarding theactual number of bytes transferred.Ideally that short command should be detected and error out, but manyprinters are known to send "incorrect" responses back so we can't justdo that.statusbuf is kmalloc(8) at probe time and never filled before the firstLPGETSTATUS ioctl.usblp_read_status() requests 1 byte. If a malicious printer respondswith zero bytes, *statusbuf is one byte of stale kmalloc heap,sign-extended into the local int status, which the LPGETSTATUS path thencopy_to_user()s directly to the ioctl caller.Fix this all by just zapping out the memory buffer when allocated atprobe time. If a later call does a short read, the data will beidentical to what the device sent it the last time, so there is no"leak" of information happening. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46168.md b/2026/CVE-2026-46168.md new file mode 100644 index 0000000000..134923be93 --- /dev/null +++ b/2026/CVE-2026-46168.md @@ -0,0 +1,20 @@ +### [CVE-2026-46168](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46168) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9061f24bf82ec2e92dd1e7c10b98b680db023d31%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:mptcp: fix scheduling with atomic in timestamp sockoptUsing lock_sock_fast() (atomic context) around sock_set_timestamp()and sock_set_timestamping() is unsafe, as both helpers can sleep.Replace lock_sock_fast() with sleepable lock_sock()/release_sock()to avoid scheduling while atomic panic. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46172.md b/2026/CVE-2026-46172.md index 42cd15d90b..8007231475 100644 --- a/2026/CVE-2026-46172.md +++ b/2026/CVE-2026-46172.md @@ -1,9 +1,11 @@ ### [CVE-2026-46172](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46172) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0146dca70b877b73c5fd9c67912b8a0ca8a7bac7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: xfrm6: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46173.md b/2026/CVE-2026-46173.md index d003d5b1dd..368fcba071 100644 --- a/2026/CVE-2026-46173.md +++ b/2026/CVE-2026-46173.md @@ -1,9 +1,11 @@ ### [CVE-2026-46173](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46173) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.17%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7f80a2fd7db9a55894fd841915236aca611291b5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:exit: prevent #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46174.md b/2026/CVE-2026-46174.md index c58d516ed6..f10c98c70d 100644 --- a/2026/CVE-2026-46174.md +++ b/2026/CVE-2026-46174.md @@ -10,6 +10,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5abd1583e06b3963e5c9d915760367de86808b78%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -22,6 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:x86/CPU/AMD: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46177.md b/2026/CVE-2026-46177.md new file mode 100644 index 0000000000..63c7b78007 --- /dev/null +++ b/2026/CVE-2026-46177.md @@ -0,0 +1,20 @@ +### [CVE-2026-46177](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46177) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ipmi: Add limits to event and receive message requestsThe driver would just fetch events and receive messages until theBMC said it was done. To avoid issues with BMCs that never say they aredone, add a limit of 10 fetches at a time.In addition, an si interface has an attn state it can return from thehardware which is supposed to cause a flag fetch to see if the driverneeds to fetch events or message or a few other things. If the attnbit gets stuck, it's a similar problem. So allow messages in betweenflag fetches so the driver itself doesn't get stuck.This is a more general fix than the previous fix for the specific badBMC, but should fix the more general issue of a BMC that won't stopsaying it has data.This has been there from the beginning of the driver. It's not a bugper-se, but it is accounting for bugs in BMCs. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46180.md b/2026/CVE-2026-46180.md new file mode 100644 index 0000000000..45953d4ccc --- /dev/null +++ b/2026/CVE-2026-46180.md @@ -0,0 +1,20 @@ +### [CVE-2026-46180](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46180) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a9ffda88be7416b8336f644806c2b3ed3ce08b26%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog taskWatchdog task might end between send_sig() and kthread_stop() calls, whatresults in the use-after-free issue. Fix this by increasing watchdog taskreference count before calling send_sig() and dropping it by switching tokthread_stop_put(). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46185.md b/2026/CVE-2026-46185.md new file mode 100644 index 0000000000..9fd868699c --- /dev/null +++ b/2026/CVE-2026-46185.md @@ -0,0 +1,22 @@ +### [CVE-2026-46185](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46185) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2d046892a493d9760c35fdaefc3017f27f91b621%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=76894f3e2f71177747b8b4763fb180e800279585%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:smb/client: fix out-of-bounds read in symlink_data()Since smb2_check_message() returns success without length validation forthe symlink error response, in symlink_data() it is possible foriov->iov_len to be smaller than sizeof(struct smb2_err_rsp). If the bufferonly contains the base SMB2 header (64 bytes), accessingerr->ErrorContextCount (at offset 66) or err->ByteCount later insymlink_data() will cause an out-of-bounds read. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46187.md b/2026/CVE-2026-46187.md new file mode 100644 index 0000000000..62fccb24a8 --- /dev/null +++ b/2026/CVE-2026-46187.md @@ -0,0 +1,30 @@ +### [CVE-2026-46187](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46187) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.18.139%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.14.113%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19.36%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4.179%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.9.170%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4c62764d0fc21a34ffc44eec1210038c3a2e4473%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ad78e2e057ab8d914a2b5e3e6acf29c3c8a428a3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c8ed05b1d8520f40395916438da9b38ce937a896%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d8f70ad66032363e3edceee81a7be2aaccb2d7f5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=de1fd69b6541ff61177114d63af7ea719c426cf0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ec759c0015fb7d4f5c7cb5711d2c8905724c7983%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: rsi: fix kthread lifetime race between self-exit and external-stopRSI driver use both self-exit(kthread_complete_and_exit) and external-stop(kthread_stop) when killing a kthread. Generally, kthread_stop() is calledfirst, and in this case, no particular issues occur.However, in rare instances where kthread_complete_and_exit() is calledfirst and then kthread_stop() is called, a UAF occurs because the kthreadobject, which has already exited and been freed, is accessed again.Therefore, to prevent this with minimal modification, you must removekthread_stop() and change the code to wait until the self-exit operationis completed. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46190.md b/2026/CVE-2026-46190.md new file mode 100644 index 0000000000..9e2799f696 --- /dev/null +++ b/2026/CVE-2026-46190.md @@ -0,0 +1,20 @@ +### [CVE-2026-46190](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46190) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0257be79fc4a16a3252ce80aa13b3640f728c425%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()Sashiko noticed an out-of-bounds read [1].In spi_nor_params_show(), the snor_f_names array is passed tospi_nor_print_flags() using sizeof(snor_f_names).Since snor_f_names is an array of pointers, sizeof() returns the totalnumber of bytes occupied by the pointers (element_count * sizeof(void *))rather than the element count itself. On 64-bit systems, this makes thepassed length 8x larger than intended.Inside spi_nor_print_flags(), the 'names_len' argument is used tobounds-check the 'names' array access. An out-of-bounds read occursif a flag bit is set that exceeds the array's actual element countbut is within the inflated byte-size count.Correct this by using ARRAY_SIZE() to pass the actual number ofstring pointers in the array. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46191.md b/2026/CVE-2026-46191.md new file mode 100644 index 0000000000..811ac16397 --- /dev/null +++ b/2026/CVE-2026-46191.md @@ -0,0 +1,20 @@ +### [CVE-2026-46191](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46191) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6cc50e1c5b57180fd37a31282000f43859b0fe73%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:fbcon: Avoid OOB font access if console rotation failsClear the font buffer if the reallocation during console rotation failsin fbcon_rotate_font(). The putcs implementations for the rotated bufferwill return early in this case. See [1] for an example.Currently, fbcon_rotate_font() keeps the old buffer, which is too smallfor the rotated font. Printing to the rotated console with a high-enoughcharacter code will overflow the font buffer.v2:- fix typos in commit message + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46193.md b/2026/CVE-2026-46193.md index 27c65fd0b3..741147f8c0 100644 --- a/2026/CVE-2026-46193.md +++ b/2026/CVE-2026-46193.md @@ -1,8 +1,10 @@ ### [CVE-2026-46193](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46193) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d4d573d0334d07341beffdcf97e2b85d3955d8ae%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:xfrm: ah: acc #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46195.md b/2026/CVE-2026-46195.md new file mode 100644 index 0000000000..5e29277da1 --- /dev/null +++ b/2026/CVE-2026-46195.md @@ -0,0 +1,20 @@ +### [CVE-2026-46195](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46195) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=bc3e9dd9d104ca1b75644eab87b38ce8a924aef4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:smb: client: validate dacloffset before building DACL pointersparse_sec_desc(), build_sec_desc(), and the chown path inid_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsdbefore proving a DACL header fits inside the returned securitydescriptor.On 32-bit builds a malicious server can return dacloffset nearU32_MAX, wrap the derived DACL pointer below end_of_acl, and then slippast the later pointer-based bounds checks. build_sec_desc() andid_mode_to_cifs_acl() can then dereference DACL fields from the wrappedpointer in the chmod/chown rewrite paths.Validate dacloffset numerically before building any DACL pointer andreuse the same helper at the three DACL entry points. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46196.md b/2026/CVE-2026-46196.md new file mode 100644 index 0000000000..07c39f3bfe --- /dev/null +++ b/2026/CVE-2026-46196.md @@ -0,0 +1,20 @@ +### [CVE-2026-46196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46196) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8cf868affdc459beee1a941df0cfaba1673740e3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func()invokes the subsystem's ext->regfunc() before attempting to install thenew probe via func_add(). If func_add() then fails (for example, whenallocate_probes() cannot allocate a new probe array under memory pressureand returns -ENOMEM), the function returns the error without calling thematching ext->unregfunc(), leaving the side effects of regfunc() behindwith no installed probe to justify them.For syscall tracepoints this is particularly unpleasant: syscall_regfunc()bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task.After a leaked failure, the refcount is stuck at a non-zero value with noconsumer, and every task continues paying the syscall trace entry/exitoverhead until reboot. Other subsystems providing regfunc()/unregfunc()pairs exhibit similarly scoped persistent state.Mirror the existing 1 -> 0 cleanup and call ext->unregfunc() in thefunc_add() error path, gated on the same condition used there so theunwind is symmetric with the registration. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46209.md b/2026/CVE-2026-46209.md new file mode 100644 index 0000000000..1392ed0099 --- /dev/null +++ b/2026/CVE-2026-46209.md @@ -0,0 +1,20 @@ +### [CVE-2026-46209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46209) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4c3dbb2c312c9fafbac30d98c523b8b1f3455d78%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensionsusing plain integer division: unsigned int width = mode_cmd->width / (i ? info->hsub : 1); unsigned int height = mode_cmd->height / (i ? info->vsub : 1);However, the ioctl-level framebuffer_check() in drm_framebuffer.c usesdrm_format_info_plane_width/height() which round up dimensions viaDIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM objectsize check for certain pixel format and dimension combinations.For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer theGEM size validation path sees height=0 instead of height=1. Theexpression (height - 1) then wraps to UINT_MAX as an unsigned int,causing min_size to overflow and wrap back to a small value. A tinyGEM object therefore passes the size guard, yet when the GPU accessesthe chroma plane it will read or write memory beyond the object'sbounds.Fix by replacing the open-coded divisions with drm_format_info_plane_width()and drm_format_info_plane_height(), which use DIV_ROUND_UP() and matchthe calculation already used in framebuffer_check(). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46214.md b/2026/CVE-2026-46214.md new file mode 100644 index 0000000000..c56cf2858c --- /dev/null +++ b/2026/CVE-2026-46214.md @@ -0,0 +1,20 @@ +### [CVE-2026-46214](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46214) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c0cfa2d8a788fcf45df5bf4070ab2474c88d543a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:vsock/virtio: fix accept queue count leak on transport mismatchvirtio_transport_recv_listen() calls sk_acceptq_added() beforevsock_assign_transport(). If vsock_assign_transport() fails orselects a different transport, the error path returns withoutcalling sk_acceptq_removed(), permanently incrementingsk_ack_backlog.After approximately backlog+1 such failures, sk_acceptq_is_full()returns true, causing the listener to reject all new connections.Fix by moving sk_acceptq_added() to after the transport validation,matching the pattern used by vmci_transport and hyperv_transport. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46227.md b/2026/CVE-2026-46227.md new file mode 100644 index 0000000000..1d1b5aa303 --- /dev/null +++ b/2026/CVE-2026-46227.md @@ -0,0 +1,20 @@ +### [CVE-2026-46227](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46227) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4910280503f3af2857d5aa77e35b22d93a8960a8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALLThe SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs withlist_for_each_entry_safe(), which caches the next entry in @tmp beforethe loop body runs. The body calls sctp_sendmsg_to_asoc(), which maydrop the socket lock inside sctp_wait_for_sndbuf().While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF theassociation cached in @tmp, migrating it to a new endpoint viasctp_sock_migrate() (list_del_init() + list_add_tail() tonewep->asocs), and optionally close the new socket which frees theassociation via kfree_rcu(). The cached @tmp can also be freed by anetwork ABORT for that association, processed in softirq while thelock is dropped.sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lockvia the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothingrevalidates @tmp. After a successful return, the iterator advances tothe stale @tmp, yielding either a use-after-free (if the peeled socketwas closed) or a list-walk onto the new endpoint's list head (typeconfusion of &newep->asocs as a struct sctp_association *).Both are reachable from CapEff=0; the type-confusion path givescontrolled indirect call via the outqueue.sched->init_sid pointer.Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc()returns. @asoc is known to still be on ep->asocs at that point: theonly callers that list_del an association from ep->asocs aresctp_association_free() (which sets asoc->base.dead) andsctp_assoc_migrate() (which changes asoc->base.sk), andsctp_wait_for_sndbuf() checks both under the lock before anysuccessful return; a tripped check propagates as err < 0 and the loopbails before the re-derive.The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and theloop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, sothe @tmp cached by list_for_each_entry_safe() still covers thelock-held free that ba59fb027307 ("sctp: walk the list of asocsafely") was added for. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46234.md b/2026/CVE-2026-46234.md new file mode 100644 index 0000000000..4f31cf147b --- /dev/null +++ b/2026/CVE-2026-46234.md @@ -0,0 +1,20 @@ +### [CVE-2026-46234](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46234) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=b9f2b0ffde0c9b666b2b1672eb468b8f805a9b97%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:vsock: fix buffer size clamping orderIn vsock_update_buffer_size(), the buffer size was being clamped to themaximum first, and then to the minimum. If a user sets a minimum buffersize larger than the maximum, the minimum check overrides the maximumcheck, inverting the constraint.This breaks the intended socket memory boundaries by allowing thevsk->buffer_size to grow beyond the configured vsk->buffer_max_size.Fix this by checking the minimum first, and then the maximum. Thisensures the buffer size never exceeds the buffer_max_size. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46243.md b/2026/CVE-2026-46243.md index db5315815e..65338f6663 100644 --- a/2026/CVE-2026-46243.md +++ b/2026/CVE-2026-46243.md @@ -1,6 +1,7 @@ ### [CVE-2026-46243](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46243) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.24%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f1d662a7d5e5322e583aad6b3cfec03d8f27b435%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -13,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:smb: client: #### Reference - http://www.openwall.com/lists/oss-security/2026/06/01/6 +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html - https://github.com/manizada/CIFSwitch #### Github diff --git a/2026/CVE-2026-46275.md b/2026/CVE-2026-46275.md new file mode 100644 index 0000000000..1e44e5c362 --- /dev/null +++ b/2026/CVE-2026-46275.md @@ -0,0 +1,30 @@ +### [CVE-2026-46275](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46275) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0d234d1135dcd8876de0576dac68efd0a87eef87%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3b799254cf6f481460719023d7a18f46651e5e7f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3fe978892ab46efc2f3830d9abc015eff72caaf9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.14.203%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19.153%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.73%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.8.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.9.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=aea63181b6fcb6b9ccde1ada9ea51be19c4015af%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=cd27019bc149f20f12ebec943c2b4c775745a5a0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: hci_uart: fix UAFs and race conditions in close and init pathsVulnerabilities leading to Use-After-Free (UAF) and Null PointerDereference (NPD) conditions were observed in the lifecycle managementof hci_uart.The primary issue arises because the workqueues (init_ready andwrite_work) are only flushed/cancelled if the HCI_UART_PROTO_READYflag is set during TTY close. If a hangup occurs before setup completes,hci_uart_tty_close() skips the teardown of these workqueues andproceeds to free the `hu` struct. When the scheduled work executeslater, it blindly dereferences the freed `hu` struct.Furthermore, several data races and UAFs were identified in the teardownsequence:1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work.2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev.3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently.Fix these synchronization and lifecycle issues by:1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free.2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state.3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs.4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration.5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core.6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46294.md b/2026/CVE-2026-46294.md new file mode 100644 index 0000000000..1d831ade69 --- /dev/null +++ b/2026/CVE-2026-46294.md @@ -0,0 +1,20 @@ +### [CVE-2026-46294](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46294) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:dm: fix a buffer overflow in ioctl processingTony Asleson (using Claude) found a buffer overflow in dm-ioctl in thefunction retrieve_status:1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr);3. The alignment doesn't check overflow, so outptr could point past the buffer end4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf);5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number6. With "remaining" being high, the code writes more data past the end of the bufferLuckily, this bug has no security implications because:1. Only root can issue device mapper ioctls2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46303.md b/2026/CVE-2026-46303.md index f3bf5b357f..09e7e59416 100644 --- a/2026/CVE-2026-46303.md +++ b/2026/CVE-2026-46303.md @@ -1,6 +1,7 @@ ### [CVE-2026-46303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46303) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=08313e26e06d4aa9ce1cbba1a8e359e9cab9ad56%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1fe5620fcd6c2f0a4a927ee10c8e53196da392f3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.32.66%20&color=brightgreen) @@ -17,6 +18,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=8190393a88f2b0321263a54f2a9eb5a2aa43be7e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=96e44adce250199ec9b2b928be66365779ff1b59%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=b6d20edb6e7cedb4eedb9e0193d20dd488ebae84%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f54e18f1b831c92f6512d2eedb224cd63d607d3d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=fbce0d7dc8965c9fb8d411862040239d4a768c71%20&color=brightgreen) @@ -30,6 +32,8 @@ In the Linux kernel, the following vulnerability has been resolved:isofs: valida #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46304.md b/2026/CVE-2026-46304.md new file mode 100644 index 0000000000..d8b8ee50a8 --- /dev/null +++ b/2026/CVE-2026-46304.md @@ -0,0 +1,22 @@ +### [CVE-2026-46304](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46304) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=06406d81a2d7cfb8abcc4fa6cdfeb8e5897007c5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3976dd677e891c0b2c63d08028d445663539472c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.9.68%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_freenvmet_tcp_release_queue_work() runs on nvmet-wq and can drop thefinal controller reference through nvmet_cq_put(). If that triggersnvmet_ctrl_free(), the teardown path flushes ctrl->async_event_work onthe same nvmet-wq.Call chain: nvmet_tcp_schedule_release_queue() kref_put(&queue->kref, nvmet_tcp_release_queue) nvmet_tcp_release_queue() queue_work(nvmet_wq, &queue->release_work) <--- nvmet_wq process_one_work() nvmet_tcp_release_queue_work() nvmet_cq_put(&queue->nvme_cq) nvmet_cq_destroy() nvmet_ctrl_put(cq->ctrl) nvmet_ctrl_free() flush_work(&ctrl->async_event_work) <--- nvmet_wq Previously Scheduled by :- nvmet_add_async_event queue_work(nvmet_wq, &ctrl->async_event_work);This trips lockdep with a possible recursive locking warning.[ 5223.015876] run blktests nvme/003 at 2026-04-07 20:53:55[ 5223.061801] loop0: detected capacity change from 0 to 2097152[ 5223.072206] nvmet: adding nsid 1 to subsystem blktests-subsystem-1[ 5223.088368] nvmet_tcp: enabling port 0 (127.0.0.1:4420)[ 5223.126086] nvmet: Created discovery controller 1 for subsystem nqn.2014-08.org.nvmexpress.discovery for NQN nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349.[ 5223.128453] nvme nvme1: new ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery", addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349[ 5233.199447] nvme nvme1: Removing ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery"[ 5233.227718] ============================================[ 5233.231283] WARNING: possible recursive locking detected[ 5233.234696] 7.0.0-rc3nvme+ #20 Tainted: G O N[ 5233.238434] --------------------------------------------[ 5233.241852] kworker/u192:6/2413 is trying to acquire lock:[ 5233.245429] ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90[ 5233.251438] but task is already holding lock:[ 5233.255254] ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x5cc/0x6e0[ 5233.261125] other info that might help us debug this:[ 5233.265333] Possible unsafe locking scenario:[ 5233.269217] CPU0[ 5233.270795] ----[ 5233.272436] lock((wq_completion)nvmet-wq);[ 5233.275241] lock((wq_completion)nvmet-wq);[ 5233.278020] *** DEADLOCK ***[ 5233.281793] May be due to missing lock nesting notation[ 5233.286195] 3 locks held by kworker/u192:6/2413:[ 5233.289192] #0: ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x5cc/0x6e0[ 5233.294569] #1: ffffc9000e2a7e40 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x6e0[ 5233.300128] #2: ffffffff82d7dc40 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530[ 5233.304290] stack backtrace:[ 5233.306520] CPU: 4 UID: 0 PID: 2413 Comm: kworker/u192:6 Tainted: G O N 7.0.0-rc3nvme+ #20 PREEMPT(full)[ 5233.306524] Tainted: [O]=OOT_MODULE, [N]=TEST[ 5233.306525] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014[ 5233.306527] Workqueue: nvmet-wq nvmet_tcp_release_queue_work [nvmet_tcp][ 5233.306532] Call Trace:[ 5233.306534] <TASK>[ 5233.306536] dump_stack_lvl+0x73/0xb0[ 5233.306552] print_deadlock_bug+0x225/0x2f0[ 5233.306556] __lock_acquire+0x13f0/0x2290[ 5233.306563] lock_acquire+0xd0/0x300[ 5233.306565] ? touch_wq_lockdep_map+0x26/0x90[ 5233.306571] ? __flush_work+0x20b/0x530[ 5233.306573] ? touch_wq_lockdep_map+0x26/0x90[ 5233.306577] touch_wq_lockdep_map+0x3b/0x90[ 5233.306580] ? touch_wq_lockdep_map+0x26/0x90[ 52---truncated--- + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46306.md b/2026/CVE-2026-46306.md index 43b09e46e7..2495c8c2f4 100644 --- a/2026/CVE-2026-46306.md +++ b/2026/CVE-2026-46306.md @@ -1,10 +1,12 @@ ### [CVE-2026-46306](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46306) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=10f665b52a75df6eb26ddebbbc072ee264183731%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=46126db9c86110e5fc1e369b9bb89735ddefdae4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d7e541e86122d21f71eb71c5dfa7fb1eb6623fe8%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +18,8 @@ In the Linux kernel, the following vulnerability has been resolved:flow_dissecto #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46307.md b/2026/CVE-2026-46307.md new file mode 100644 index 0000000000..b60e609fd4 --- /dev/null +++ b/2026/CVE-2026-46307.md @@ -0,0 +1,20 @@ +### [CVE-2026-46307](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46307) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6d7b97b23e114c8fbb825e6721164d228c1af3fc%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:wifi: ath5k: do not access array OOBVincent reports:> The ath5k driver seems to do an array-index-out-of-bounds access as> shown by the UBSAN kernel message:> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20> index 4 is out of range for type 'ieee80211_tx_rate [4]'> ...> Call Trace:> <TASK>> dump_stack_lvl+0x5d/0x80> ubsan_epilogue+0x5/0x2b> __ubsan_handle_out_of_bounds.cold+0x46/0x4b> ath5k_tasklet_tx+0x4e0/0x560 [ath5k]> tasklet_action_common+0xb5/0x1c0It is real. 'ts->ts_final_idx' can be 3 on 5212, so: info->status.rates[ts->ts_final_idx + 1].idx = -1;with the array defined as: struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];while the size is: #define IEEE80211_TX_MAX_RATES 4is indeed bogus.Set this 'idx = -1' sentinel only if the array index is less than thearray size. As mac80211 will not look at rates beyond the size(IEEE80211_TX_MAX_RATES).Note: The effect of the OOB write is negligible. It just overwrites thenext member of info->status, i.e. ack_signal. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46320.md b/2026/CVE-2026-46320.md new file mode 100644 index 0000000000..e2373f299c --- /dev/null +++ b/2026/CVE-2026-46320.md @@ -0,0 +1,20 @@ +### [CVE-2026-46320](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46320) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0efac27791ee068075d80f07c55a229b1335ce12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:tap: free page on error paths in tap_get_user_xdp()tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL,and returns -ENOMEM when build_skb() fails. Both paths jump to the errlabel without freeing the page that vhost_net_build_xdp() allocated forthe frame. tap_sendmsg() discards the per-buffer return value and alwaysreturns 0, so vhost_tx_batch() takes the success path and never freesthe page; each rejected frame in a batch leaks one page-frag chunk.Free the page on both error paths, before the skb is built. This is thetap counterpart of the same leak in tun_xdp_one(). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46321.md b/2026/CVE-2026-46321.md new file mode 100644 index 0000000000..27239ff98f --- /dev/null +++ b/2026/CVE-2026-46321.md @@ -0,0 +1,34 @@ +### [CVE-2026-46321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46321) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=049584807f1d797fc3078b68035450a9769eb5c3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=32b0aaba5dbc85816898167d9b5d45a22eae82e9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.223%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.164%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.281%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.102%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.10.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.6.43%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.9.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6100e0237204890269e3f934acfc50d35fd6f319%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8418f55302fa1d2eeb73e16e345167e545c598a5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d5ad89b7d01ed4e66fd04734fc63d6e78536692a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:tun: free page on short-frame rejection in tun_xdp_one()tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN withoutfreeing the page that vhost_net_build_xdp() allocated for it.tun_sendmsg() discards that -EINVAL and still returns total_len, sovhost_tx_batch() takes the success path and never frees the page; eachshort frame in a batch leaks one page-frag chunk.A local process that can open /dev/net/tun and /dev/vhost-net can hitthis path: it attaches a tun/tap device as the vhost-net backend andfeeds TX descriptors whose length minus the virtio-net header is belowETH_HLEN. Each kick leaks the page-frag chunks for that batch, and atight submission loop exhausts host memory and triggers an OOM panic.Free the page before returning -EINVAL, matching the XDP-program errorpath in the same function. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46322.md b/2026/CVE-2026-46322.md new file mode 100644 index 0000000000..3d42d66a18 --- /dev/null +++ b/2026/CVE-2026-46322.md @@ -0,0 +1,20 @@ +### [CVE-2026-46322](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46322) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=043d222f93ab8c76b56a3b315cd8692e35affb6c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:tun: free page on build_skb failure in tun_xdp_one()When build_skb() fails in tun_xdp_one(), the function sets ret to-ENOMEM and jumps to the out label, which returns without freeing thepage that vhost_net_build_xdp() allocated for the frame. As with theshort-frame rejection path, tun_sendmsg() discards the per-buffer errorand still returns total_len, so vhost_tx_batch() takes the success pathand never frees the page. Each build_skb() failure in a batch leaks onepage-frag chunk.Free the page before taking the error path, matching the put_page() theother error exits of tun_xdp_one() already perform. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46323.md b/2026/CVE-2026-46323.md index ffb58a3069..2499536fcd 100644 --- a/2026/CVE-2026-46323.md +++ b/2026/CVE-2026-46323.md @@ -1,9 +1,11 @@ ### [CVE-2026-46323](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46323) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=753f1ca4e1e50248a1b760c9774d6d6b354562cc%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -15,6 +17,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: gro: don #### Reference - https://bugzilla.redhat.com/show_bug.cgi?id=2479832 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-46331.md b/2026/CVE-2026-46331.md new file mode 100644 index 0000000000..627cd583f5 --- /dev/null +++ b/2026/CVE-2026-46331.md @@ -0,0 +1,30 @@ +### [CVE-2026-46331](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2ec2dd7d51a9320151f275ddbb2b53260fb32ca1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19.244%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.117%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.41%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.17.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.4.195%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8b796475fd7882663a870456466a4fb315cc1bd6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=abe35bf3be51482593076d516a680d79e5fbc8e1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=b773640d5bb9e2acfd91e2695717af04d47aa116%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c19cc520b3d69904e9518d401ad0df7f4702aca0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d0c38a914b0c4c21d553da801003d36979016726%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net/sched: fix pedit partial COW leading to page cache corruptiontcf_pedit_act() computes the COW range for skb_ensure_writable()once before the key loop using tcfp_off_max_hint, but the hint doesnot account for the runtime header offset added by typed keys. Thiscan leave part of the write region un-COW'd.Fix by moving skb_ensure_writable() inside the per-key loop wherethe actual write offset is known, and add overflow checking on theoffset arithmetic. For negative offsets (e.g. Ethernet header editsat ingress), use skb_cow() to COW the headroom instead. Guardoffset_valid() against INT_MIN, where negation is undefined. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-46333.md b/2026/CVE-2026-46333.md index 867cf2df15..c92ac5a953 100644 --- a/2026/CVE-2026-46333.md +++ b/2026/CVE-2026-46333.md @@ -9,6 +9,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.9.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=694a95fa6dae4991f16cda333d897ea063021fed%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bfedb589252c01fa505ac9f6f2a3d5d68d707ef4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d5b3e840dbf6dd2c0f30b5982b6f5ecd49e46b12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e45692fa1aea06676449b63ef3c2b6e1e72b7578%20&color=brightgreen) @@ -23,6 +24,7 @@ In the Linux kernel, the following vulnerability has been resolved:ptrace: sligh #### Reference - http://www.openwall.com/lists/oss-security/2026/05/20/16 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html - https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/ #### Github diff --git a/2026/CVE-2026-51861.md b/2026/CVE-2026-51861.md new file mode 100644 index 0000000000..ae9db64c6a --- /dev/null +++ b/2026/CVE-2026-51861.md @@ -0,0 +1,17 @@ +### [CVE-2026-51861](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51861) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py. + +### POC + +#### Reference +- https://github.com/dataelement/bisheng/issues/1995 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-52909.md b/2026/CVE-2026-52909.md new file mode 100644 index 0000000000..3c199702e0 --- /dev/null +++ b/2026/CVE-2026-52909.md @@ -0,0 +1,20 @@ +### [CVE-2026-52909](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52909) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=61220ab349485d911083d0b7990ccd3db6c63297%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ip6_vti: set netns_immutable on the fallback device.john1988 and Noam Rathaus reported that vti6_init_net() does not set thenetns_immutable flag on the per-netns fallback tunnel device (ip6_vti0).Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel)correctly set this flag during their fallback device initialization toprevent them from being moved to another network namespace. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-52910.md b/2026/CVE-2026-52910.md index 1bf3a7041b..e4309f85ae 100644 --- a/2026/CVE-2026-52910.md +++ b/2026/CVE-2026-52910.md @@ -1,9 +1,11 @@ ### [CVE-2026-52910](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52910) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=538950a1b7527a0a52ccd9337e3fcd304f027f13%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Free reu #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-52912.md b/2026/CVE-2026-52912.md index efddefcfb5..f19d2aa46b 100644 --- a/2026/CVE-2026-52912.md +++ b/2026/CVE-2026-52912.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ac28634456867b23b95faccba7997a62ec430603%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-52917.md b/2026/CVE-2026-52917.md new file mode 100644 index 0000000000..89256d3110 --- /dev/null +++ b/2026/CVE-2026-52917.md @@ -0,0 +1,20 @@ +### [CVE-2026-52917](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52917) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8f840e47f190cbe61a96945c13e9551048d42cef%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:sctp: diag: reject stale associations in dump_one pathThe SCTP exact sock_diag lookup can hold a transport reference, block onlock_sock(sk), and then resume after sctp_association_free() has markedthe association dead and freed its bind address list.When that happens, inet_assoc_attr_size() andinet_diag_msg_sctpasoc_fill() can still dereference association statethat is no longer valid for reporting. In particular,inet_diag_msg_sctpasoc_fill() may read an empty bind-address list as areal sctp_sockaddr_entry and trigger an out-of-bounds read fromunrelated association memory.Reject the association after taking the socket lock if it has beenreaped or detached from the endpoint, and report the lookup as stale.This keeps the exact dump-one path from formatting torn associationstate. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-52918.md b/2026/CVE-2026-52918.md new file mode 100644 index 0000000000..6216c6f536 --- /dev/null +++ b/2026/CVE-2026-52918.md @@ -0,0 +1,20 @@ +### [CVE-2026-52918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52918) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: serialize accept_q accessbt_sock_poll() walks the accept queue without synchronization, whilechild teardown can unlink the same socket and drop its last reference.The unsynchronized accept queue walk has existed since the initialBluetooth import.Protect accept_q with a dedicated lock for queue updates and polling.Also rework bt_accept_dequeue() to take temporary child references underthe queue lock before dropping it and locking the child socket. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-52923.md b/2026/CVE-2026-52923.md new file mode 100644 index 0000000000..bb6da4e522 --- /dev/null +++ b/2026/CVE-2026-52923.md @@ -0,0 +1,20 @@ +### [CVE-2026-52923](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52923) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=03f595668017f1a1fb971c02fc37140bc6e7bb1c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ipc: limit next_id allocation to the valid ID rangeThe checkpoint/restore sysctl path can request the next SysV IPC idthrough ids->next_id. ipc_idr_alloc() currently forwards that request toidr_alloc() with an open-ended upper bound.If the valid tail of the SysV IPC id space is full, the allocation canspill beyond ipc_mni. The returned SysV IPC id still uses the normalindex encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for theobject.The bug is in ipc_idr_alloc() in the checkpoint/restore path.1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...)2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range.3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index.5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer.6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory.Prevent this by bounding the requested allocation to ipc_mni so thecheckpoint/restore path fails once the valid range is exhausted. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-52928.md b/2026/CVE-2026-52928.md new file mode 100644 index 0000000000..1a24da74fb --- /dev/null +++ b/2026/CVE-2026-52928.md @@ -0,0 +1,20 @@ +### [CVE-2026-52928](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52928) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=314001f0bf927015e459c9d387d62a231fe93af3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:af_unix: Reject SIOCATMARK on non-stream socketsSIOCATMARK reports whether the receive queue is at the urgent mark forMSG_OOB.In AF_UNIX, MSG_OOB is supported only for SOCK_STREAM sockets.SOCK_DGRAM and SOCK_SEQPACKET reject MSG_OOB in sendmsg() and recvmsg(),so they should not support SIOCATMARK either.Return -EOPNOTSUPP for non-stream sockets before checking the receivequeue. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-52929.md b/2026/CVE-2026-52929.md new file mode 100644 index 0000000000..7191f51a0c --- /dev/null +++ b/2026/CVE-2026-52929.md @@ -0,0 +1,20 @@ +### [CVE-2026-52929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52929) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=637784ade221a3c8a7ecd0f583eddd95d6276b9a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:sctp: stream: fully roll back denied add-stream stateWhen ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks andthen lowers outcnt. That leaves removed stream metadata behind, so alater re-add can reuse a stale ext and hit a null-pointer dereference inthe scheduler get path.Fix the rollback by tearing down the removed stream state the same wayother stream resizes do. Unschedule the current scheduler state, dropthe removed stream ext state with sctp_stream_outq_migrate(), and thenreschedule the remaining streams.This keeps scheduler-private RR/FC/PRIO lists consistent while fullyrolling back denied outgoing stream additions. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-52930.md b/2026/CVE-2026-52930.md index 0c373f7315..66d089c7a5 100644 --- a/2026/CVE-2026-52930.md +++ b/2026/CVE-2026-52930.md @@ -1,9 +1,11 @@ ### [CVE-2026-52930](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52930) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4c677e2eefdba9c5bfc4474e2e91b26ae8458a1d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:ipc/shm: seri #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-52933.md b/2026/CVE-2026-52933.md index 84e06f40c9..38a4b8e3c6 100644 --- a/2026/CVE-2026-52933.md +++ b/2026/CVE-2026-52933.md @@ -6,6 +6,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.0.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=a26a35e9019fd70bf3cf647dcfdae87abc7bacea%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bc4e6ee16778149811333a969a7a893d4cc110c5%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:io_uring/poll #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-52942.md b/2026/CVE-2026-52942.md index 885ab6f554..942d0c1859 100644 --- a/2026/CVE-2026-52942.md +++ b/2026/CVE-2026-52942.md @@ -1,9 +1,11 @@ ### [CVE-2026-52942](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52942) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.36%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7eb9282cd0efac08b8377cbd5037ba297c77e3f7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-52943.md b/2026/CVE-2026-52943.md index 7beef5e554..f14f28e65a 100644 --- a/2026/CVE-2026-52943.md +++ b/2026/CVE-2026-52943.md @@ -1,9 +1,11 @@ ### [CVE-2026-52943](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52943) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6fa01ccd883021105e9f8af7d04b9f156fa3494a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -15,6 +17,8 @@ In the Linux kernel, the following vulnerability has been resolved:net: skbuff: #### Reference - https://bugzilla.redhat.com/show_bug.cgi?id=2492137 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-52946.md b/2026/CVE-2026-52946.md index aeefe9139b..270bd9880f 100644 --- a/2026/CVE-2026-52946.md +++ b/2026/CVE-2026-52946.md @@ -1,9 +1,11 @@ ### [CVE-2026-52946](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52946) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:fs/fcntl: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-52947.md b/2026/CVE-2026-52947.md new file mode 100644 index 0000000000..97446a2f69 --- /dev/null +++ b/2026/CVE-2026-52947.md @@ -0,0 +1,20 @@ +### [CVE-2026-52947](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52947) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=bdabad3e363d825ddf9679dd431cca0b2c30f881%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: qrtr: fix refcount saturation and potential UAF in qrtr_port_removeIn qrtr_port_remove(), the socket reference count is decremented via__sock_put() before the port is removed from the qrtr_ports XArray andbefore the RCU grace period elapses.This breaks the fundamental RCU update paradigm. It exposes a racewindow where a concurrent RCU reader (such as qrtr_reset_ports() orqrtr_port_lookup()) can obtain a pointer to the socket from the XArray,and attempt to call sock_hold() on a socket whose reference count hasalready dropped to zero.This exact race condition was hit during syzkaller fuzzing, leading tothe following refcount saturation warning and a potential Use-After-Free: refcount_t: saturated; leaking memory. WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0 Modules linked in: qrtr(+) bochs drm_shmem_helper ... Call Trace: <TASK> qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr] __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr] qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr] kernel_bind+0xe4/0x120 net/socket.c:3592 qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr] qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr] do_one_initcall+0xf5/0x5e0 init/main.c:1283 ... </TASK>Fix this by deferring the reference count decrement until after thexa_erase() and the synchronize_rcu() complete.(Note: The v1 of this patch incorrectly replaced __sock_put() withsock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove()still hold a reference to the socket, so freeing the socket memory herewould lead to a subsequent UAF in the caller. Thus, the __sock_put() iskept, but only repositioned to close the RCU race.) + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-52948.md b/2026/CVE-2026-52948.md new file mode 100644 index 0000000000..8722fd6bbc --- /dev/null +++ b/2026/CVE-2026-52948.md @@ -0,0 +1,20 @@ +### [CVE-2026-52948](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52948) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.29%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctlWhile fuzzing with Syzkaller, a persistent `schedule_timeout: wrongtimeout value` warning was observed, accompanied by SMBus controllerstate machine corruption.The I2C_TIMEOUT ioctl accepts a user-provided timeout in multiples of10 ms. The user argument is checked against INT_MAX, but it issubsequently multiplied by 10 before being passed to msecs_to_jiffies().A malicious user can pass a large value (e.g., 429496729) that passesthe `arg > INT_MAX` check but overflows when multiplied by 10. Thisresults in a truncated 32-bit unsigned value that bypasses theinternal `(int)m < 0` check in `msecs_to_jiffies()`.The truncated value is then assigned to `client->adapter->timeout`(a signed 32-bit int), which is reinterpreted as a negative number.When passed to wait_for_completion_timeout(), this negative valueundergoes sign extension to a 64-bit unsigned long, triggering the`schedule_timeout` warning and causing premature returns. This leavesthe SMBus state machine in an unrecoverable state, constituting alocal Denial of Service (DoS).Fix this by bounding the user argument to `INT_MAX / 10`.[wsa: move the comment as well] + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-52970.md b/2026/CVE-2026-52970.md index bbb3483cf5..4d35192429 100644 --- a/2026/CVE-2026-52970.md +++ b/2026/CVE-2026-52970.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=857b46027d6f91150797295752581b7155b9d0e1%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-52986.md b/2026/CVE-2026-52986.md index 3ef953d7e1..dbb821cbf5 100644 --- a/2026/CVE-2026-52986.md +++ b/2026/CVE-2026-52986.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=05e3ced297fe755093140e7487e292fb7603316e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.26%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-52998.md b/2026/CVE-2026-52998.md index 81f5112a17..f3be7af5ba 100644 --- a/2026/CVE-2026-52998.md +++ b/2026/CVE-2026-52998.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.31%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-52999.md b/2026/CVE-2026-52999.md index f461b2bd5f..4a8e3fb342 100644 --- a/2026/CVE-2026-52999.md +++ b/2026/CVE-2026-52999.md @@ -8,6 +8,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8316b60582facd4068fb0916c4db2418c21b7174%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53001.md b/2026/CVE-2026-53001.md index fe36ac1a46..b0a42984ed 100644 --- a/2026/CVE-2026-53001.md +++ b/2026/CVE-2026-53001.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.28%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ab4f21e6fb1c09b13c4c3cb8357babe8223471bd%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: xt #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53002.md b/2026/CVE-2026-53002.md index 4563b276c9..afbbdaddec 100644 --- a/2026/CVE-2026-53002.md +++ b/2026/CVE-2026-53002.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.20%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=9fafcd7b203229c3f3893a475741afc27e276306%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: co #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53006.md b/2026/CVE-2026-53006.md index 083402bfbd..7ed7f27b06 100644 --- a/2026/CVE-2026-53006.md +++ b/2026/CVE-2026-53006.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4b3418fba0fe819197e3359d5ddbef84ba2c59de%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: fix pos #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53012.md b/2026/CVE-2026-53012.md index 0ce3cda9c9..9bb1878760 100644 --- a/2026/CVE-2026-53012.md +++ b/2026/CVE-2026-53012.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=7bf4796dd09984ad1612877a82d0d139c70ae27f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:nexthop: fix #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53050.md b/2026/CVE-2026-53050.md index af1dacbae7..dcd360fe86 100644 --- a/2026/CVE-2026-53050.md +++ b/2026/CVE-2026-53050.md @@ -15,6 +15,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=869b6ea1609f655a43251bf41757aa44e5350a8f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bb7e3a019b52d829949d02b64ebab37838148fbf%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -26,6 +27,7 @@ In the Linux kernel, the following vulnerability has been resolved:quota: Fix ra #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53080.md b/2026/CVE-2026-53080.md new file mode 100644 index 0000000000..75996a754f --- /dev/null +++ b/2026/CVE-2026-53080.md @@ -0,0 +1,20 @@ +### [CVE-2026-53080](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53080) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ed76f5edccc98fa66f2337f0b3b255d6e1a568b7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net/sched: cls_fw: fix NULL dereference of "old" filters before change()Like pointed out by Sashiko [1], since commit ed76f5edccc9 ("net: sched:protect filter_chain list with filter_chain_lock mutex") TC filters areadded to a shared block and published to datapath before their ->change()function is called. This is a problem for cls_fw: an invalid filtercreated with the "old" method can still classify some packets before itis destroyed by the validation logic added by Xiang.Therefore, insisting with repeated runs of the following script: # ip link add dev crash0 type dummy # ip link set dev crash0 up # mausezahn crash0 -c 100000 -P 10 \ > -A 4.3.2.1 -B 1.2.3.4 -t udp "dp=1234" -q & # sleep 1 # tc qdisc add dev crash0 egress_block 1 clsact # tc filter add block 1 protocol ip prio 1 matchall \ > action skbedit mark 65536 continue # tc filter add block 1 protocol ip prio 2 fw # ip link del dev crash0can still make fw_classify() hit the WARN_ON() in [2]: WARNING: ./include/net/pkt_cls.h:88 at fw_classify+0x244/0x250 [cls_fw], CPU#18: mausezahn/1399 Modules linked in: cls_fw(E) act_skbedit(E) CPU: 18 UID: 0 PID: 1399 Comm: mausezahn Tainted: G E 7.0.0-rc6-virtme #17 PREEMPT(full) Tainted: [E]=UNSIGNED_MODULE Hardware name: Red Hat KVM, BIOS 1.16.3-2.el9 04/01/2014 RIP: 0010:fw_classify+0x244/0x250 [cls_fw] Code: 5c 49 c7 45 00 00 00 00 00 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 5b b8 ff ff ff ff 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 <0f> 0b 90 eb a0 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffd1b7026bf8a8 EFLAGS: 00010202 RAX: ffff8c5ac9c60800 RBX: ffff8c5ac99322c0 RCX: 0000000000000004 RDX: 0000000000000001 RSI: ffff8c5b74d7a000 RDI: ffff8c5ac8284f40 RBP: ffffd1b7026bf8d0 R08: 0000000000000000 R09: ffffd1b7026bf9b0 R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000010000 R13: ffffd1b7026bf930 R14: ffff8c5ac8284f40 R15: 0000000000000000 FS: 00007fca40c37740(0000) GS:ffff8c5b74d7a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fca40e822a0 CR3: 0000000005ca0001 CR4: 0000000000172ef0 Call Trace: <TASK> tcf_classify+0x17d/0x5c0 tc_run+0x9d/0x150 __dev_queue_xmit+0x2ab/0x14d0 ip_finish_output2+0x340/0x8f0 ip_output+0xa4/0x250 raw_sendmsg+0x147d/0x14b0 __sys_sendto+0x1cc/0x1f0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x126/0xf80 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fca40e822ba Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffc248a42c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055ef233289d0 RCX: 00007fca40e822ba RDX: 000000000000001e RSI: 000055ef23328c30 RDI: 0000000000000003 RBP: 000055ef233289d0 R08: 00007ffc248a42d0 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001e R13: 00000000000186a0 R14: 0000000000000000 R15: 00007fca41043000 </TASK> irq event stamp: 1045778 hardirqs last enabled at (1045784): [<ffffffff864ec042>] __up_console_sem+0x52/0x60 hardirqs last disabled at (1045789): [<ffffffff864ec027>] __up_console_sem+0x37/0x60 softirqs last enabled at (1045426): [<ffffffff874d48c7>] __alloc_skb+0x207/0x260 softirqs last disabled at (1045434): [<ffffffff874fe8f8>] __dev_queue_xmit+0x78/0x14d0Then, because of the value in the packet's mark, dereference on 'q->handle'with NULL 'q' occurs: BUG: kernel NULL pointer dereference, address: 0000000000000038 [...] RIP: 0010:fw_classify+0x1fe/0x250 [cls_fw] [...]Skip "old-style" classification on shared blocks, so that the NULLdereference is fixed and WARN_ON() is not hit anymore in the shortlifetime of invalid cls_fw "old-style" filters.[1] https://sashiko.dev/#/patchset/2---truncated--- + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53131.md b/2026/CVE-2026-53131.md new file mode 100644 index 0000000000..12c7b2e6d5 --- /dev/null +++ b/2026/CVE-2026-53131.md @@ -0,0 +1,20 @@ +### [CVE-2026-53131](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53131) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:netfilter: require Ethernet MAC header before using eth_hdr()`ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and`hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`after either assuming that the skb is associated with an Ethernetdevice or checking only that the `ETH_HLEN` bytes at`skb_mac_header(skb)` lie between `skb->head` and `skb->data`.Make these paths first verify that the skb is associated with anEthernet device, that the MAC header was set, and that it spans atleast a full Ethernet header before accessing `eth_hdr(skb)`. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53134.md b/2026/CVE-2026-53134.md index 6825a9d5a9..59e118385b 100644 --- a/2026/CVE-2026-53134.md +++ b/2026/CVE-2026-53134.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.10%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f6d0cbcf09c506b9b022df8f9d7693a7cec3c732%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53146.md b/2026/CVE-2026-53146.md new file mode 100644 index 0000000000..f1377ef863 --- /dev/null +++ b/2026/CVE-2026-53146.md @@ -0,0 +1,20 @@ +### [CVE-2026-53146](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53146) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=cdae7c07e3e3509eaabc18c1640a55dc5b99c179%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:thunderbolt: Limit XDomain response copy to actual frame sizetb_xdomain_copy() copies req->response_size bytes from the receivedpacket buffer regardless of the actual frame size. When a shortresponse arrives, this reads past the valid frame data in the DMApool buffer into stale contents from previous transactions.Use the minimum of frame size and expected response size for thecopy length. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53147.md b/2026/CVE-2026-53147.md new file mode 100644 index 0000000000..d26a039117 --- /dev/null +++ b/2026/CVE-2026-53147.md @@ -0,0 +1,20 @@ +### [CVE-2026-53147](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53147) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=cdae7c07e3e3509eaabc18c1640a55dc5b99c179%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:thunderbolt: Validate XDomain request packet size before type casttb_xdp_handle_request() casts the received packet buffer toprotocol-specific structs without verifying that the allocationis large enough for the target type. A peer can send a minimalXDomain packet that passes the generic header length check but isshorter than the struct accessed after the cast, causing out-of-bounds reads from the kmemdup allocation.Plumb the packet length through xdomain_request_work and validateit against the expected struct size before each cast. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53148.md b/2026/CVE-2026-53148.md new file mode 100644 index 0000000000..dff9ede38c --- /dev/null +++ b/2026/CVE-2026-53148.md @@ -0,0 +1,20 @@ +### [CVE-2026-53148](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53148) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=cdae7c07e3e3509eaabc18c1640a55dc5b99c179%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:thunderbolt: Clamp XDomain response data copy to allocation sizetb_xdp_properties_request() derives the per-packet copy length fromthe response header without checking that it fits in the previouslyallocated data buffer. A malicious peer can set its length fieldlarger than the declared data_length, causing memcpy to write pastthe kcalloc allocation.Clamp the per-packet copy length so that the cumulative offsetnever exceeds data_len. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53149.md b/2026/CVE-2026-53149.md new file mode 100644 index 0000000000..8037579831 --- /dev/null +++ b/2026/CVE-2026-53149.md @@ -0,0 +1,20 @@ +### [CVE-2026-53149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53149) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=cdae7c07e3e3509eaabc18c1640a55dc5b99c179%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:thunderbolt: Bound root directory content to block size__tb_property_parse_dir() does not check that content_offset +content_len fits within block_len for the root directory case.When rootdir->length equals or exceeds block_len - 2, the entryloop reads past the allocated property block.Add a bounds check after computing content_offset and content_lento reject directories whose content extends past the block. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53150.md b/2026/CVE-2026-53150.md new file mode 100644 index 0000000000..dbec2a51c2 --- /dev/null +++ b/2026/CVE-2026-53150.md @@ -0,0 +1,20 @@ +### [CVE-2026-53150](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53150) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=cdae7c07e3e3509eaabc18c1640a55dc5b99c179%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:thunderbolt: Reject zero-length property entries in validatortb_property_entry_valid() accepts entries with length == 0 forDIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passesvalidation but causes an underflow in the null-termination logic: property->value.text[property->length * 4 - 1] = '\0';When property->length is 0 this writes to offset -1 relative tothe allocation.Reject zero-length entries early in the validator since they have novalid representation in the XDomain property protocol. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53167.md b/2026/CVE-2026-53167.md new file mode 100644 index 0000000000..1261a2f8a7 --- /dev/null +++ b/2026/CVE-2026-53167.md @@ -0,0 +1,20 @@ +### [CVE-2026-53167](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53167) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.36%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate foliosFUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folioscan contain uninitialized data.Since FUSE_NOTIFY_RETRIEVE is intended to only return data that is alreadyin the page cache and not wait for data from the FUSE daemon, treat!uptodate folios as if they weren't present.This only has security impact on systems that don't enable automaticzero-initialization of all page allocations viaCONFIG_INIT_ON_ALLOC_DEFAULT_ON or init_on_alloc=1. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53168.md b/2026/CVE-2026-53168.md new file mode 100644 index 0000000000..7a6394b761 --- /dev/null +++ b/2026/CVE-2026-53168.md @@ -0,0 +1,20 @@ +### [CVE-2026-53168](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53168) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:fuse: reject fuse_notify() pagecache ops on directoriesThe operations FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE allow theFUSE daemon to actively write/read pagecache contents.For directories with FOPEN_CACHE_DIR, the pagecache is used askernel-internal cache storage, and userspace is not supposed to havedirect access to this cache - in particular, fuse_parse_cache() will hitWARN_ON() if the cache contains bogus data.Reject FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE on anything other thanregular files with -EINVAL. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53177.md b/2026/CVE-2026-53177.md new file mode 100644 index 0000000000..7198a35581 --- /dev/null +++ b/2026/CVE-2026-53177.md @@ -0,0 +1,20 @@ +### [CVE-2026-53177](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53177) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e5811b8c09df9bc80eabc95339fceded23f16289%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:bnxt_en: Fix NULL pointer dereferencePCIe errors detected by a Root Port or Downstream Port cause errorrecovery services to run on all subordinate devices regardless ofadministrative state.The .error_detected() callback, bnxt_io_error_detected(), disablesand synchronizes IRQs via bnxt_disable_int_sync(), which callsbnxt_cp_num_to_irq_num() to map completion rings to IRQs usingbp->bnapi.Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIeerror recovery on a closed NIC can dereference a NULL pointer.Check if bp->bnapi is NULL before disabling and synchronizing IRQs. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53181.md b/2026/CVE-2026-53181.md new file mode 100644 index 0000000000..ab70ec79fe --- /dev/null +++ b/2026/CVE-2026-53181.md @@ -0,0 +1,20 @@ +### [CVE-2026-53181](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53181) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=d021c344051af91f42c5ba9fdedc176740cbd238%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:vsock/vmci: fix sk_ack_backlog leak on failed handshakeWhen vmci_transport_recv_connecting_server() returns an error,vmci_transport_recv_listen() calls vsock_remove_pending() but nevercalls sk_acceptq_removed(). This leaves sk_ack_backlog incrementedpermanently.Repeated handshake failures (malformed packets, queue pair allocfailure, event subscribe failure) cause sk_ack_backlog to climbtoward sk_max_ack_backlog. Once it reaches the limit the listenerpermanently refuses all new connections with -ECONNREFUSED, asilent denial of service requiring a process restart to recover.The two existing sk_acceptq_removed() calls in af_vsock.c do notcover this path: line 764 checks vsock_is_pending() which returnsfalse after vsock_remove_pending(), and line 1889 is only reachedon successful accept().Fix by balancing sk_acceptq_added() with sk_acceptq_removed() onthe error path. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53183.md b/2026/CVE-2026-53183.md new file mode 100644 index 0000000000..657a3e5d39 --- /dev/null +++ b/2026/CVE-2026-53183.md @@ -0,0 +1,20 @@ +### [CVE-2026-53183](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53183) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f3589be0c420a3137e5902d15705ced6a36f3f43%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:mptcp: allow subflow rcv wnd to shrinkIn MPTCP connection, the `window` field in the TCP header refers to theMPTCP-level rcv_nxt and it's right edge should not move backward. Suchconstraint is enforced at DSS option generation time.At the same time, the TCP stack ensures independently that the TCP-levelrcv wnd right's edge does not move backward. That in turn causes artificialinflating of the MPTCP rcv window when the incoming data is acked at theTCP level and is OoO in the MPTCP sequence space (or lands in the backlog).As a consequence, the incoming traffic can exceed the receiver rcvbuf sizeeven when the sender is not misbehaving.Prevent such scenario forcibly allowing the TCP subflow to shrink theTCP-level rcv wnd regardless of the current netns setting. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53184.md b/2026/CVE-2026-53184.md new file mode 100644 index 0000000000..2f6869a9d2 --- /dev/null +++ b/2026/CVE-2026-53184.md @@ -0,0 +1,20 @@ +### [CVE-2026-53184](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53184) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=965b57b469a589d64d81b1688b38dcb537011bb0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:udp: clear skb->dev before running a sockmap verdictOn the UDP receive path skb->dev is repurposed as dev_scratch (thetruesize/state cache set by udp_set_dev_scratch()), through theunion { struct net_device *dev; unsigned long dev_scratch; } in sk_buff.When a UDP socket is in a sockmap, sk_data_ready issk_psock_verdict_data_ready(), which calls udp_read_skb() -> recv_actor()(sk_psock_verdict_recv) to run the attached SK_SKB verdict program in softirq.If that program calls a socket-lookup helper (bpf_sk_lookup_tcp/udp,bpf_skc_lookup_tcp), bpf_skc_lookup() does: if (skb->dev) caller_net = dev_net(skb->dev);skb->dev still holds the dev_scratch value (a non-NULL integer), so dev_net()dereferences it as a struct net_device * and the kernel takes a generalprotection fault on a non-canonical address in softirq: Oops: general protection fault, probably for non-canonical address 0x1010000800004a0 CPU: 1 UID: 0 PID: 1406 Comm: syz.2.19 Not tainted 7.1.0-rc6 #1 PREEMPT(full) RIP: 0010:bpf_skc_lookup net/core/filter.c:7033 [inline] RIP: 0010:bpf_sk_lookup+0x45/0x160 net/core/filter.c:7047 Call Trace: <IRQ> bpf_prog_4675cb904b7071f8+0x12e/0x14e bpf_prog_run_pin_on_cpu+0xc6/0x1f0 sk_psock_verdict_recv+0x1ba/0x350 udp_read_skb+0x31a/0x370 sk_psock_verdict_data_ready+0x2e3/0x600 __udp_enqueue_schedule_skb+0x4c8/0x650 udpv6_queue_rcv_one_skb+0x3ec/0x740 udp6_unicast_rcv_skb+0x11d/0x140 ip6_protocol_deliver_rcu+0x61e/0x950 ip6_input_finish+0xa9/0x150 NF_HOOK+0x286/0x2f0 ip6_input+0x117/0x220 NF_HOOK+0x286/0x2f0 __netif_receive_skb+0x85/0x200 process_backlog+0x374/0x9a0 __napi_poll+0x4f/0x1c0 net_rx_action+0x3b0/0x770 handle_softirqs+0x15a/0x460 do_softirq+0x57/0x80 </IRQ>The rmem charge that dev_scratch accounted for is released by skb_recv_udp() ondequeue, just above, so the scratch is dead by the time recv_actor() runs. Clearskb->dev so bpf_skc_lookup() falls back to sock_net(skb->sk), whichskb_set_owner_sk_safe() set just above. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53192.md b/2026/CVE-2026-53192.md new file mode 100644 index 0000000000..a0ce7ddf5e --- /dev/null +++ b/2026/CVE-2026-53192.md @@ -0,0 +1,20 @@ +### [CVE-2026-53192](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53192) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=37745918e0e7575bc40f38da93a99b9fa6406224%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ALSA: timer: Fix UAF at snd_timer_user_params()At releasing a timer object, e.g. when a userspace timer(CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, ittries to detach the timer instances and release the resources.However, it's still possible that other in-flight tasks are holdingthe timer instance where the to-be-deleted timer object is associated,and this may lead to racy accesses.Fortunately, most of ioctls dealing with the timer instance listalready have the protection with register_mutex, and this also avoidssuch races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence theconcurrent ioctl may lead to use-after-free.This patch just adds the guard with register_mutex to protectsnd_timer_user_params() for covering the code path as a quickworkaround. It's no hot-path but rather a rarely issued ioctl, so theperformance penalty doesn't matter. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53198.md b/2026/CVE-2026-53198.md new file mode 100644 index 0000000000..061e97f635 --- /dev/null +++ b/2026/CVE-2026-53198.md @@ -0,0 +1,20 @@ +### [CVE-2026-53198](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53198) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCELA deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work onconn->async_requests via setup_async_work(), with cancel_fn =smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock.When the request is cancelled, the worker frees the file_lock withlocks_free_lock() and takes the cancelled early-exit, which "goto out"s and neverreaches release_async_work() -- the only site that unlinks the work fromconn->async_requests and clears cancel_fn/cancel_argv. The work therefore staysmatchable on async_requests with a live cancel_fn pointing at the freed file_lock,until connection teardown finally runs release_async_work().smb2_cancel() fires cancel_fn unconditionally with no state guard, so a secondSMB2_CANCEL for the same AsyncId, arriving in that window, re-runssmb2_remove_blocked_lock() on the freed file_lock -- a slab use-after-free: BUG: KASAN: slab-use-after-free in __locks_delete_block __locks_delete_block locks_delete_block ksmbd_vfs_posix_lock_unblock smb2_remove_blocked_lock smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn handle_ksmbd_work Allocated by ...: locks_alloc_lock <- smb2_lock Freed by ...: locks_free_lock <- smb2_lock (cancelled branch) ... cache file_lock_cache of size 192Reproduced on mainline with KASAN by an authenticated SMB client.Skip a work whose state is already KSMBD_WORK_CANCELLED so its cancel callbackcannot be fired a second time. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53208.md b/2026/CVE-2026-53208.md new file mode 100644 index 0000000000..b57b9ce999 --- /dev/null +++ b/2026/CVE-2026-53208.md @@ -0,0 +1,20 @@ +### [CVE-2026-53208](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53208) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsignet/bluetooth/l2cap_core.c:l2cap_sig_channel() accepts BR/EDRsignaling packets up to the channel MTU and dispatches each commandwithout enforcing the signaling MTU (MTUsig). A Bluetooth BR/EDR peerwithin radio range can send a fixed-channel CID 0x0001 packet that islarger than MTUsig and contains many L2CAP_ECHO_REQ commands beforepairing. In a real-radio stock-kernel run, one 681-byte signalingpacket containing 168 zero-length ECHO_REQ commands made the targettransmit 168 ECHO_RSP frames over about 220 ms.Impact: a Bluetooth BR/EDR peer within radio range, before pairing, canforce 168 ECHO_RSP frames from one 681-byte fixed-channel signalingpacket containing packed ECHO_REQ commands.Define Linux's BR/EDR signaling MTU as the spec minimum of 48 bytes andreject any larger signaling packet with one L2CAP_COMMAND_REJECT_RSPcarrying L2CAP_REJ_MTU_EXCEEDED before any command is dispatched.The Bluetooth Core spec wording for MTUExceeded says the rejectidentifier shall match the first request command in the packet, andthat packets containing only responses shall be silently discarded.Linux intentionally deviates from that prescription: silentlydiscarding desynchronizes the peer because the remote stack neverlearns its responses were dropped, and locating the first requestcommand requires walking command headers past MTUsig, i.e. processingbytes from a packet we have already decided is too large to process.We therefore always emit one reject and use the identifier from thefirst command header, a single fixed-offset byte read.The unrestricted BR/EDR signaling parser and ECHO_REQ response path bothtrace to the initial git import; no later introducing commit isavailable for a Fixes tag. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53212.md b/2026/CVE-2026-53212.md new file mode 100644 index 0000000000..0907277a9a --- /dev/null +++ b/2026/CVE-2026-53212.md @@ -0,0 +1,20 @@ +### [CVE-2026-53212](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53212) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=af308b94a2a4a5a27bec9028354c4df444a7c8ba%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:netfilter: nft_tunnel: fix use-after-free on object destroynft_tunnel_obj_destroy() calls metadata_dst_free() which directlykfree()s the metadata_dst, ignoring the dst_entry refcount. Packetsthat took a reference via dst_hold() in nft_tunnel_obj_eval() andare still queued (e.g. in a netem qdisc) are left with a danglingpointer. When these packets are eventually dequeued, dst_release()operates on freed memory.Replace metadata_dst_free() with dst_release() so the metadata_dstis freed only after all references are dropped. The dst subsystemalready handles metadata_dst cleanup in dst_destroy() whenDST_METADATA is set. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53218.md b/2026/CVE-2026-53218.md index d0657653c9..2bb404b85c 100644 --- a/2026/CVE-2026-53218.md +++ b/2026/CVE-2026-53218.md @@ -1,8 +1,10 @@ ### [CVE-2026-53218](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53218) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53219.md b/2026/CVE-2026-53219.md index 137b3b2318..fb6c78802b 100644 --- a/2026/CVE-2026-53219.md +++ b/2026/CVE-2026-53219.md @@ -1,9 +1,11 @@ ### [CVE-2026-53219](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53219) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=71ae0dff02d756e4d2ca710b79f2ff5390029a5f%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: x_ #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53221.md b/2026/CVE-2026-53221.md new file mode 100644 index 0000000000..c70b222cb0 --- /dev/null +++ b/2026/CVE-2026-53221.md @@ -0,0 +1,20 @@ +### [CVE-2026-53221](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53221) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=fbe68ee87522f6eaa10f9076c0a7117e1613f2f7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()In vti6_tnl_lookup(), when an exact match for a tunnel fails,the code falls back to searching for wildcard tunnels:- Tunnels matching the packet's local address, with any remote address wildcard remote).- Tunnels matching the packet's remote address, with any local address (wildcard local).However, vti6 stores all these different types of tunnels in the samehash table (ip6n->tnls_r_l) prone to hash collisions.The bug is that the fallback search loops in vti6_tnl_lookup() weremissing checks to ensure that the candidate tunnel actually hasa wildcard address. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53223.md b/2026/CVE-2026-53223.md index 617e255cdd..165cfaebc9 100644 --- a/2026/CVE-2026-53223.md +++ b/2026/CVE-2026-53223.md @@ -5,6 +5,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=4.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=8605330aac5a5785630aec8f64378a54891937cc%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=cdaf15b43bd31003220cb080bcbbd57787a2fca9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -16,6 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: guard ti #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53225.md b/2026/CVE-2026-53225.md new file mode 100644 index 0000000000..554791d65d --- /dev/null +++ b/2026/CVE-2026-53225.md @@ -0,0 +1,20 @@ +### [CVE-2026-53225](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53225) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.25%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=df21857714398acb8b24a8bb5a6d2286dd9c59ef%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:sctp: fix uninit-value in __sctp_rcv_asconf_lookup()__sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONFchunk can hold the ADDIP header and a parameter header, then callsaf->from_addr_param(), which reads the full address (16 bytes for IPv6)trusting the parameter's declared length.An unauthenticated peer can send a truncated trailing ASCONF chunk thatdeclares an IPv6 address parameter but stops after the 4-byte parameterheader; reached from the no-association lookup path, from_addr_param() thenreads uninitialized bytes past the parameter.Impact: an unauthenticated SCTP peer makes the receive path read up to 16bytes of uninitialized memory past a truncated ASCONF address parameter.The sibling __sctp_rcv_init_lookup() bounds parameters withsctp_walk_params(); this path open-codes the fetch and omits the bound.Verify the whole address parameter lies within the chunk beforefrom_addr_param() reads it, the same class of fix as commit 51e5ad549c43("net: sctp: fix KMSAN uninit-value in sctp_inq_pop"). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53227.md b/2026/CVE-2026-53227.md new file mode 100644 index 0000000000..e420048247 --- /dev/null +++ b/2026/CVE-2026-53227.md @@ -0,0 +1,20 @@ +### [CVE-2026-53227](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53227) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=893f139b9a6c00c097b9082a90f3041cfb3a0d20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: openvswitch: fix possible kfree_skb of ERR_PTRAfter the patch in the "Fixes" tag, the allocation of the "reply" skbcan happen either before or after locking the ovs_mutex.However, error cleanups still follow the classical reversed order,assuming "reply" is allocated before locking: it is freed after unlocking.If "reply" allocation happens after locking the mutex and it fails,"reply" is left with an ERR_PTR, and execution jumps to the correspondentcleanup stage which will try to free an invalid pointer.Fix this by setting the pointer to NULL after having saved its errorvalue. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53228.md b/2026/CVE-2026-53228.md new file mode 100644 index 0000000000..fb7fa07333 --- /dev/null +++ b/2026/CVE-2026-53228.md @@ -0,0 +1,20 @@ +### [CVE-2026-53228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53228) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14909664e4e192f4c6f6fcdccd9919af7cf783ab%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ipv6: sit: reload inner IPv6 header after GSO offloadsipip6_tunnel_xmit() caches the inner IPv6 header pointer at functionentry and continues using it after iptunnel_handle_offloads().For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().When the skb header is cloned, skb_header_unclone() can callpskb_expand_head(), which may move the skb head. The pskb_expand_head()contract requires pointers into the skb header to be reloaded after thecall.If the later skb_realloc_headroom() branch is not taken, SIT uses thestale iph6 pointer to read the inner hop limit and DS field. That canread from a freed skb head after the old head's remaining clone isreleased.Reload iph6 after the offload helper succeeds and before subsequentreads from the inner IPv6 header. Keep the existing reload afterskb_realloc_headroom(), since that branch can also replace the skb. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53236.md b/2026/CVE-2026-53236.md index 8c273f12e8..a435f90f3d 100644 --- a/2026/CVE-2026-53236.md +++ b/2026/CVE-2026-53236.md @@ -1,9 +1,11 @@ ### [CVE-2026-53236](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53236) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:tcp: restrict #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53239.md b/2026/CVE-2026-53239.md index 5163323931..851d85d1eb 100644 --- a/2026/CVE-2026-53239.md +++ b/2026/CVE-2026-53239.md @@ -1,9 +1,11 @@ ### [CVE-2026-53239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53239) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6be3b0db6db82cf056a72cc18042048edd27f8ee%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:xfrm: policy: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53242.md b/2026/CVE-2026-53242.md new file mode 100644 index 0000000000..9635fb0cc0 --- /dev/null +++ b/2026/CVE-2026-53242.md @@ -0,0 +1,33 @@ +### [CVE-2026-53242](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53242) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4a758e9a1f5ed722f83c4dd35f867fe811553bcb%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.253%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.167%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.12.78%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.18.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.19.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.6.130%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=629cf09464cf98670996ea5c191dc9743e6f3f00%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9baee36e8c5443411c4629afabafaff8a46a23fd%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f2cb2e0d27fb925c73a78f0ce7d6dbf68d3747c1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=fc71f888994569f87d5bee20b1ac6c9c1e3a7a79%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streamssnd_pcm_drain() uses init_waitqueue_entry which does not clearentry.prev/next, and add_wait_queue with a conditionalremove_wait_queue that is skipped when to_check is no longerin the group after concurrent UNLINK. The orphaned wait entryremains on the unlinked substream sleep queue. On the nextdrain iteration, add_wait_queue adds the entry to a new queuewhile still linked on the old one, corrupting both lists. Asubsequent wake_up dereferences NULL at the func pointer(mapped from the spinlock at offset 0 of the misinterpretedwait_queue_head_t), causing a kernel panic.Replace init_waitqueue_entry/add_wait_queue/conditionalremove_wait_queue with init_wait_entry/prepare_to_wait/finish_wait. init_wait_entry clears prev/next viaINIT_LIST_HEAD on each iteration and setsautoremove_wake_function which auto-removes the entry onwake-up. finish_wait safely handles both the already-removedand still-queued cases. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53245.md b/2026/CVE-2026-53245.md new file mode 100644 index 0000000000..c224eedd1f --- /dev/null +++ b/2026/CVE-2026-53245.md @@ -0,0 +1,20 @@ +### [CVE-2026-53245](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53245) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=febf018d22347b5df94066bca05d0c11a84e839d%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattrIn mrp_pdu_parse_vecattr(), vector attribute events are encoded threeper byte and valen tracks the number of events left to process.The parser decrements valen after processing the first and second eventsfrom each event byte, but not after processing the third one. When valenis exactly a multiple of three, the loop continues after the last validevent and consumes the next byte as a new event byte, applying aspurious event to the MRP applicant state.Additionally, when valen is zero the parser unconditionally consumesattrlen bytes as FirstValue and advances the offset, even though perIEEE 802.1ak a VectorAttribute with only a LeaveAllEvent has valen ofzero and no FirstValue or Vector fields. This corrupts the offset forsubsequent PDU parsing.Also, when valen exceeds three the loop crosses byte boundaries butthe attribute value is not incremented between the last event of onebyte and the first event of the next. This causes the first event ofthe next byte to use the same attribute value as the third eventrather than the next consecutive value.Decrement valen after processing the third event, skip FirstValueconsumption when valen is zero, and increment the attribute value atthe end of each loop iteration. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53249.md b/2026/CVE-2026-53249.md index ddb8c576ef..7eeb776ca6 100644 --- a/2026/CVE-2026-53249.md +++ b/2026/CVE-2026-53249.md @@ -1,9 +1,11 @@ ### [CVE-2026-53249](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53249) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:ipv4: restric #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53253.md b/2026/CVE-2026-53253.md new file mode 100644 index 0000000000..f595b33072 --- /dev/null +++ b/2026/CVE-2026-53253.md @@ -0,0 +1,20 @@ +### [CVE-2026-53253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53253) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: bnep: reject short frames before parsingA BNEP peer can send a short BNEP SDU. bnep_rx_frame() reads thepacket type byte immediately and, for control packets, reads the controlopcode and setup UUID-size byte before proving that those bytes arepresent. bnep_rx_control() also dereferences the control opcode withoutrejecting an empty control payload.Use skb_pull_data() for the fixed fields in bnep_rx_frame() so a NULLreturn gates each dereference. Split the control handler so the framepath can pass an opcode that has already been pulled, and keep thebyte-buffer wrapper for extension control payloads.For BNEP_SETUP_CONN_REQ, name the UUID-size byte before pulling thesetup payload. struct bnep_setup_conn_req carries destination and sourceservice UUIDs after that byte, each uuid_size bytes, so the parser nowdocuments that tuple explicitly instead of leaving the pull length as anopaque multiplication.Validation reproduced this kernel report:KASAN slab-out-of-bounds in bnep_rx_frame.isra.0+0x130c/0x1790The buggy address belongs to the object at ffff88800c0f7908 which belongsto the cache kmalloc-8 of size 8The buggy address is located 0 bytes to the right of allocated 1-byteregion [ffff88800c0f7908, ffff88800c0f7909)Read of size 1Call trace: dump_stack_lvl+0xb3/0x140 (?:?) print_address_description+0x57/0x3a0 (?:?) bnep_rx_frame+0x130c/0x1790 (net/bluetooth/bnep/core.c:306) print_report+0xb9/0x2b0 (?:?) __virt_addr_valid+0x1ba/0x3a0 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) kasan_addr_to_slab+0x21/0x60 (?:?) kasan_report+0xe0/0x110 (?:?) process_one_work+0xfce/0x17e0 (kernel/workqueue.c:3200) worker_thread+0x65c/0xe40 (?:?) __kthread_parkme+0x184/0x230 (?:?) kthread+0x35e/0x470 (?:?) _raw_spin_unlock_irq+0x28/0x50 (?:?) ret_from_fork+0x586/0x870 (?:?) __switch_to+0x74f/0xdc0 (?:?) ret_from_fork_asm+0x1a/0x30 (?:?) + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53254.md b/2026/CVE-2026-53254.md new file mode 100644 index 0000000000..ffb4036ac4 --- /dev/null +++ b/2026/CVE-2026-53254.md @@ -0,0 +1,20 @@ +### [CVE-2026-53254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53254) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: RFCOMM: validate skb length in MCC handlersThe RFCOMM MCC handlers cast skb->data to protocol-specific structswithout validating skb->len first. A malicious remote device can sendtruncated MCC frames and trigger out-of-bounds reads in these handlers.Fix this by using skb_pull_data() to validate and access the requireddata before dereferencing it.rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows1-byte RPN requests. Handle this by validating only the DLCI byte first,and validating the full struct only when len > 1. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53255.md b/2026/CVE-2026-53255.md new file mode 100644 index 0000000000..ca823b8e02 --- /dev/null +++ b/2026/CVE-2026-53255.md @@ -0,0 +1,20 @@ +### [CVE-2026-53255](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53255) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2bb36870e8cb29949ef9acec37129cd8e70f1857%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: MGMT: validate advertising TLV before type checkstlv_data_is_valid() reads each advertising data field length fromdata[i], then inspects data[i + 1] for managed EIR types beforechecking that the current field still fits inside the supplied buffer.A malformed field whose length byte is the last byte of the buffer cantherefore make the parser read one byte past the advertising data.KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISINGrequest reached that path: BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid() Read of size 1 Call trace: tlv_data_is_valid() add_advertising() hci_mgmt_cmd() hci_sock_sendmsg()Move the existing element-length check before any type-octet inspectionso each non-empty element is proven to contain its type byte before theparser looks at data[i + 1]. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53256.md b/2026/CVE-2026-53256.md new file mode 100644 index 0000000000..7dd15cd6ea --- /dev/null +++ b/2026/CVE-2026-53256.md @@ -0,0 +1,20 @@ +### [CVE-2026-53256](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53256) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock,but returns the selected listener after dropping that lock withouttaking a reference. rfcomm_connect_ind() then locks the listener,queues a child socket on it, and may notify it after unlocking it.The buggy scenario involves two paths, with each column showing theorder within that path:rfcomm_connect_ind(): listener close: 1. Find parent in 1. close() enters rfcomm_get_sock_by_channel() rfcomm_sock_release(). 2. Drop rfcomm_sk_list.lock 2. rfcomm_sock_shutdown() without pinning parent. closes the listener. 3. Call lock_sock(parent) and 3. rfcomm_sock_kill() bt_accept_enqueue(parent, unlinks and puts parent. sk, true). 4. Read parent flags and may 4. parent can be freed. call sk_state_change().If close wins the race, parent can be freed beforerfcomm_connect_ind() reaches lock_sock(), bt_accept_enqueue(), or thedeferred-setup callback.Take a reference on the listener before leaving rfcomm_sk_list.lock.After lock_sock() succeeds, recheck that it is still in BT_LISTENbefore queueing a child, cache the deferred-setup bit while the parentis locked, and drop the reference after the last parent use.KASAN reported a slab-use-after-free in lock_sock_nested() fromrfcomm_connect_ind(), with the freeing stack going throughrfcomm_sock_kill() and rfcomm_sock_release(). + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53263.md b/2026/CVE-2026-53263.md new file mode 100644 index 0000000000..53602e0132 --- /dev/null +++ b/2026/CVE-2026-53263.md @@ -0,0 +1,20 @@ +### [CVE-2026-53263](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53263) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5609c185f24dffca5f6a9c127106869da150be03%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:6lowpan: fix off-by-one in multicast context address compressionThe second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses&data[1] as destination and &ipaddr->s6_addr[11] as source, butboth should be offset by one: &data[2] and &ipaddr->s6_addr[12]respectively.This off-by-one has two consequences:1. data[1] is overwritten with s6_addr[11], corrupting the RIID field in the compressed multicast address2. data[5] is never written, so uninitialized kernel stack memory is transmitted over the network via lowpan_push_hc_data(), leaking kernel stack contentsThe correct inline data layout must match what the decompressionfunction lowpan_uncompress_multicast_ctx_daddr() expects: data[0..1] = s6_addr[1..2] (flags/scope + RIID) data[2..5] = s6_addr[12..15] (group ID)Also zero-initialize the data array as a defensive measure againstsimilar bugs in the future. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53264.md b/2026/CVE-2026-53264.md index aa9b0a10d0..e5855ac6fe 100644 --- a/2026/CVE-2026-53264.md +++ b/2026/CVE-2026-53264.md @@ -1,6 +1,7 @@ ### [CVE-2026-53264](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53264) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.14%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -12,6 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: ac ### POC #### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html - https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/ #### Github diff --git a/2026/CVE-2026-53265.md b/2026/CVE-2026-53265.md new file mode 100644 index 0000000000..d451908752 --- /dev/null +++ b/2026/CVE-2026-53265.md @@ -0,0 +1,32 @@ +### [CVE-2026-53265](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53265) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1b2bec4a7dcf5f00b7a1cbeeec8997841d783513%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2b62d0611c9af14a16bddf22df2612b4f40eb5a1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4991b5a08751e2e82488fb93ae08849b6aea10d9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.10.258%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.15.209%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.1.175%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.12.91%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.18.33%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.6.141%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7.0.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=93627a29d4b66d4a2def938dfb8610cc80ae454b%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=ac5ee99443891bdb161f5539606a66a1b5e72542%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c348ae47d8e65f06429fa41adce9ad986b696766%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:dm cache policy smq: check allocation under invalidate lockcommit 2d1f7b65f5de ("dm cache policy smq: fix missing locks ininvalidating cache blocks") added mq->lock around the destructive part ofsmq_invalidate_mapping(), but left the e->allocated check outside thecritical section.That leaves a check-then-act race. Two concurrent invalidators can bothobserve e->allocated as true before either of them takes mq->lock. Thefirst invalidator that acquires the lock removes the entry from thequeues and hash table and then calls free_entry(), which clearse->allocated and puts the entry back on the free list. The secondinvalidator can then acquire mq->lock and continue with the stale resultof the unlocked check.This can corrupt the SMQ queues or hash table by deleting an entry thatis no longer on those structures. It can also hit the allocation check infree_entry() when the same entry is freed again.Move the allocation check under mq->lock so the predicate and thedestructive operations are serialized by the same lock. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53268.md b/2026/CVE-2026-53268.md index f0f7a2456e..63cade72fb 100644 --- a/2026/CVE-2026-53268.md +++ b/2026/CVE-2026-53268.md @@ -1,9 +1,11 @@ ### [CVE-2026-53268](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53268) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.20%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=869f37d8e48f3911eb70f38a994feaa8f8380008%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: co #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53269.md b/2026/CVE-2026-53269.md index 1ca2867c38..37c30dd053 100644 --- a/2026/CVE-2026-53269.md +++ b/2026/CVE-2026-53269.md @@ -1,8 +1,10 @@ ### [CVE-2026-53269](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53269) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=ad49d86e07a497e834cb06f2b151dccd75f8e148%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: sy #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53275.md b/2026/CVE-2026-53275.md index 3411ef2378..597b4355d7 100644 --- a/2026/CVE-2026-53275.md +++ b/2026/CVE-2026-53275.md @@ -1,9 +1,11 @@ ### [CVE-2026-53275](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53275) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=97300b5fdfe28c6edae926926f9467a27cf5889c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: mcast: #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53295.md b/2026/CVE-2026-53295.md index e6124936cb..870a1d45e1 100644 --- a/2026/CVE-2026-53295.md +++ b/2026/CVE-2026-53295.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2b6d83e2b8b7de82331a6a1dcd64b51020a6031c%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:mailbox: add #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53325.md b/2026/CVE-2026-53325.md new file mode 100644 index 0000000000..8c88f59bdf --- /dev/null +++ b/2026/CVE-2026-53325.md @@ -0,0 +1,20 @@ +### [CVE-2026-53325](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53325) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=a32073bffc656ca4bde6002b6cf7c1a8e0e22712%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:agp/amd64: Fix broken error propagation in agp_amd64_probe()A NULL pointer dereference was observed in the AMD64 AGP driver whenrunning in a virtualized environment (e.g. qemu/kvm) without a physicalAMD northbridge. The crash occurs in amd64_fetch_size() when attemptingto dereference the pointer returned by node_to_amd_nb(0).The root cause of this crash is broken error propagation inagp_amd64_probe(): When no AMD northbridges are found, cache_nbs()correctly returns -ENODEV. However, the probe function erroneouslychecks the return value against exactly -1, rather than < 0.As a result, the hardware absence error is masked, allowing the driverto improperly proceed with initialization. It eventually callsagp_add_bridge(), which invokes amd64_fetch_size(). Since the hardwaredoes not exist, node_to_amd_nb(0) returns NULL, leading to a GeneralProtection Fault (GPF) when accessing its ->misc member.Fix the issue by correcting the error check in agp_amd64_probe() toabort properly when cache_nbs() returns any negative error code. Thisprevents the driver from erroneously proceeding without hardware, therebyavoiding the subsequent NULL pointer dereference at its source. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53337.md b/2026/CVE-2026-53337.md new file mode 100644 index 0000000000..c99b03ef36 --- /dev/null +++ b/2026/CVE-2026-53337.md @@ -0,0 +1,20 @@ +### [CVE-2026-53337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53337) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=e2a7420df2e01370b40e4cf7b85ab9a885c6d755%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:net: bonding: fix NULL pointer dereference in bond_do_ioctl()In bond_do_ioctl(), slave_dev is obtained via __dev_get_by_name() whichcan return NULL if the requested interface name does not exist. However,the subsequent slave_dbg() call is placed before the NULL check: slave_dev = __dev_get_by_name(net, ifr->ifr_slave); slave_dbg(bond_dev, slave_dev, "slave_dev=%p:\n", slave_dev); //here if (!slave_dev) return -ENODEV;The slave_dbg() macro expands to netdev_dbg(bond_dev, "(slave %s): " fmt,(slave_dev)->name, ...) which unconditionally dereferences slave_dev->namebefore the NULL check is performed. This results in a NULL pointerdereference kernel oops when a user calls bonding ioctl (e.g.SIOCBONDENSLAVE, SIOCBONDRELEASE, etc.) with a non-existent slaveinterface name.This is reachable from userspace via the bonding ioctl interface withCAP_NET_ADMIN capability, making it a potential local denial-of-servicevector.Fix by moving the slave_dbg() call after the NULL check. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53349.md b/2026/CVE-2026-53349.md new file mode 100644 index 0000000000..32bd206a0a --- /dev/null +++ b/2026/CVE-2026-53349.md @@ -0,0 +1,20 @@ +### [CVE-2026-53349](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53349) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.6.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:netfilter: nf_conntrack: destroy stale expectfn expectations on unregisterNAT helpers such as nf_nat_h323 store a raw pointer to module text inexp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()only unlinks the callback descriptor and never walks the expectation table,so an expectation pending at module removal survives with a danglingexp->expectfn into freed module text.When the expected connection arrives, init_conntrack() invokesexp->expectfn(), now a stale pointer into the unloaded module. Reproducedon a KASAN build by loading the H.323 helpers, creating a Q.931expectation, unloading nf_nat_h323, then connecting to the expected port: Oops: int3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d1 init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) __ip_local_out (net/ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_output.c:1715) tcp_connect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/ipv4/tcp_ipv4.c:345) __sys_connect (net/socket.c:2167) Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]Reaching the dangling state requires CAP_SYS_MODULE in the initial usernamespace to remove a NAT helper that still has live expectations, so thisis a robustness fix; leaving an expectation pointing at freed text is wrongregardless.Add nf_ct_helper_expectfn_destroy(), which walks the expectation table anddrops every expectation whose ->expectfn matches the descriptor being torndown. Call it from each NAT helper's exit path after the existing RCU graceperiod, so no expectation outlives the code it points at and no extrasynchronize_rcu() is introduced. With the fix, the same reproducer runs tocompletion without the Oops. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53350.md b/2026/CVE-2026-53350.md new file mode 100644 index 0000000000..76a4c5dc1e --- /dev/null +++ b/2026/CVE-2026-53350.md @@ -0,0 +1,20 @@ +### [CVE-2026-53350](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53350) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0700bc2fb94c28459f57a10d2ee2c7ef4cb70862%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ASoC: wm_adsp: Fix NULL dereference when removing firmware controlsIn wm_adsp_control_remove() check that the priv pointer is not NULLbefore attempting to cleanup what it points to.When cs_dsp creates a control it calls wm_adsp_control_add_cb() so thatwm_adsp can create its own private control data. There are two caseswhere private data is not created:1. The control is a SYSTEM control, so an ALSA control is not created.2. The codec driver has registered a control_add() callback that hides the control, so wm_adsp_control_add() is not called.When cs_dsp_remove destroys its control list it callswm_adsp_control_remove() for each control. But wm_adsp_control_remove()was attempting to cleanup the private data pointed to by cs_ctl->privwithout checking the pointer for NULL. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53352.md b/2026/CVE-2026-53352.md index 0fef4d770c..a7e68722c6 100644 --- a/2026/CVE-2026-53352.md +++ b/2026/CVE-2026-53352.md @@ -1,9 +1,11 @@ ### [CVE-2026-53352](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53352) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=39efa3ef3a376a4e53de2f82fc91182459d34200%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:signal: clear #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-53356.md b/2026/CVE-2026-53356.md new file mode 100644 index 0000000000..90b3d0930b --- /dev/null +++ b/2026/CVE-2026-53356.md @@ -0,0 +1,20 @@ +### [CVE-2026-53356](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=c6790dc22312f592c1434577258b31c48c72d52a%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:drm/i915/gem: Fix phys BO pread/pwrite with offsetsg_page() returns struct page pointer not (void *) so the scalingof pread/pwrite is wrong for phys BO and wrong parts of BO would beaccessed if non-zero offset is used.Last impacted platform with overlay or cursor planes using physmapping was Gen3/945G/Lakeport.(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6) + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53358.md b/2026/CVE-2026-53358.md new file mode 100644 index 0000000000..8bba9d64b3 --- /dev/null +++ b/2026/CVE-2026-53358.md @@ -0,0 +1,20 @@ +### [CVE-2026-53358](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53358) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3df91ea20e744344100b10ae69a17211fcf5b207%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()l2cap_chan_close() removes the channel from conn->chan_l, whichmust be done under conn->lock. cleanup_listen() runs under theparent sk_lock, so acquiring conn->lock would invert theestablished conn->lock -> chan->lock -> sk_lock order.Instead of calling l2cap_chan_close() directly, schedulel2cap_chan_timeout with delay 0 to close the channelasynchronously. The timeout handler already acquires conn->lockand chan->lock in the correct order.The timer is only armed when chan->conn is still set: if it isalready NULL, l2cap_conn_del() has already processed this channel(l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb),so there is nothing left to do. If l2cap_conn_del() races inafter the timer is armed, __clear_chan_timer() insidel2cap_chan_del() cancels it; if the timer has already fired, thehandler returns harmlessly because chan->conn was cleared. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53362.md b/2026/CVE-2026-53362.md new file mode 100644 index 0000000000..d1cd220d4f --- /dev/null +++ b/2026/CVE-2026-53362.md @@ -0,0 +1,20 @@ +### [CVE-2026-53362](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53362) +![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=773ba4fe9104a64a54d1c00f0fb6ffb95def2b03%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +In the Linux kernel, the following vulnerability has been resolved:ipv6: account for fraggap on the paged allocation pathIn __ip6_append_data(), when the paged-allocation branch is taken(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen arecomputed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen;datalen already includes fraggap (datalen = length + fraggap). Whenfraggap is non-zero, this is not the first skb and transhdrlen is zero.The fraggap bytes carried over from the previous skb are copied just pastthe fragment headers in the new skb's linear area. The linear area istherefore undersized by fraggap bytes while pagedlen is overstated by thesame amount, and the copy writes past skb->end into the trailingskb_shared_info.An unprivileged user can trigger this via a UDPv6 socket usingMSG_MORE together with MSG_SPLICE_PAGES.The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negativecopy value caused -EINVAL to be returned. That later commit allowedMSG_SPLICE_PAGES to proceed in this case, making the corruptiontriggerable.The non-paged branch sets alloclen to fraglen, which already accountsfor fraggap because datalen does. Bring the paged branch in line byadding fraggap to alloclen and subtracting it from pagedlen.After this adjustment, copy no longer collapses to -fraggap on thepaged path, so remove the stale comment describing that old arithmetic.Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGEScase, remove the MSG_SPLICE_PAGES exception from the negative copy check. + +### POC + +#### Reference +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-53400.md b/2026/CVE-2026-53400.md index 5d636f43c3..d6a6fde3a3 100644 --- a/2026/CVE-2026-53400.md +++ b/2026/CVE-2026-53400.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.22%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6e13e641841833cc2aa5baefe89bb04bc388801b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:i2c: core: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-55174.md b/2026/CVE-2026-55174.md new file mode 100644 index 0000000000..6aeffcc133 --- /dev/null +++ b/2026/CVE-2026-55174.md @@ -0,0 +1,19 @@ +### [CVE-2026-55174](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55174) +![](https://img.shields.io/static/v1?label=Product&message=UltrafastSecp256k1&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-345%3A%20Insufficient%20Verification%20of%20Data%20Authenticity&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-347%3A%20Improper%20Verification%20of%20Cryptographic%20Signature&color=brightgreen) + +### Description + +UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-based review scopes. Prior to version 4.2.0, UltrafastSecp256k1's ECDSA adaptor pre-signature verification accepts forged adaptor pre-signatures whose "r" value is not cryptographically bound to the adaptor point "T". This issue has been patched in version 4.2.0. + +### POC + +#### Reference +- https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.0 +- https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-61568.md b/2026/CVE-2026-61568.md new file mode 100644 index 0000000000..60bae861fe --- /dev/null +++ b/2026/CVE-2026-61568.md @@ -0,0 +1,17 @@ +### [CVE-2026-61568](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61568) +![](https://img.shields.io/static/v1?label=Product&message=gitlab-mcp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.1.30%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-350%3A%20Reliance%20on%20Reverse%20DNS%20Resolution%20for%20a%20Security-Critical%20Action&color=brightgreen) + +### Description + +`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled `Host` and `Origin`. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. Version 2.1.30 contains a patch. + +### POC + +#### Reference +- https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-vmp7-252j-cwp7 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-61612.md b/2026/CVE-2026-61612.md index 371e154492..2df0a10c32 100644 --- a/2026/CVE-2026-61612.md +++ b/2026/CVE-2026-61612.md @@ -11,6 +11,7 @@ CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version #### Reference - https://github.com/advisories/GHSA-3xm7-qw7j-qc8v +- https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-798p-78g2-v556 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-61628.md b/2026/CVE-2026-61628.md new file mode 100644 index 0000000000..a7b1233bb0 --- /dev/null +++ b/2026/CVE-2026-61628.md @@ -0,0 +1,17 @@ +### [CVE-2026-61628](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61628) +![](https://img.shields.io/static/v1?label=Product&message=nginx-ignition&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.41.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-362%3A%20Concurrent%20Execution%20using%20Shared%20Resource%20with%20Improper%20Synchronization%20('Race%20Condition')&color=brightgreen) + +### Description + +nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue. + +### POC + +#### Reference +- https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-61629.md b/2026/CVE-2026-61629.md new file mode 100644 index 0000000000..f3993ed2ef --- /dev/null +++ b/2026/CVE-2026-61629.md @@ -0,0 +1,17 @@ +### [CVE-2026-61629](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61629) +![](https://img.shields.io/static/v1?label=Product&message=nginx-ignition&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.29.0%2C%20%3C%202.40.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen) + +### Description + +nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-` characters in the input at 1000, but it does not cap `_` characters even though the parser's internal scanner aliases `_` to `-` before parsing. A single unauthenticated GET request with an `Accept-Language` header built out of `_` separators burns about 2.4 seconds of server CPU on the host running nginx-ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue. + +### POC + +#### Reference +- https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-61672.md b/2026/CVE-2026-61672.md new file mode 100644 index 0000000000..305fb4636b --- /dev/null +++ b/2026/CVE-2026-61672.md @@ -0,0 +1,18 @@ +### [CVE-2026-61672](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61672) +![](https://img.shields.io/static/v1?label=Product&message=capsule&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.13.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-697%3A%20Incorrect%20Comparison&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list mixes capitalized and lowercase keys or otherwise has different case-insensitive and byte ordering, the binary search can return false for a key that is present. An authenticated tenant owner can then pass the missed key through api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions, potentially influencing cluster policies, network exposure, or scheduling outside the tenant boundary. Uniformly lowercase lists whose two orderings coincide are not affected. This issue is fixed in version 0.13.7. + +### POC + +#### Reference +- https://github.com/projectcapsule/capsule/security/advisories/GHSA-gjw4-3v3v-rqxg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-61699.md b/2026/CVE-2026-61699.md new file mode 100644 index 0000000000..7b4a92e5a8 --- /dev/null +++ b/2026/CVE-2026-61699.md @@ -0,0 +1,18 @@ +### [CVE-2026-61699](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61699) +![](https://img.shields.io/static/v1?label=Product&message=nebula-mesh&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.7.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-299%3A%20Improper%20Check%20for%20Certificate%20Revocation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-672%3A%20Operation%20on%20a%20Resource%20after%20Expiration%20or%20Release&color=brightgreen) + +### Description + +nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (mobile). An attacker who exfiltrates host.key+host.crt can run stock slackhq/nebula directly, ignore the agent's 403/410 poll responses, and stay connected after the operator revokes the host. Operator-visible state (UI shows blocked, audit log records it) is misleading. This issue has been patched in version 0.7.1. + +### POC + +#### Reference +- https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-cm26-5974-52h8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-61788.md b/2026/CVE-2026-61788.md new file mode 100644 index 0000000000..f645867352 --- /dev/null +++ b/2026/CVE-2026-61788.md @@ -0,0 +1,19 @@ +### [CVE-2026-61788](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61788) +![](https://img.shields.io/static/v1?label=Product&message=dbhub&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-184%3A%20Incomplete%20List%20of%20Disallowed%20Inputs&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-636%3A%20Not%20Failing%20Securely%20('Failing%20Open')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it never runs. The only thing left enforcing read-only is a classifier that inspects the first keyword of each statement. Any `SELECT` that writes or has side effects through a function call passes it. With an ordinary role this allows sequence tampering; with a privileged role it allows writing arbitrary files on the server (`lo_export`), reading arbitrary host files (`pg_read_file`), and remote code execution (`dblink` + `COPY ... TO PROGRAM`). The HTTP transport is unauthenticated and binds to `0.0.0.0` by default, so this is reachable by any network caller of `/mcp`. Version 0.22.6 patches the issue. + +### POC + +#### Reference +- https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-61795.md b/2026/CVE-2026-61795.md new file mode 100644 index 0000000000..a3366e7d00 --- /dev/null +++ b/2026/CVE-2026-61795.md @@ -0,0 +1,17 @@ +### [CVE-2026-61795](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61795) +![](https://img.shields.io/static/v1?label=Product&message=capsule&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.13.0%2C%20%3C%200.13.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-697%3A%20Incorrect%20Comparison&color=brightgreen) + +### Description + +Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostname_regex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can therefore store a malformed AllowedHostnames.Regex after the webhook accepts the update based on stale valid state. Subsequent Ingress creation or update reaches validate_hostnames.go, which evaluates the malformed pattern, ignores the regular-expression error, and treats every hostname as unmatched, blocking Ingress operations for the affected tenant until an administrator repairs the Tenant configuration. This issue is fixed in version 0.13.7. + +### POC + +#### Reference +- https://github.com/projectcapsule/capsule/security/advisories/GHSA-f94q-w3w8-cj67 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-61833.md b/2026/CVE-2026-61833.md new file mode 100644 index 0000000000..676fe12b3b --- /dev/null +++ b/2026/CVE-2026-61833.md @@ -0,0 +1,17 @@ +### [CVE-2026-61833](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61833) +![](https://img.shields.io/static/v1?label=Product&message=zot&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.1.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-285%3A%20Improper%20Authorization&color=brightgreen) + +### Description + +zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go, while DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a bearer token limited to pull and push actions can therefore delete manifests and blobs within the token's repository scope, making images unavailable and allowing repository history to be altered despite the token lacking delete authorization. This issue is fixed in version 2.1.18. + +### POC + +#### Reference +- https://github.com/project-zot/zot/security/advisories/GHSA-qg67-7m6v-qg25 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-61837.md b/2026/CVE-2026-61837.md new file mode 100644 index 0000000000..dbb017aa5c --- /dev/null +++ b/2026/CVE-2026-61837.md @@ -0,0 +1,21 @@ +### [CVE-2026-61837](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61837) +![](https://img.shields.io/static/v1?label=Product&message=rabbitmq-server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.0.0%2C%20%3C%204.0.23%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.1.0%2C%20%3C%204.1.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.2.0%2C%20%3C%204.2.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.3.0%2C%20%3C%204.3.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-285%3A%20Improper%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET /bindings (the rabbitamqpmanagement handler) enumerates bindings between an arbitrary source exchange and destination queue/exchange in the caller's virtual host without performing any resource-level permission check. Unlike every sibling operation in the same module (which call checkresourceaccess / bindingchecks), the GET handler ignores the authenticated User and returns the binding list unchanged. As a result, any authenticated AMQP 1.0 client that can open a management link pair , including users with no management/monitoring/policymaker/administrator tag , can enumerate the complete binding topology (source exchanges, destination queues/exchanges, routing keys, and binding arguments) of the virtual host they can access. The equivalent HTTP management API (GET /api/bindings) Confidentiality impact: a non-management AMQP 1.0 user can enumerate the complete routing topology of any virtual host it can connect to , every (source exchange, destination queue/exchange, routing key, binding arguments) This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23. + +### POC + +#### Reference +- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w9hf-476r-443x + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-61843.md b/2026/CVE-2026-61843.md new file mode 100644 index 0000000000..a3b2555429 --- /dev/null +++ b/2026/CVE-2026-61843.md @@ -0,0 +1,17 @@ +### [CVE-2026-61843](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61843) +![](https://img.shields.io/static/v1?label=Product&message=FileRise&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.18.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and any configured share password can upload a file with the same name as an existing file and silently replace its content while the original uploader metadata remains. The same replacement gap affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the existing file. This issue is fixed in version 3.18.0. + +### POC + +#### Reference +- https://github.com/error311/FileRise/security/advisories/GHSA-r787-5hp3-4874 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62858.md b/2026/CVE-2026-62858.md new file mode 100644 index 0000000000..a2cb8eb62e --- /dev/null +++ b/2026/CVE-2026-62858.md @@ -0,0 +1,17 @@ +### [CVE-2026-62858](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62858) +![](https://img.shields.io/static/v1?label=Product&message=YOURLS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.10.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-98%3A%20Improper%20Control%20of%20Filename%20for%20Include%2FRequire%20Statement%20in%20PHP%20Program%20('PHP%20Remote%20File%20Inclusion')&color=brightgreen) + +### Description + +YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5. + +### POC + +#### Reference +- https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63004.md b/2026/CVE-2026-63004.md new file mode 100644 index 0000000000..c85c09af71 --- /dev/null +++ b/2026/CVE-2026-63004.md @@ -0,0 +1,19 @@ +### [CVE-2026-63004](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63004) +![](https://img.shields.io/static/v1?label=Product&message=unleash&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%207.5.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%207.6.0%2C%20%3C%207.6.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%208.0.0%2C%20%3C%208.0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.ts without restricting loopback, link-local, private, or cloud metadata addresses. An authenticated actor with the root CREATE_ADDON or UPDATE_ADDON permission can cause the server to send requests from inside its network boundary, use integration event status as a blind probing oracle, forward Authorization, customHeaders, or DD-API-KEY values to an attacker-observed host, and deliver the feature-event JSON body to internal services. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2. + +### POC + +#### Reference +- https://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fj + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63104.md b/2026/CVE-2026-63104.md new file mode 100644 index 0000000000..0d78b6083f --- /dev/null +++ b/2026/CVE-2026-63104.md @@ -0,0 +1,17 @@ +### [CVE-2026-63104](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63104) +![](https://img.shields.io/static/v1?label=Product&message=kaneo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.3.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks. Attackers can send requests to the PATCH /api/task/bulk endpoint, which verifies only workspace membership without calling the role-based permission check enforced on all other task endpoints, to permanently delete all tasks or modify task status, priority, assignee, due date, and labels in a workspace. + +### POC + +#### Reference +- https://github.com/usekaneo/kaneo/security/advisories/GHSA-gx46-mfgj-vm86 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63123.md b/2026/CVE-2026-63123.md new file mode 100644 index 0000000000..3251babe30 --- /dev/null +++ b/2026/CVE-2026-63123.md @@ -0,0 +1,17 @@ +### [CVE-2026-63123](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63123) +![](https://img.shields.io/static/v1?label=Product&message=tinacms&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.5.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%3A%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) + +### Description + +Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still routes POST /media/upload/* to mediaRouter.handlePost. The upload code in packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts writes attacker-controlled multipart contents inside the configured media root. A remote attacker can cause a developer's browser to submit this state-changing request by inducing the developer to visit an attacker-controlled page while tinacms dev is running. This issue is fixed in version 2.5.2. + +### POC + +#### Reference +- https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63295.md b/2026/CVE-2026-63295.md new file mode 100644 index 0000000000..77f284cb15 --- /dev/null +++ b/2026/CVE-2026-63295.md @@ -0,0 +1,20 @@ +### [CVE-2026-63295](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63295) +![](https://img.shields.io/static/v1?label=Product&message=LXD&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.21.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%20Incorrect%20Authorization&color=brightgreen) + +### Description + +An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project's security constraints. + +### POC + +#### Reference +- https://github.com/canonical/lxd/security/advisories/GHSA-7vp9-3vmp-c5jm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63330.md b/2026/CVE-2026-63330.md new file mode 100644 index 0000000000..a8bea1c1ba --- /dev/null +++ b/2026/CVE-2026-63330.md @@ -0,0 +1,18 @@ +### [CVE-2026-63330](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63330) +![](https://img.shields.io/static/v1?label=Product&message=warpgate&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.25.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-285%3A%20Improper%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6. + +### POC + +#### Reference +- https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63404.md b/2026/CVE-2026-63404.md new file mode 100644 index 0000000000..2d43d390ad --- /dev/null +++ b/2026/CVE-2026-63404.md @@ -0,0 +1,17 @@ +### [CVE-2026-63404](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63404) +![](https://img.shields.io/static/v1?label=Product&message=faktory&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.10.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-377%3A%20Insecure%20Temporary%20File&color=brightgreen) + +### Description + +Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that lets a local unprivileged user hijack the Redis configuration and escalate to root. It writes its startup configuration to a fixed, predictable, world-writable path, /tmp/redis.conf, only creating the file if it does not already exist and never validating it on later boots. Because /tmp is world-writable, a local unprivileged user can pre-create /tmp/redis.conf with attacker-chosen Redis directives before Faktory starts, and Faktory will use the planted file verbatim. Faktory only overrides the unixsocket, dir, and logfile options, leaving directives such as bind, protected-mode, requirepass, and loadmodule attacker-controlled. This lets an attacker silently expose the entire job queue over an unauthenticated network port with no visible error to the administrator. Because the official systemd unit runs Faktory, and the redis-server child it spawns, as root, an attacker can also supply a loadmodule directive to execute arbitrary native code in the root-owned Redis process, escalating from a local unprivileged user to root. This issue is fixed in version 1.10.0. + +### POC + +#### Reference +- https://github.com/contribsys/faktory/security/advisories/GHSA-j2vx-rpwf-w77v + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63420.md b/2026/CVE-2026-63420.md new file mode 100644 index 0000000000..e003cf15db --- /dev/null +++ b/2026/CVE-2026-63420.md @@ -0,0 +1,20 @@ +### [CVE-2026-63420](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63420) +![](https://img.shields.io/static/v1?label=Product&message=OpenImageIO&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.0.21.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.1.0.0%2C%20%3C%203.1.16.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.2.0.0-dev%2C%20%3C%203.2.0.3-beta1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-129%3A%20Improper%20Validation%20of%20Array%20Index&color=brightgreen) + +### Description + +OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. when oiio:rawcolor or psd:rawdata is enabled, psdinput::read_native_scanline() passes spec.nchannels to psdinput::interleave_row(), which indexes beyond channel_buffers, resulting in a heap out-of-bounds read and process crash. The affected implementation is identified by src/psd.imageio/psdinput.cpp, PSDInput::read_native_scanline(), PSDInput::interleave_row(), oiio:RawColor, psd:RawData, channel_buffers, and spec.nchannels, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1. + +### POC + +#### Reference +- https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-x877-h4xx-5m5j + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63431.md b/2026/CVE-2026-63431.md new file mode 100644 index 0000000000..dca97cc5dd --- /dev/null +++ b/2026/CVE-2026-63431.md @@ -0,0 +1,17 @@ +### [CVE-2026-63431](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63431) +![](https://img.shields.io/static/v1?label=Product&message=horilla-hr&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%201.5.0-85%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records selected by emp_id, allowance_id, or deduction_id. An authenticated employee can substitute those identifiers to read another employee's salary structure, allowance and deduction amounts, personal loan disbursements, and repayment schedules without owning the record or holding payroll-view permissions. No complete fixed version is available as of this review. + +### POC + +#### Reference +- https://github.com/horilla/horilla-hr/security/advisories/GHSA-c38j-fg3w-7rph + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63493.md b/2026/CVE-2026-63493.md new file mode 100644 index 0000000000..463c31aceb --- /dev/null +++ b/2026/CVE-2026-63493.md @@ -0,0 +1,17 @@ +### [CVE-2026-63493](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63493) +![](https://img.shields.io/static/v1?label=Product&message=snipe-it&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%208.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-288%3A%20Authentication%20Bypass%20Using%20an%20Alternate%20Path%20or%20Channel&color=brightgreen) + +### Description + +Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The advisory states that the resulting persistent API token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint. Resetting the administrator's enrolled second factor allows the password-holding attacker to enroll an attacker-controlled factor, take over the administrator's web account, and lock out the legitimate user. The token does not create a web session, but it provides broad API access while the same browser session remains blocked at the two-factor page. This vulnerability is fixed in 8.7.0. + +### POC + +#### Reference +- https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63626.md b/2026/CVE-2026-63626.md new file mode 100644 index 0000000000..4e7494c57c --- /dev/null +++ b/2026/CVE-2026-63626.md @@ -0,0 +1,18 @@ +### [CVE-2026-63626](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63626) +![](https://img.shields.io/static/v1?label=Product&message=mongoose&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%207.23%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-122%3A%20Heap-based%20Buffer%20Overflow&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) + +### Description + +Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23. + +### POC + +#### Reference +- https://github.com/cesanta/mongoose/security/advisories/GHSA-pc66-j6r6-49x9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63669.md b/2026/CVE-2026-63669.md new file mode 100644 index 0000000000..364d057aa7 --- /dev/null +++ b/2026/CVE-2026-63669.md @@ -0,0 +1,18 @@ +### [CVE-2026-63669](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63669) +![](https://img.shields.io/static/v1?label=Product&message=apostrophe&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.32.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0. + +### POC + +#### Reference +- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63720.md b/2026/CVE-2026-63720.md index 659cd32ac8..5abff1217e 100644 --- a/2026/CVE-2026-63720.md +++ b/2026/CVE-2026-63720.md @@ -10,6 +10,7 @@ datamodel-code-generator prior to version 0.70.0 contains a code injection vulne ### POC #### Reference +- https://github.com/rahulreddykarne/CVE-2026-63720-datamodel-code-generator - https://rahulkarne.com/#/cve/CVE-2026-63720 #### Github diff --git a/2026/CVE-2026-63767.md b/2026/CVE-2026-63767.md new file mode 100644 index 0000000000..fa90a0329b --- /dev/null +++ b/2026/CVE-2026-63767.md @@ -0,0 +1,18 @@ +### [CVE-2026-63767](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63767) +![](https://img.shields.io/static/v1?label=Product&message=ktransformers&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Deserialization%20of%20Untrusted%20Data&color=brightgreen) + +### Description + +ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can exploit malicious __reduce__ methods embedded in crafted pickle payloads to execute arbitrary shell commands as the server process. + +### POC + +#### Reference +- https://github.com/kvcache-ai/ktransformers/issues/2087 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-63810.md b/2026/CVE-2026-63810.md index 24a5c09e56..0bbf02f198 100644 --- a/2026/CVE-2026-63810.md +++ b/2026/CVE-2026-63810.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:block: Avoid #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64279.md b/2026/CVE-2026-64279.md index c29f13c75f..d01aca9f88 100644 --- a/2026/CVE-2026-64279.md +++ b/2026/CVE-2026-64279.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.31%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=35fc37f8188177e3ba3e7f99a6e3300e490e9181%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:i2c: core: fi #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64317.md b/2026/CVE-2026-64317.md index 5e9bac1e72..2f124acb22 100644 --- a/2026/CVE-2026-64317.md +++ b/2026/CVE-2026-64317.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:isofs: bound #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64370.md b/2026/CVE-2026-64370.md index 95c8513f97..fa0799d7a0 100644 --- a/2026/CVE-2026-64370.md +++ b/2026/CVE-2026-64370.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:posix-cpu-tim #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64371.md b/2026/CVE-2026-64371.md index 163ea8f564..444987a0d7 100644 --- a/2026/CVE-2026-64371.md +++ b/2026/CVE-2026-64371.md @@ -7,6 +7,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=334ed22054b2ec8477e4409e214fc139cf937ef6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6b06d6282100dd5aacf7d45443d651a1995bd9c4%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=f83ce3e6b02d5e48b3a43b001390e2b58820389d%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -18,6 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:proc: protect #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64375.md b/2026/CVE-2026-64375.md index b7faca1b21..449e4f5815 100644 --- a/2026/CVE-2026-64375.md +++ b/2026/CVE-2026-64375.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.18%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=778c1144771f0064b6f51bee865cceb0d996f2f9%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:proc: protect #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64411.md b/2026/CVE-2026-64411.md index a594c50a4c..49ae44efaf 100644 --- a/2026/CVE-2026-64411.md +++ b/2026/CVE-2026-64411.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: eb #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64412.md b/2026/CVE-2026-64412.md index 4e67193412..af9ba2335b 100644 --- a/2026/CVE-2026-64412.md +++ b/2026/CVE-2026-64412.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=4.6%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bcf4934288402be3464110109a4dae3bd6fb3e93%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: eb #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64413.md b/2026/CVE-2026-64413.md index be869be6e3..29ba46d4df 100644 --- a/2026/CVE-2026-64413.md +++ b/2026/CVE-2026-64413.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=2.6.12%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: eb #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64422.md b/2026/CVE-2026-64422.md index 739d5386ec..02473357de 100644 --- a/2026/CVE-2026-64422.md +++ b/2026/CVE-2026-64422.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=2.6.24%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=91cc17c0e5e5ada156a8d5787a2509d263ea6bbf%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: ipv4: bo #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64423.md b/2026/CVE-2026-64423.md index cc4b9565ca..7322e4ceef 100644 --- a/2026/CVE-2026-64423.md +++ b/2026/CVE-2026-64423.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=3.11%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=e9897071350bd9d94a56b5b6f79c85b1a98fc7e7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv4: igmp: r #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64425.md b/2026/CVE-2026-64425.md index 1cddd2c3a7..da98532601 100644 --- a/2026/CVE-2026-64425.md +++ b/2026/CVE-2026-64425.md @@ -14,6 +14,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=6.6.122%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=85eb83694a91c89d9abe615d717c0053c3efa714%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=bdf0bf73006ea8af9327cdb85cfdff4c23a5f966%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=d05d99573f81a091547b1778b9a50120f5d6c68a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -26,6 +27,7 @@ In the Linux kernel, the following vulnerability has been resolved:io_uring/io-w #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64538.md b/2026/CVE-2026-64538.md index e4c3f7f943..4f9c4bf8ff 100644 --- a/2026/CVE-2026-64538.md +++ b/2026/CVE-2026-64538.md @@ -3,6 +3,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.3%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=c0b220cf7d80eb8a36ae9f12cae6df4577a6814e%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: Fix nul #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64545.md b/2026/CVE-2026-64545.md index 0a8236a45a..bd1ad850a3 100644 --- a/2026/CVE-2026-64545.md +++ b/2026/CVE-2026-64545.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=879af96ffd72706c6e3278ea6b45b0b0e37ec5d7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:net, bpf: che #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64552.md b/2026/CVE-2026-64552.md index c5a7460165..bdefa423ee 100644 --- a/2026/CVE-2026-64552.md +++ b/2026/CVE-2026-64552.md @@ -12,6 +12,7 @@ ![](https://img.shields.io/static/v1?label=Version&message=82fe78065450d2d07f36a22e2b6b44955cf5ca5b%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=946dec89c41726b94d31147ec528b96af0be1b5a%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -22,6 +23,7 @@ In the Linux kernel, the following vulnerability has been resolved:virtio-net: f #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-64560.md b/2026/CVE-2026-64560.md index b841f48ab9..124a4a21f1 100644 --- a/2026/CVE-2026-64560.md +++ b/2026/CVE-2026-64560.md @@ -1,9 +1,11 @@ ### [CVE-2026-64560](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560) ![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=V3.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=V3.1.7%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) ### Description @@ -14,6 +16,8 @@ In the Linux kernel, the following vulnerability has been resolved:posix-cpu-tim #### Reference - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +- https://cert-portal.siemens.com/productcert/html/ssa-457936.html +- https://cert-portal.siemens.com/productcert/html/ssa-784472.html #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-69090.md b/2026/CVE-2026-69090.md new file mode 100644 index 0000000000..a8df582dc5 --- /dev/null +++ b/2026/CVE-2026-69090.md @@ -0,0 +1,18 @@ +### [CVE-2026-69090](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69090) +![](https://img.shields.io/static/v1?label=Product&message=admidio&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groups_roles.php handlers to modify that organization's roles without authorization. + +### POC + +#### Reference +- https://github.com/Admidio/admidio/security/advisories/GHSA-fcq9-w4hp-xchg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-69110.md b/2026/CVE-2026-69110.md new file mode 100644 index 0000000000..29ea1071be --- /dev/null +++ b/2026/CVE-2026-69110.md @@ -0,0 +1,17 @@ +### [CVE-2026-69110](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69110) +![](https://img.shields.io/static/v1?label=Product&message=opencode-studio&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can retrieve intermediate audio, video artifacts, and subtitles belonging to other users' jobs, and additionally delete any video by ID through the unauthenticated DELETE /api/short-video/:videoId endpoint. + +### POC + +#### Reference +- https://github.com/Microck/opencode-studio/issues/54 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-69259.md b/2026/CVE-2026-69259.md new file mode 100644 index 0000000000..b38ea69f15 --- /dev/null +++ b/2026/CVE-2026-69259.md @@ -0,0 +1,17 @@ +### [CVE-2026-69259](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-69259) +![](https://img.shields.io/static/v1?label=Product&message=Flowise&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.1.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended database setting, allowing additionalConfig.database to overwrite the SQLite database path. An authenticated attacker using the published Docker image, which ran as root, could write a SQLite database to paths such as /etc/chromium/exploit.conf; by controlling the table name and namespace value, the attacker could place shell syntax into the database file and trigger execution when Puppeteer launched Chromium and sourced /etc/chromium/*.conf. This issue is fixed in version 3.1.3. + +### POC + +#### Reference +- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x3hf-7cj6-3r4m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71303.md b/2026/CVE-2026-71303.md new file mode 100644 index 0000000000..1bf79c8837 --- /dev/null +++ b/2026/CVE-2026-71303.md @@ -0,0 +1,17 @@ +### [CVE-2026-71303](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71303) +![](https://img.shields.io/static/v1?label=Product&message=lemur&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.9.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acme_url with an internal service or instance-metadata URL such as 169.254.169.254. The next issuance operation loaded that value and passed it to ClientV2.get_directory, causing an outbound request from the Lemur backend. This bypassed the creation-time mitigation for CVE-2026-55166 and could expose internal services or cloud metadata. The fix revalidates acme_url whenever authority options are updated. This issue is fixed in version 1.9.3. + +### POC + +#### Reference +- https://github.com/Netflix/lemur/security/advisories/GHSA-v5rc-cpwc-cfpr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71307.md b/2026/CVE-2026-71307.md new file mode 100644 index 0000000000..db2d455299 --- /dev/null +++ b/2026/CVE-2026-71307.md @@ -0,0 +1,17 @@ +### [CVE-2026-71307](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71307) +![](https://img.shields.io/static/v1?label=Product&message=lemur&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.9.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allowing even a read-only user to retrieve credentials for remote certificate-deployment hosts. The exposed credentials could permit direct access to SFTP systems and TLS material outside the Lemur security boundary. The fix requires administrator permission for destination reads and redacts options marked sensitive. This issue is fixed in version 1.9.3. + +### POC + +#### Reference +- https://github.com/Netflix/lemur/security/advisories/GHSA-6c8m-q6g9-vrw3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71309.md b/2026/CVE-2026-71309.md new file mode 100644 index 0000000000..f310f5af7f --- /dev/null +++ b/2026/CVE-2026-71309.md @@ -0,0 +1,17 @@ +### [CVE-2026-71309](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71309) +![](https://img.shields.io/static/v1?label=Product&message=rclone&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.40.0%2C%20%3C%201.75.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and passes it to GET, HEAD, POST, and DELETE handlers for configured backends including WebDAV, FTP, HTTP, Memory, and SFTP. An attacker who can access the REST endpoint may read, create, overwrite, or delete objects outside the path configured by the operator when the operator publishes a backend subdirectory and the backend credential can access parent or sibling objects. This issue is fixed in 1.75.0. + +### POC + +#### Reference +- https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71310.md b/2026/CVE-2026-71310.md new file mode 100644 index 0000000000..876e6c0f26 --- /dev/null +++ b/2026/CVE-2026-71310.md @@ -0,0 +1,18 @@ +### [CVE-2026-71310](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71310) +![](https://img.shields.io/static/v1?label=Product&message=rclone&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.75.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen) + +### Description + +rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0. + +### POC + +#### Reference +- https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71317.md b/2026/CVE-2026-71317.md new file mode 100644 index 0000000000..278aa69f65 --- /dev/null +++ b/2026/CVE-2026-71317.md @@ -0,0 +1,17 @@ +### [CVE-2026-71317](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71317) +![](https://img.shields.io/static/v1?label=Product&message=lemur&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.9.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority creation to cryptography-issuer, which used the parent authority_certificate.private_key to sign a new intermediate. Any authenticated non-read-only user in that supported configuration could chain a sub-CA to an internal root for which the user held no role. The resulting intermediate could issue trusted certificates and its private key could be used outside Lemur, bypassing normal issuance controls. The fix checks AuthorityPermission on every supplied parent before invoking the issuer. This issue is fixed in version 1.9.3. + +### POC + +#### Reference +- https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71325.md b/2026/CVE-2026-71325.md new file mode 100644 index 0000000000..261353d665 --- /dev/null +++ b/2026/CVE-2026-71325.md @@ -0,0 +1,20 @@ +### [CVE-2026-71325](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71325) +![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.11.54%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.0.0%2C%20%3C%203.6.25%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.7.0%2C%20%3C%203.7.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-653%3A%20Improper%20Isolation%20or%20Compartmentalization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a single namespace can therefore bind its own router to a TraefikService owned by another namespace and expose or reroute that namespace's backend, defeating the namespace isolation allowCrossNamespace=false is meant to enforce. This issue is fixed in version 2.11.54, 3.6.25, 3.7.10. + +### POC + +#### Reference +- https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71326.md b/2026/CVE-2026-71326.md new file mode 100644 index 0000000000..145555c490 --- /dev/null +++ b/2026/CVE-2026-71326.md @@ -0,0 +1,18 @@ +### [CVE-2026-71326](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71326) +![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.6.11%2C%20%3C%203.6.25%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.7.0%2C%20%3C%203.7.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%3A%20Improper%20Authentication&color=brightgreen) + +### Description + +Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10. + +### POC + +#### Reference +- https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71416.md b/2026/CVE-2026-71416.md new file mode 100644 index 0000000000..74c3709916 --- /dev/null +++ b/2026/CVE-2026-71416.md @@ -0,0 +1,18 @@ +### [CVE-2026-71416](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71416) +![](https://img.shields.io/static/v1?label=Product&message=headroom&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.35.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1385%3A%20Missing%20Origin%20Validation%20in%20WebSockets&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%3A%20Improper%20Authentication&color=brightgreen) + +### Description + +Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable. Version 0.35.0 fixes the issue. + +### POC + +#### Reference +- https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71417.md b/2026/CVE-2026-71417.md new file mode 100644 index 0000000000..1d9a7d9fb8 --- /dev/null +++ b/2026/CVE-2026-71417.md @@ -0,0 +1,17 @@ +### [CVE-2026-71417](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71417) +![](https://img.shields.io/static/v1?label=Product&message=lemur&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.9.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authority_id, serial, or external_id without requiring permission on the underlying authority. PUT /api/1/certificates//revoke authorized the caller against only the selected Lemur row, so the creator of the duplicate bypassed CertificatePermission. The duplicate had no cert.endpoints, which also bypassed the safeguard that prevents revocation of deployed certificates. Issuer plugins then revoked the real CA-side certificate using certificate.body or external_id under the stored authority credentials. An attacker could therefore revoke arbitrary managed certificates and cause fleet-wide TLS denial of service. The fix rejects duplicate authority_id and serial identities, requires authority access on upload, and checks every matching row during revocation. This issue is fixed in version 1.9.3. + +### POC + +#### Reference +- https://github.com/Netflix/lemur/security/advisories/GHSA-pxmc-2ffp-8j67 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71426.md b/2026/CVE-2026-71426.md new file mode 100644 index 0000000000..3ed787d19d --- /dev/null +++ b/2026/CVE-2026-71426.md @@ -0,0 +1,18 @@ +### [CVE-2026-71426](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71426) +![](https://img.shields.io/static/v1?label=Product&message=GetSimpleCMS-CE&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%203.3.22%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-98%3A%20Improper%20Control%20of%20Filename%20for%20Include%2FRequire%20Statement%20in%20PHP%20Program%20('PHP%20Remote%20File%20Inclusion')&color=brightgreen) + +### Description + +GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is passed unsanitized to a PHP include() when the page is rendered. Because the include path is never confined, this allows directory-traversal Local File Inclusion: arbitrary local files are included (and, if they contain PHP, executed) when any visitor requests the page. At time of publication, there are no publicly available patches. + +### POC + +#### Reference +- https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-559q-hqrv-m84x + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71430.md b/2026/CVE-2026-71430.md new file mode 100644 index 0000000000..80d534c4df --- /dev/null +++ b/2026/CVE-2026-71430.md @@ -0,0 +1,17 @@ +### [CVE-2026-71430](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71430) +![](https://img.shields.io/static/v1?label=Product&message=node-re2&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.25.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-617%3A%20Reachable%20Assertion&color=brightgreen) + +### Description + +node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string length, the unchecked ToLocalChecked call causes a fatal, uncatchable process abort instead of a catchable exception. This issue is fixed in version 1.25.1. + +### POC + +#### Reference +- https://github.com/uhop/node-re2/security/advisories/GHSA-8hcv-x26h-mcgp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71477.md b/2026/CVE-2026-71477.md new file mode 100644 index 0000000000..a24f988afe --- /dev/null +++ b/2026/CVE-2026-71477.md @@ -0,0 +1,17 @@ +### [CVE-2026-71477](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71477) +![](https://img.shields.io/static/v1?label=Product&message=mise&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202026.7.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-278%3A%20Insecure%20Preserved%20Inherited%20Permissions&color=brightgreen) + +### Description + +mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1. + +### POC + +#### Reference +- https://github.com/jdx/mise/security/advisories/GHSA-9mm4-fgvc-x7rp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71483.md b/2026/CVE-2026-71483.md new file mode 100644 index 0000000000..5ec5d75a42 --- /dev/null +++ b/2026/CVE-2026-71483.md @@ -0,0 +1,17 @@ +### [CVE-2026-71483](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71483) +![](https://img.shields.io/static/v1?label=Product&message=horilla-hr&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0. + +### POC + +#### Reference +- https://github.com/horilla/horilla-hr/security/advisories/GHSA-rw86-x8hq-xgwh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71493.md b/2026/CVE-2026-71493.md new file mode 100644 index 0000000000..ea6288532a --- /dev/null +++ b/2026/CVE-2026-71493.md @@ -0,0 +1,18 @@ +### [CVE-2026-71493](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71493) +![](https://img.shields.io/static/v1?label=Product&message=infracost&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.10.45%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-59%3A%20Improper%20Link%20Resolution%20Before%20File%20Access%20('Link%20Following')&color=brightgreen) + +### Description + +Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an intermediate directory symlink. A repository can contain a path such as evil/file where evil points outside the checkout, causing os.ReadFile and related operations to follow the symlink and read runner-accessible files. The resulting content is rendered into generated configuration and can be surfaced through the Infracost dashboard or pull request comment, with greater impact in workflows that provide repository secrets. This issue is fixed in version 0.10.45. + +### POC + +#### Reference +- https://github.com/infracost/infracost/commit/4d39331afc0e27752d16d9d91c34583e5e8487fb + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71498.md b/2026/CVE-2026-71498.md new file mode 100644 index 0000000000..68eed20ccc --- /dev/null +++ b/2026/CVE-2026-71498.md @@ -0,0 +1,17 @@ +### [CVE-2026-71498](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71498) +![](https://img.shields.io/static/v1?label=Product&message=node-re2&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.26.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) + +### Description + +node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1. + +### POC + +#### Reference +- https://github.com/uhop/node-re2/issues/272 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71542.md b/2026/CVE-2026-71542.md new file mode 100644 index 0000000000..8f9edf6a17 --- /dev/null +++ b/2026/CVE-2026-71542.md @@ -0,0 +1,17 @@ +### [CVE-2026-71542](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71542) +![](https://img.shields.io/static/v1?label=Product&message=GetSimpleCMS-CE&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%203.3.22%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context. This allows persistent execution of arbitrary JavaScript in the admin panel. At time of publication, there are no publicly available patches. + +### POC + +#### Reference +- https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-vqfh-838q-xfqh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71551.md b/2026/CVE-2026-71551.md new file mode 100644 index 0000000000..90d85919ec --- /dev/null +++ b/2026/CVE-2026-71551.md @@ -0,0 +1,17 @@ +### [CVE-2026-71551](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71551) +![](https://img.shields.io/static/v1?label=Product&message=super-productivity&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2018.13.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins executed with new Function(), without requiring nodeExecution permission. A confirmation dialog protects only the first execution, its persistence checkbox is selected by default, and approved commands are stored in the ALLOWED_COMMANDS value in simpleSettings for silent later execution with the desktop account's privileges. This issue is fixed in version 18.13.0. + +### POC + +#### Reference +- https://github.com/super-productivity/super-productivity/security/advisories/GHSA-256q-p9ff-jv8q + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71613.md b/2026/CVE-2026-71613.md new file mode 100644 index 0000000000..8a7dec2501 --- /dev/null +++ b/2026/CVE-2026-71613.md @@ -0,0 +1,17 @@ +### [CVE-2026-71613](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71613) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdec_process() function. Fixed in 9a253a07fd3f6b48022bba74302bf39388dda859. + +### POC + +#### Reference +- https://github.com/gpac/gpac/issues/3613 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71614.md b/2026/CVE-2026-71614.md new file mode 100644 index 0000000000..3b4e874120 --- /dev/null +++ b/2026/CVE-2026-71614.md @@ -0,0 +1,17 @@ +### [CVE-2026-71614](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71614) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938. + +### POC + +#### Reference +- https://github.com/gpac/gpac/issues/3614 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71616.md b/2026/CVE-2026-71616.md new file mode 100644 index 0000000000..dd3b06df23 --- /dev/null +++ b/2026/CVE-2026-71616.md @@ -0,0 +1,17 @@ +### [CVE-2026-71616](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71616) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_complete_object(). Fixed in 3c4e6c5b3e0c6fa9b16d55599701a08354538fab. + +### POC + +#### Reference +- https://github.com/gpac/gpac/issues/3621 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71802.md b/2026/CVE-2026-71802.md new file mode 100644 index 0000000000..0ff284d6af --- /dev/null +++ b/2026/CVE-2026-71802.md @@ -0,0 +1,17 @@ +### [CVE-2026-71802](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71802) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages "which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings. + +### POC + +#### Reference +- https://github.com/W000i/vuln/issues/6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71832.md b/2026/CVE-2026-71832.md new file mode 100644 index 0000000000..109b58e53c --- /dev/null +++ b/2026/CVE-2026-71832.md @@ -0,0 +1,17 @@ +### [CVE-2026-71832](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71832) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote malicious user to cause a Denial of Service + +### POC + +#### Reference +- https://github.com/aria2/aria2/issues/2371 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71851.md b/2026/CVE-2026-71851.md new file mode 100644 index 0000000000..e8212cd346 --- /dev/null +++ b/2026/CVE-2026-71851.md @@ -0,0 +1,19 @@ +### [CVE-2026-71851](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71851) +![](https://img.shields.io/static/v1?label=Product&message=crypto-js&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-331%3A%20Insufficient%20Entropy&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-334%3A%20Small%20Space%20of%20Random%20Values&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-338%3A%20Use%20of%20Cryptographically%20Weak%20Pseudo-Random%20Number%20Generator%20(PRNG)&color=brightgreen) + +### Description + +crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release. Nominal requests for 128 or 256 bits of entropy through this function produce effective search spaces of approximately 2 to the 39th and 2 to the 47th possibilities, small enough to enumerate on commodity hardware. Downstream wallet applications that used CryptoJS.lib.WordArray.random() as the entropy source for BIP39 recovery phrases are affected, and an attacker who enumerates the reduced output space can recover the resulting private keys and control the associated funds. This issue is fixed in version 4.0.0. + +### POC + +#### Reference +- https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71858.md b/2026/CVE-2026-71858.md new file mode 100644 index 0000000000..7743fd5272 --- /dev/null +++ b/2026/CVE-2026-71858.md @@ -0,0 +1,19 @@ +### [CVE-2026-71858](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71858) +![](https://img.shields.io/static/v1?label=Product&message=notepad-plus-plus&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%208.9.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-345%3A%20Insufficient%20Verification%20of%20Data%20Authenticity&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-693%3A%20Protection%20Mechanism%20Failure&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++ process, allowing protected file modification and conditional elevated command execution when a local attacker influences settingsDir and a user triggers the macro. This issue is fixed in version 8.9.7. + +### POC + +#### Reference +- https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-f4rj-vqq4-wvg4 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71865.md b/2026/CVE-2026-71865.md new file mode 100644 index 0000000000..99f536f024 --- /dev/null +++ b/2026/CVE-2026-71865.md @@ -0,0 +1,19 @@ +### [CVE-2026-71865](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71865) +![](https://img.shields.io/static/v1?label=Product&message=orval&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%208.21.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-116%3A%20Improper%20Encoding%20or%20Escaping%20of%20Output&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-95%3A%20Improper%20Neutralization%20of%20Directives%20in%20Dynamically%20Evaluated%20Code%20('Eval%20Injection')&color=brightgreen) + +### Description + +Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0. + +### POC + +#### Reference +- https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71867.md b/2026/CVE-2026-71867.md new file mode 100644 index 0000000000..298661492d --- /dev/null +++ b/2026/CVE-2026-71867.md @@ -0,0 +1,18 @@ +### [CVE-2026-71867](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71867) +![](https://img.shields.io/static/v1?label=Product&message=orval&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%208.21.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-95%3A%20Improper%20Neutralization%20of%20Directives%20in%20Dynamically%20Evaluated%20Code%20('Eval%20Injection')&color=brightgreen) + +### Description + +Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0. + +### POC + +#### Reference +- https://github.com/orval-labs/orval/security/advisories/GHSA-2w86-xfrc-g85r + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71869.md b/2026/CVE-2026-71869.md new file mode 100644 index 0000000000..579ce2e677 --- /dev/null +++ b/2026/CVE-2026-71869.md @@ -0,0 +1,19 @@ +### [CVE-2026-71869](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71869) +![](https://img.shields.io/static/v1?label=Product&message=orval&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%208.21.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-116%3A%20Improper%20Encoding%20or%20Escaping%20of%20Output&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1336%3A%20Improper%20Neutralization%20of%20Special%20Elements%20Used%20in%20a%20Template%20Engine&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0. + +### POC + +#### Reference +- https://github.com/orval-labs/orval/security/advisories/GHSA-2h9g-j24r-h63g + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-71871.md b/2026/CVE-2026-71871.md new file mode 100644 index 0000000000..78f8e97d16 --- /dev/null +++ b/2026/CVE-2026-71871.md @@ -0,0 +1,19 @@ +### [CVE-2026-71871](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71871) +![](https://img.shields.io/static/v1?label=Product&message=orval&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%208.21.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-116%3A%20Improper%20Encoding%20or%20Escaping%20of%20Output&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1336%3A%20Improper%20Neutralization%20of%20Special%20Elements%20Used%20in%20a%20Template%20Engine&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0. + +### POC + +#### Reference +- https://github.com/orval-labs/orval/security/advisories/GHSA-8j6p-r8jg-mxqh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-74860.md b/2026/CVE-2026-74860.md index 06386b7cf7..23c059e976 100644 --- a/2026/CVE-2026-74860.md +++ b/2026/CVE-2026-74860.md @@ -8,6 +8,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Hardened%20Images&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Update%20Infrastructure%205&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Release%20of%20Invalid%20Pointer%20or%20Reference&color=brightgreen) diff --git a/2026/CVE-2026-74920.md b/2026/CVE-2026-74920.md new file mode 100644 index 0000000000..e69c5309ff --- /dev/null +++ b/2026/CVE-2026-74920.md @@ -0,0 +1,17 @@ +### [CVE-2026-74920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74920) +![](https://img.shields.io/static/v1?label=Product&message=Document%20Gallery&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/aa80cef6-b2fd-47ef-bac9-53438aa27573/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75011.md b/2026/CVE-2026-75011.md new file mode 100644 index 0000000000..bb9f1b048c --- /dev/null +++ b/2026/CVE-2026-75011.md @@ -0,0 +1,18 @@ +### [CVE-2026-75011](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75011) +![](https://img.shields.io/static/v1?label=Product&message=NetForensicMCP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the file index.js. Executing a manipulation of the argument interface/protocol can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/kylecui/NetForensicMCP/issues/1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75078.md b/2026/CVE-2026-75078.md new file mode 100644 index 0000000000..bc9e6592f6 --- /dev/null +++ b/2026/CVE-2026-75078.md @@ -0,0 +1,18 @@ +### [CVE-2026-75078](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75078) +![](https://img.shields.io/static/v1?label=Product&message=Class%20and%20Exam%20Timetabling%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) + +### Description + +A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. + +### POC + +#### Reference +- https://github.com/i-QvQ-i/first-OvO/issues/5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75086.md b/2026/CVE-2026-75086.md new file mode 100644 index 0000000000..cac6d03633 --- /dev/null +++ b/2026/CVE-2026-75086.md @@ -0,0 +1,18 @@ +### [CVE-2026-75086](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75086) +![](https://img.shields.io/static/v1?label=Product&message=Hospital%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +- https://github.com/11snk/CVE/issues/3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75093.md b/2026/CVE-2026-75093.md index 0b158e95c4..e84a7f48ce 100644 --- a/2026/CVE-2026-75093.md +++ b/2026/CVE-2026-75093.md @@ -16,6 +16,7 @@ A security vulnerability has been detected in sonos tract up to 0.23.4. This imp #### Reference - https://github.com/sonos/tract/issues/2390 +- https://github.com/sonos/tract/pull/2413 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-75106.md b/2026/CVE-2026-75106.md new file mode 100644 index 0000000000..fcc41b461c --- /dev/null +++ b/2026/CVE-2026-75106.md @@ -0,0 +1,17 @@ +### [CVE-2026-75106](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75106) +![](https://img.shields.io/static/v1?label=Product&message=OpnForm&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Generation%20of%20Predictable%20Numbers%20or%20Identifiers&color=brightgreen) + +### Description + +OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint. + +### POC + +#### Reference +- https://github.com/OpnForm/OpnForm/issues/1259 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75109.md b/2026/CVE-2026-75109.md new file mode 100644 index 0000000000..085c028d4b --- /dev/null +++ b/2026/CVE-2026-75109.md @@ -0,0 +1,17 @@ +### [CVE-2026-75109](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75109) +![](https://img.shields.io/static/v1?label=Product&message=determined&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own. + +### POC + +#### Reference +- https://github.com/determined-ai/determined/issues/10270 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75148.md b/2026/CVE-2026-75148.md new file mode 100644 index 0000000000..6c664e3e2d --- /dev/null +++ b/2026/CVE-2026-75148.md @@ -0,0 +1,17 @@ +### [CVE-2026-75148](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75148) +![](https://img.shields.io/static/v1?label=Product&message=cgltf&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Integer%20Overflow%20or%20Wraparound&color=brightgreen) + +### Description + +cgltf through 1.15 contains an integer overflow vulnerability in the non-sparse accessor bounds check within cgltf_validate() that allows remote attackers to cause memory disclosure and denial of service by supplying crafted accessor count values. Attackers can provide malformed .gltf or .glb input with a specially crafted accessor count to overflow the unsigned integer multiplication of accessor stride and element count, causing the bounds check to pass and triggering a heap out-of-bounds read when cgltf_accessor_read_float() is subsequently called on the validated malformed accessor. + +### POC + +#### Reference +- https://github.com/jkuhlmann/cgltf/issues/301 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75169.md b/2026/CVE-2026-75169.md new file mode 100644 index 0000000000..f236aa6613 --- /dev/null +++ b/2026/CVE-2026-75169.md @@ -0,0 +1,17 @@ +### [CVE-2026-75169](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75169) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths. + +### POC + +#### Reference +- https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75169 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75171.md b/2026/CVE-2026-75171.md new file mode 100644 index 0000000000..32fa9f7fe6 --- /dev/null +++ b/2026/CVE-2026-75171.md @@ -0,0 +1,17 @@ +### [CVE-2026-75171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75171) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component. + +### POC + +#### Reference +- https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75171 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75331.md b/2026/CVE-2026-75331.md new file mode 100644 index 0000000000..0bbe4ccfcd --- /dev/null +++ b/2026/CVE-2026-75331.md @@ -0,0 +1,17 @@ +### [CVE-2026-75331](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75331) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server. + +### POC + +#### Reference +- https://github.com/fangtang7/CVE/blob/main/tamgou/xss.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75337.md b/2026/CVE-2026-75337.md new file mode 100644 index 0000000000..2ec3c39794 --- /dev/null +++ b/2026/CVE-2026-75337.md @@ -0,0 +1,17 @@ +### [CVE-2026-75337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75337) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root. + +### POC + +#### Reference +- https://github.com/fangtang7/CVE/blob/main/yu-ai/YU_AI_4.3_TRAVERSAL_POC.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75345.md b/2026/CVE-2026-75345.md new file mode 100644 index 0000000000..cd851cd473 --- /dev/null +++ b/2026/CVE-2026-75345.md @@ -0,0 +1,17 @@ +### [CVE-2026-75345](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75345) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service. + +### POC + +#### Reference +- https://github.com/EIPStackGroup/OpENer/issues/569 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75346.md b/2026/CVE-2026-75346.md new file mode 100644 index 0000000000..6ac38e3950 --- /dev/null +++ b/2026/CVE-2026-75346.md @@ -0,0 +1,17 @@ +### [CVE-2026-75346](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75346) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker to cause a denial of service + +### POC + +#### Reference +- https://github.com/EIPStackGroup/OpENer/issues/572 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75348.md b/2026/CVE-2026-75348.md new file mode 100644 index 0000000000..02c591f351 --- /dev/null +++ b/2026/CVE-2026-75348.md @@ -0,0 +1,17 @@ +### [CVE-2026-75348](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75348) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type 0x8000 or 0x8001 without first validating that the remaining CPF buffer contains the complete fixed sockaddr structure. This allows a remote attacker to cause a denial of service. + +### POC + +#### Reference +- https://github.com/EIPStackGroup/OpENer/issues/573 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75349.md b/2026/CVE-2026-75349.md new file mode 100644 index 0000000000..9fbe38fa74 --- /dev/null +++ b/2026/CVE-2026-75349.md @@ -0,0 +1,17 @@ +### [CVE-2026-75349](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75349) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service. + +### POC + +#### Reference +- https://github.com/EIPStackGroup/OpENer/issues/577 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75350.md b/2026/CVE-2026-75350.md new file mode 100644 index 0000000000..0af65fc4d9 --- /dev/null +++ b/2026/CVE-2026-75350.md @@ -0,0 +1,17 @@ +### [CVE-2026-75350](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75350) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service + +### POC + +#### Reference +- https://github.com/EIPStackGroup/OpENer/issues/576 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75351.md b/2026/CVE-2026-75351.md new file mode 100644 index 0000000000..6700e1ac9a --- /dev/null +++ b/2026/CVE-2026-75351.md @@ -0,0 +1,17 @@ +### [CVE-2026-75351](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75351) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service. + +### POC + +#### Reference +- https://github.com/EIPStackGroup/OpENer/issues/574 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75353.md b/2026/CVE-2026-75353.md new file mode 100644 index 0000000000..fee46640b6 --- /dev/null +++ b/2026/CVE-2026-75353.md @@ -0,0 +1,17 @@ +### [CVE-2026-75353](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75353) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remtoe attacker to cause a denial of service + +### POC + +#### Reference +- https://github.com/EIPStackGroup/OpENer/issues/570 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75414.md b/2026/CVE-2026-75414.md new file mode 100644 index 0000000000..7f477798ae --- /dev/null +++ b/2026/CVE-2026-75414.md @@ -0,0 +1,17 @@ +### [CVE-2026-75414](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75414) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability. + +### POC + +#### Reference +- https://github.com/Y4y17/CVE/blob/main/AntFlow/Front%20desk%20command%20execution.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75465.md b/2026/CVE-2026-75465.md new file mode 100644 index 0000000000..b5ac8f178a --- /dev/null +++ b/2026/CVE-2026-75465.md @@ -0,0 +1,17 @@ +### [CVE-2026-75465](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75465) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users. + +### POC + +#### Reference +- https://github.com/returnwrong/returnwrong-security-advisories/blob/main/CVE-2026-75465.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75480.md b/2026/CVE-2026-75480.md new file mode 100644 index 0000000000..3b3530378e --- /dev/null +++ b/2026/CVE-2026-75480.md @@ -0,0 +1,17 @@ +### [CVE-2026-75480](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75480) +![](https://img.shields.io/static/v1?label=Product&message=OpenViking&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) + +### Description + +OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the same account without administrative privileges. + +### POC + +#### Reference +- https://github.com/volcengine/OpenViking/issues/3724 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75510.md b/2026/CVE-2026-75510.md new file mode 100644 index 0000000000..f774d30c90 --- /dev/null +++ b/2026/CVE-2026-75510.md @@ -0,0 +1,17 @@ +### [CVE-2026-75510](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75510) +![](https://img.shields.io/static/v1?label=Product&message=novu&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.18.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through apps/api/src/app/inbox/utils/notification-mapper.ts and packages/js/src/ui/components/Notification/DefaultNotification.tsx to the navigate function in packages/js/src/ui/context/InboxContext.tsx without validating its URL scheme. An authenticated organization member or environment API-key holder can store a javascript: redirect with target _self in an in-app workflow. When a recipient using a Chromium-based browser clicks the notification, window.open executes the redirect in the current inbox-hosting origin, which can expose session material and permit authenticated actions in a customer application or the self-hosted Novu dashboard. This issue is fixed in version 3.18.0. + +### POC + +#### Reference +- https://github.com/novuhq/novu/security/advisories/GHSA-8gr3-5j6f-25gp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75513.md b/2026/CVE-2026-75513.md index 43a8a00af3..1c770366c5 100644 --- a/2026/CVE-2026-75513.md +++ b/2026/CVE-2026-75513.md @@ -11,6 +11,7 @@ Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From v #### Reference - https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed +- https://github.com/JasperFx/marten/pull/4911 - https://github.com/JasperFx/marten/releases/tag/9.13.0 - https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp diff --git a/2026/CVE-2026-75514.md b/2026/CVE-2026-75514.md new file mode 100644 index 0000000000..e828f861b8 --- /dev/null +++ b/2026/CVE-2026-75514.md @@ -0,0 +1,17 @@ +### [CVE-2026-75514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75514) +![](https://img.shields.io/static/v1?label=Product&message=bunkerweb&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.6.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-350%3A%20Reliance%20on%20Reverse%20DNS%20Resolution%20for%20a%20Security-Critical%20Action&color=brightgreen) + +### Description + +BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13. + +### POC + +#### Reference +- https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q54j-5484-pvjm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75542.md b/2026/CVE-2026-75542.md new file mode 100644 index 0000000000..5e60b42c08 --- /dev/null +++ b/2026/CVE-2026-75542.md @@ -0,0 +1,18 @@ +### [CVE-2026-75542](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75542) +![](https://img.shields.io/static/v1?label=Product&message=hexpm&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2025-10-18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages.When an API key is exchanged for a token through the OAuth client_credentials grant, validate_scopes_against_key/2 in lib/hexpm_web/controllers/api/oauth_controller.ex admits a requested scope whenever the key carries the repositories permission and the scope string begins with repository:. The organization name is never resolved against the principal, and expand_repositories_scope/3 only rewrites the literal repositories scope, so an explicit repository:<name> passes through untouched. Both CDN edges authorize repository access from the token claim without querying the database, so the minted token is read access to that organization's private packages until it expires.This issue affects hex.pm: from 2025-10-18 before 2026-08-24. + +### POC + +#### Reference +- https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75601.md b/2026/CVE-2026-75601.md new file mode 100644 index 0000000000..0c2e691f4a --- /dev/null +++ b/2026/CVE-2026-75601.md @@ -0,0 +1,17 @@ +### [CVE-2026-75601](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75601) +![](https://img.shields.io/static/v1?label=Product&message=static-web-server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.44.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) + +### Description + +Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0. + +### POC + +#### Reference +- https://github.com/static-web-server/static-web-server/security/advisories/GHSA-97q6-jph8-rxgm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75608.md b/2026/CVE-2026-75608.md new file mode 100644 index 0000000000..dcc77ee245 --- /dev/null +++ b/2026/CVE-2026-75608.md @@ -0,0 +1,17 @@ +### [CVE-2026-75608](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75608) +![](https://img.shields.io/static/v1?label=Product&message=frigate&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.18.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal addresses, configuration paths, application logs, goroutine stack data, and RTSP stream URLs that may contain camera credentials. Non-GET methods remain blocked by limit_except GET. This issue is fixed in version 0.18.0. + +### POC + +#### Reference +- https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75758.md b/2026/CVE-2026-75758.md new file mode 100644 index 0000000000..1163229fbe --- /dev/null +++ b/2026/CVE-2026-75758.md @@ -0,0 +1,20 @@ +### [CVE-2026-75758](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75758) +![](https://img.shields.io/static/v1?label=Product&message=elixir&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.15.0-rc.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.19.0-rc.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.20.0-rc.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9718f2b90ce086ff8614d5782f4ec528495c98dd%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-674%20Uncontrolled%20Recursion&color=brightgreen) + +### Description + +Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory.Inspect.List's charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using List.ascii_printable?/2, which examines only the first :printable_limit (4096 by default) elements, and then calls IO.chardata_to_string/1 on the whole term. A list whose printable prefix exceeds that limit but which contains a later element that is not a code point (an atom, an out-of-range integer, or an improper tail) is therefore mis-classified, and the conversion raises ArgumentError. That conversion runs inside List.to_string/1, whose rescue clause builds its message by interpolating inspect(list), which re-enters the same branch and raises again. The nested inspection is an argument to raise, so the recursion is not in tail position and every level is retained: the process stack grows monotonically while each cycle re-walks the list, until the process is killed by max_heap_size or, by default, the node runs out of memory. List.to_charlist/1 has the same rescue shape.Below the printable limit the inner inspect/1 sees the invalid element within its counter and renders the list in ordinary bracket form, so a single ArgumentError is raised and no recursion occurs.This issue affects elixir: from 1.15.0-rc.0 before 1.18.5, from 1.19.0-rc.0 before 1.19.6, and from 1.20.0-rc.0 before 1.20.4. + +### POC + +#### Reference +- https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75773.md b/2026/CVE-2026-75773.md new file mode 100644 index 0000000000..df81e9d8a9 --- /dev/null +++ b/2026/CVE-2026-75773.md @@ -0,0 +1,50 @@ +### [CVE-2026-75773](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75773) +![](https://img.shields.io/static/v1?label=Product&message=karakeep&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.21%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.22%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.23%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.24%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.25%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.26%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.27%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.28%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.29%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.30%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.31%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.32.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Control%20of%20Interaction%20Frequency&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Restriction%20of%20Excessive%20Authentication%20Attempts&color=brightgreen) + +### Description + +A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. Upgrading to version 0.33.0 is sufficient to fix this issue. The patch is identified as f7d042971d0d2bcc7119654830cf1eb93eabbf24. It is advisable to upgrade the affected component. + +### POC + +#### Reference +- https://github.com/karakeep-app/karakeep/issues/2919 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75783.md b/2026/CVE-2026-75783.md new file mode 100644 index 0000000000..0c3627cb48 --- /dev/null +++ b/2026/CVE-2026-75783.md @@ -0,0 +1,19 @@ +### [CVE-2026-75783](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75783) +![](https://img.shields.io/static/v1?label=Product&message=TEW-WLC100P&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=12.07b01%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used. + +### POC + +#### Reference +- https://github.com/meishigana/CVE/blob/main/team15_20260702/01_wlc100p-netifd/poc/poc-netifd-overflow.py +- https://github.com/meishigana/CVE/tree/main/team15_20260702/01_wlc100p-netifd + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75784.md b/2026/CVE-2026-75784.md new file mode 100644 index 0000000000..393ec43698 --- /dev/null +++ b/2026/CVE-2026-75784.md @@ -0,0 +1,18 @@ +### [CVE-2026-75784](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75784) +![](https://img.shields.io/static/v1?label=Product&message=TEW-WLC100&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1v2.07b01%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/meishigana/CVE/tree/main/team15_20260702/02_wlc100-nginx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75830.md b/2026/CVE-2026-75830.md new file mode 100644 index 0000000000..d08480d80a --- /dev/null +++ b/2026/CVE-2026-75830.md @@ -0,0 +1,18 @@ +### [CVE-2026-75830](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75830) +![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=External%20Control%20of%20File%20Name%20or%20Path&color=brightgreen) + +### Description + +grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15. + +### POC + +#### Reference +- https://github.com/getgrav/grav/security/advisories/GHSA-g6j3-8jv9-ch5f + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75840.md b/2026/CVE-2026-75840.md new file mode 100644 index 0000000000..2bb0b84dfd --- /dev/null +++ b/2026/CVE-2026-75840.md @@ -0,0 +1,18 @@ +### [CVE-2026-75840](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75840) +![](https://img.shields.io/static/v1?label=Product&message=arcadedb&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Comparison%20Using%20Wrong%20Factors&color=brightgreen) + +### Description + +ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type() to access java.util.zip.ZipFile or java.util.jar.JarFile classes and read arbitrary files on the host system as the ArcadeDB server process. + +### POC + +#### Reference +- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-wx28-2265-f788 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75841.md b/2026/CVE-2026-75841.md new file mode 100644 index 0000000000..20c863ab36 --- /dev/null +++ b/2026/CVE-2026-75841.md @@ -0,0 +1,18 @@ +### [CVE-2026-75841](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75841) +![](https://img.shields.io/static/v1?label=Product&message=arcadedb&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen) + +### Description + +ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or unavailability. + +### POC + +#### Reference +- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-xmjm-8q85-g778 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75843.md b/2026/CVE-2026-75843.md new file mode 100644 index 0000000000..cf1baec884 --- /dev/null +++ b/2026/CVE-2026-75843.md @@ -0,0 +1,18 @@ +### [CVE-2026-75843](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75843) +![](https://img.shields.io/static/v1?label=Product&message=arcadedb&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Privilege%20Management&color=brightgreen) + +### Description + +ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run unrestricted JavaScript that creates server-wide administrator accounts. + +### POC + +#### Reference +- https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p29f-345w-4qwf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75857.md b/2026/CVE-2026-75857.md new file mode 100644 index 0000000000..ead3d357d1 --- /dev/null +++ b/2026/CVE-2026-75857.md @@ -0,0 +1,19 @@ +### [CVE-2026-75857](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75857) +![](https://img.shields.io/static/v1?label=Product&message=CodeWhale&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.3.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8.41%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Privilege%20Management&color=brightgreen) + +### Description + +CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in 0.8.64. + +### POC + +#### Reference +- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-g29h-pfmp-qp9r + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75858.md b/2026/CVE-2026-75858.md new file mode 100644 index 0000000000..d52c3541fd --- /dev/null +++ b/2026/CVE-2026-75858.md @@ -0,0 +1,19 @@ +### [CVE-2026-75858](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75858) +![](https://img.shields.io/static/v1?label=Product&message=CodeWhale&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8.33%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8.41%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlm_open tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64. + +### POC + +#### Reference +- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-wrj3-vj8c-784f + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75859.md b/2026/CVE-2026-75859.md new file mode 100644 index 0000000000..493bf3c993 --- /dev/null +++ b/2026/CVE-2026-75859.md @@ -0,0 +1,19 @@ +### [CVE-2026-75859](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75859) +![](https://img.shields.io/static/v1?label=Product&message=CodeWhale&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8.41%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration. + +### POC + +#### Reference +- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-62f5-cp2p-vq95 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75877.md b/2026/CVE-2026-75877.md new file mode 100644 index 0000000000..2a04dd4bff --- /dev/null +++ b/2026/CVE-2026-75877.md @@ -0,0 +1,19 @@ +### [CVE-2026-75877](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75877) +![](https://img.shields.io/static/v1?label=Product&message=TV-IP751WIC&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=11.03.03%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged/websCheckRealm/FUN_00432574/FUN_0043372C of the component alphapd. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used. + +### POC + +#### Reference +- https://github.com/meishigana/CVE/blob/main/team15_20260702/09_751wic-apd-password-overflow/poc/poc-password-overflow.py +- https://github.com/meishigana/CVE/tree/main/team15_20260702/09_751wic-apd-password-overflow + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75898.md b/2026/CVE-2026-75898.md new file mode 100644 index 0000000000..f4b38f790c --- /dev/null +++ b/2026/CVE-2026-75898.md @@ -0,0 +1,17 @@ +### [CVE-2026-75898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75898) +![](https://img.shields.io/static/v1?label=Product&message=ragflow&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared assert_url_is_safe validator or pinning the resolved address, unlike the crawler, SearXNG, file-upload, and RSS fetch paths. A user who can create or trigger an agent can direct the server to fetch loopback, link-local, and RFC 1918 destinations, including cloud instance metadata endpoints and services co-located on the deployment network, and the response body is returned as the component output. Where an agent is configured to interpolate the chat query into the Invoke URL, the destination is chosen by whoever can send that query. + +### POC + +#### Reference +- https://github.com/infiniflow/ragflow/issues/15425 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75913.md b/2026/CVE-2026-75913.md new file mode 100644 index 0000000000..184316236d --- /dev/null +++ b/2026/CVE-2026-75913.md @@ -0,0 +1,19 @@ +### [CVE-2026-75913](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75913) +![](https://img.shields.io/static/v1?label=Product&message=CodeWhale&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.3.27%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8.41%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=External%20Control%20of%20File%20Name%20or%20Path&color=brightgreen) + +### Description + +CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in 0.8.64 by adding rev validation. + +### POC + +#### Reference +- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-7j5w-7r7x-9v27 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75914.md b/2026/CVE-2026-75914.md new file mode 100644 index 0000000000..ed25939890 --- /dev/null +++ b/2026/CVE-2026-75914.md @@ -0,0 +1,19 @@ +### [CVE-2026-75914](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75914) +![](https://img.shields.io/static/v1?label=Product&message=CodeWhale&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8.32%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8.41%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval. + +### POC + +#### Reference +- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-w7wx-5q49-r59w + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75976.md b/2026/CVE-2026-75976.md index 6300b207ad..d608b95b24 100644 --- a/2026/CVE-2026-75976.md +++ b/2026/CVE-2026-75976.md @@ -11,6 +11,7 @@ A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the ### POC #### Reference +- https://github.com/meishigana/CVE/blob/main/team15_20260702/10_823dru-rc-bof/poc/poc-rc-overflow.py - https://github.com/meishigana/CVE/tree/main/team15_20260702/10_823dru-rc-bof #### Github diff --git a/2026/CVE-2026-75984.md b/2026/CVE-2026-75984.md new file mode 100644 index 0000000000..b5648da434 --- /dev/null +++ b/2026/CVE-2026-75984.md @@ -0,0 +1,18 @@ +### [CVE-2026-75984](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75984) +![](https://img.shields.io/static/v1?label=Product&message=TEW-823DRU&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.1.02b01%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admin.cgi. The manipulation of the argument Hostname results in command injection. The attack can be launched remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/meishigana/CVE/tree/main/team15_20260702/11_823dru-rc-cmdi + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-76066.md b/2026/CVE-2026-76066.md new file mode 100644 index 0000000000..fec595820a --- /dev/null +++ b/2026/CVE-2026-76066.md @@ -0,0 +1,17 @@ +### [CVE-2026-76066](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76066) +![](https://img.shields.io/static/v1?label=Product&message=intentkit&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities. + +### POC + +#### Reference +- https://www.lasso.security/vulnerability-database/cve-2026-76066 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-76578.md b/2026/CVE-2026-76578.md index 1eb0dc3c2b..0c75497ef6 100644 --- a/2026/CVE-2026-76578.md +++ b/2026/CVE-2026-76578.md @@ -1,9 +1,15 @@ ### [CVE-2026-76578](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76578) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010.0%20Extended%20Update%20Support&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%206&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208.8%20Telecommunications%20Update%20Service&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208.8%20Update%20Services%20for%20SAP%20Solutions&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.2%20Update%20Services%20for%20SAP%20Solutions&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.4%20Update%20Services%20for%20SAP%20Solutions&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.6%20Extended%20Update%20Support&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) diff --git a/2026/CVE-2026-77931.md b/2026/CVE-2026-77931.md new file mode 100644 index 0000000000..33e10f2618 --- /dev/null +++ b/2026/CVE-2026-77931.md @@ -0,0 +1,17 @@ +### [CVE-2026-77931](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77931) +![](https://img.shields.io/static/v1?label=Product&message=MoviePilot&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20Used%20for%20LLM%20Prompting&color=brightgreen) + +### Description + +MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host. + +### POC + +#### Reference +- https://www.lasso.security/vulnerability-database/cve-2026-77931 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-79957.md b/2026/CVE-2026-79957.md new file mode 100644 index 0000000000..3bd1d3cbab --- /dev/null +++ b/2026/CVE-2026-79957.md @@ -0,0 +1,17 @@ +### [CVE-2026-79957](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-79957) +![](https://img.shields.io/static/v1?label=Product&message=SerTec&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.00%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). Any authenticated user can iterate the ID parameter to retrieve the full profile record of every other user, including passwords stored in cleartext (CWE-256), enabling account takeover and credential-stuffing attacks. + +### POC + +#### Reference +- https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-8260.md b/2026/CVE-2026-8260.md new file mode 100644 index 0000000000..49ecefc8bb --- /dev/null +++ b/2026/CVE-2026-8260.md @@ -0,0 +1,18 @@ +### [CVE-2026-8260](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8260) +![](https://img.shields.io/static/v1?label=Product&message=DCS-935L&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.10.01%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Buffer%20Overflow&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A vulnerability was found in D-Link DCS-935L up to 1.10.01. The impacted element is the function SetDeviceSettings of the file /web/cgi-bin/hnap/hnap_service of the component HNAP Service. The manipulation of the argument AdminPassword results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. + +### POC + +#### Reference +- https://github.com/0xcc12138/DCS-935L-HNAP-Service-CVE + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-8270.md b/2026/CVE-2026-8270.md new file mode 100644 index 0000000000..da002c9c9c --- /dev/null +++ b/2026/CVE-2026-8270.md @@ -0,0 +1,24 @@ +### [CVE-2026-8270](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8270) +![](https://img.shields.io/static/v1?label=Product&message=Open5GS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen) + +### Description + +A vulnerability was determined in Open5GS up to 2.7.7. The affected element is the function ogs_nas_parse_qos_rules of the component SMF. Executing a manipulation can lead to denial of service. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/open5gs/open5gs/issues/4451 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82844.md b/2026/CVE-2026-82844.md new file mode 100644 index 0000000000..6927b931b9 --- /dev/null +++ b/2026/CVE-2026-82844.md @@ -0,0 +1,17 @@ +### [CVE-2026-82844](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82844) +![](https://img.shields.io/static/v1?label=Product&message=WPForms%20Lite&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.10.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-345%20Insufficient%20Verification%20of%20Data%20Authenticity&color=brightgreen) + +### Description + +The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its notification emails are sent even though no order exists at the payment provider and no payment is recorded. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/e959ddad-8588-4136-8518-6b1d772a62c4/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84192.md b/2026/CVE-2026-84192.md new file mode 100644 index 0000000000..2d44e776d2 --- /dev/null +++ b/2026/CVE-2026-84192.md @@ -0,0 +1,18 @@ +### [CVE-2026-84192](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84192) +![](https://img.shields.io/static/v1?label=Product&message=librenms&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog program fields that executes when authenticated users view affected pages. + +### POC + +#### Reference +- https://github.com/librenms/librenms/security/advisories/GHSA-7w8c-qgxg-m7jx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84206.md b/2026/CVE-2026-84206.md new file mode 100644 index 0000000000..68c3937ba6 --- /dev/null +++ b/2026/CVE-2026-84206.md @@ -0,0 +1,18 @@ +### [CVE-2026-84206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84206) +![](https://img.shields.io/static/v1?label=Product&message=snipe-it&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) + +### Description + +Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation. + +### POC + +#### Reference +- https://github.com/grokability/snipe-it/security/advisories/GHSA-m863-2j99-jxwm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84287.md b/2026/CVE-2026-84287.md new file mode 100644 index 0000000000..6df05e0047 --- /dev/null +++ b/2026/CVE-2026-84287.md @@ -0,0 +1,17 @@ +### [CVE-2026-84287](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84287) +![](https://img.shields.io/static/v1?label=Product&message=hermes-agent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.18.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen) + +### Description + +A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/api_server.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/hackerguopeng/cve/tree/main/Hermes_API_Server_Session_Chat_DoS_Report + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84289.md b/2026/CVE-2026-84289.md new file mode 100644 index 0000000000..4be4ce83c3 --- /dev/null +++ b/2026/CVE-2026-84289.md @@ -0,0 +1,20 @@ +### [CVE-2026-84289](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84289) +![](https://img.shields.io/static/v1?label=Product&message=hermes-agent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.18.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.18.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.18.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Resource%20Consumption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Uncontrolled%20Memory%20Allocation&color=brightgreen) + +### Description + +A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the component MCP Tool. Performing a manipulation results in uncontrolled memory allocation. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/lche511/cve/blob/main/Hermes_MCP_Tool_Resource_Amplification_DoS_Report/REPORT.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84312.md b/2026/CVE-2026-84312.md new file mode 100644 index 0000000000..efd9893dd5 --- /dev/null +++ b/2026/CVE-2026-84312.md @@ -0,0 +1,18 @@ +### [CVE-2026-84312](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84312) +![](https://img.shields.io/static/v1?label=Product&message=nginx-ui&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%3A%20Improper%20Authentication&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%3A%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) + +### Description + +Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated attacker can cause a victim's browser to complete an attacker-controlled Casdoor authorization flow, and the callback can mint a Nginx UI session for the identity returned by that authorization code. This issue is fixed in version 2.4.1. + +### POC + +#### Reference +- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-44xr-mrhh-qm78 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84315.md b/2026/CVE-2026-84315.md new file mode 100644 index 0000000000..909f17c8bd --- /dev/null +++ b/2026/CVE-2026-84315.md @@ -0,0 +1,17 @@ +### [CVE-2026-84315](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84315) +![](https://img.shields.io/static/v1?label=Product&message=nginx-ui&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1. + +### POC + +#### Reference +- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5v7c-xpfp-p65m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84317.md b/2026/CVE-2026-84317.md new file mode 100644 index 0000000000..d3145eb3d9 --- /dev/null +++ b/2026/CVE-2026-84317.md @@ -0,0 +1,18 @@ +### [CVE-2026-84317](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84317) +![](https://img.shields.io/static/v1?label=Product&message=nginx-ui&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-693%3A%20Protection%20Mechanism%20Failure&color=brightgreen) + +### Description + +Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path — the MCP tool nginx_config_add (mcp/config/config_add.go) — does NOT call it: it writes the caller-supplied content straight to disk and reloads nginx. An authenticated MCP caller (or an MCP agent induced via prompt injection) can therefore inject exactly the directives the control is meant to block, leading to nginx code execution on deployments where the njs/perl module is available (e.g. the official Docker image). This issue is fixed in version 2.4.1. + +### POC + +#### Reference +- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84318.md b/2026/CVE-2026-84318.md new file mode 100644 index 0000000000..2eacfe7101 --- /dev/null +++ b/2026/CVE-2026-84318.md @@ -0,0 +1,17 @@ +### [CVE-2026-84318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84318) +![](https://img.shields.io/static/v1?label=Product&message=nginx-ui&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.0.0-rc.6%2C%20%3C%202.4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-693%3A%20Protection%20Mechanism%20Failure&color=brightgreen) + +### Description + +Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui's entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1. + +### POC + +#### Reference +- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9jww-cxg5-rj9m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84366.md b/2026/CVE-2026-84366.md new file mode 100644 index 0000000000..2a00796a11 --- /dev/null +++ b/2026/CVE-2026-84366.md @@ -0,0 +1,17 @@ +### [CVE-2026-84366](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84366) +![](https://img.shields.io/static/v1?label=Product&message=scrapy&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.17.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-319%3A%20Cleartext%20Transmission%20of%20Sensitive%20Information&color=brightgreen) + +### Description + +Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta["is_secure"] is explicitly enabled, then signs and sends the plaintext request with configured AWS credentials. A network attacker who can observe traffic between Scrapy and S3 can read the bucket and key path, AWS Authorization header, X-Amz-Security-Token when temporary credentials are used, S3 object contents, and S3 response headers. An active man-in-the-middle attacker can also modify the plaintext S3 response body, status code, and headers before Scrapy processes them, causing scraped-data poisoning, poisoned exports, HTTP cache poisoning when caching is enabled, or influence over later crawl targets through forged redirects or attacker-controlled links. Users making S3-scheme requests with AWS credentials are affected. This issue is fixed in version 2.17.0. + +### POC + +#### Reference +- https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84425.md b/2026/CVE-2026-84425.md new file mode 100644 index 0000000000..cb0924c45a --- /dev/null +++ b/2026/CVE-2026-84425.md @@ -0,0 +1,20 @@ +### [CVE-2026-84425](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84425) +![](https://img.shields.io/static/v1?label=Product&message=CowAgent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen) + +### Description + +A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/hackerguopeng/cve/tree/main/CowAgent_Browser_Evaluate_Wait_DoS_Report + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84427.md b/2026/CVE-2026-84427.md new file mode 100644 index 0000000000..d4f3bb94a2 --- /dev/null +++ b/2026/CVE-2026-84427.md @@ -0,0 +1,24 @@ +### [CVE-2026-84427](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84427) +![](https://img.shields.io/static/v1?label=Product&message=CowAgent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen) + +### Description + +A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/outlookgp/CVE/tree/main/CowAgent_Bash_Output_Buffer_DoS_Report + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84437.md b/2026/CVE-2026-84437.md new file mode 100644 index 0000000000..a921a044e6 --- /dev/null +++ b/2026/CVE-2026-84437.md @@ -0,0 +1,19 @@ +### [CVE-2026-84437](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84437) +![](https://img.shields.io/static/v1?label=Product&message=OpenCart&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.1.0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1.0.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) + +### Description + +A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address_1 results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/Leousum/VulnPoC/blob/main/OpenCart_4.1.0.3/customer-address-stored-xss.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84448.md b/2026/CVE-2026-84448.md new file mode 100644 index 0000000000..7d50235b86 --- /dev/null +++ b/2026/CVE-2026-84448.md @@ -0,0 +1,18 @@ +### [CVE-2026-84448](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84448) +![](https://img.shields.io/static/v1?label=Product&message=libheif&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.23.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-131%3A%20Incorrect%20Calculation%20of%20Buffer%20Size&color=brightgreen) + +### Description + +libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() function in libheif/api/libheif/heif_regions.cc accepts mask_data_len without verifying that it equals the byte count required by width and height. A later heif_region_get_mask_image() call derives the read length from the region geometry, so an undersized stored buffer causes heif_region_get_inline_mask_image() to read beyond the heap allocation and copy adjacent bytes into the returned monochrome mask image. This can disclose heap data or crash an application that constructs region metadata through the writer API, while the file-parsing path is not affected because it validates the canonical mask size. This issue is fixed in version 1.23.2. + +### POC + +#### Reference +- https://github.com/strukturag/libheif/security/advisories/GHSA-p58j-h3vm-3fp5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84451.md b/2026/CVE-2026-84451.md index 839131b60e..42d2b86d60 100644 --- a/2026/CVE-2026-84451.md +++ b/2026/CVE-2026-84451.md @@ -11,6 +11,7 @@ libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1. #### Reference - https://github.com/strukturag/libheif/commit/8bfed9a9ed008e4ef28abc736284a90d3cba754f +- https://github.com/strukturag/libheif/security/advisories/GHSA-hh47-fhqr-cj2r #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-84484.md b/2026/CVE-2026-84484.md new file mode 100644 index 0000000000..e50bf4f064 --- /dev/null +++ b/2026/CVE-2026-84484.md @@ -0,0 +1,17 @@ +### [CVE-2026-84484](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84484) +![](https://img.shields.io/static/v1?label=Product&message=ION-DTN&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen) + +### Description + +ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote attackers to read memory by sending truncated SDNV values. Attackers can send a UDP datagram to the LTP link service input port with a truncated SDNV to trigger reads up to nine bytes past buffer boundaries and underflow byte counters. + +### POC + +#### Reference +- https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-85pw-28vw-2jf7 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84840.md b/2026/CVE-2026-84840.md index dacbfad027..6aea2ef511 100644 --- a/2026/CVE-2026-84840.md +++ b/2026/CVE-2026-84840.md @@ -16,6 +16,7 @@ A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affect ### POC #### Reference +- https://github.com/mano257200/TSI-DPDP-CMS-Unauthenticated-Super-Admin-Bootstrap-Endpoint/blob/main/README.md - https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/docs/security-fixes/2.md #### Github diff --git a/2026/CVE-2026-84841.md b/2026/CVE-2026-84841.md new file mode 100644 index 0000000000..d0a325037e --- /dev/null +++ b/2026/CVE-2026-84841.md @@ -0,0 +1,22 @@ +### [CVE-2026-84841](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84841) +![](https://img.shields.io/static/v1?label=Product&message=tsi-dpdp-cms&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.5.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Client-Side%20Enforcement%20of%20Server-Side%20Security&color=brightgreen) + +### Description + +A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.1 is able to resolve this issue. It is recommended to upgrade the affected component. + +### POC + +#### Reference +- https://github.com/mano257200/TSI-DPDP-CMS-Client-Side-Only-Authentication-Allows-Complete-Bypass-via-Direct-HTTP-Request/blob/main/README.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-84992.md b/2026/CVE-2026-84992.md new file mode 100644 index 0000000000..b5a5941e58 --- /dev/null +++ b/2026/CVE-2026-84992.md @@ -0,0 +1,17 @@ +### [CVE-2026-84992](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84992) +![](https://img.shields.io/static/v1?label=Product&message=md-editor-v3&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%206.5.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4 + +### POC + +#### Reference +- https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-85731.md b/2026/CVE-2026-85731.md new file mode 100644 index 0000000000..adac6fa385 --- /dev/null +++ b/2026/CVE-2026-85731.md @@ -0,0 +1,18 @@ +### [CVE-2026-85731](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85731) +![](https://img.shields.io/static/v1?label=Product&message=oras-go&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.6.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-59%3A%20Improper%20Link%20Resolution%20Before%20File%20Access%20('Link%20Following')&color=brightgreen) + +### Description + +oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2. + +### POC + +#### Reference +- https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-85750.md b/2026/CVE-2026-85750.md new file mode 100644 index 0000000000..2674551aba --- /dev/null +++ b/2026/CVE-2026-85750.md @@ -0,0 +1,17 @@ +### [CVE-2026-85750](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85750) +![](https://img.shields.io/static/v1?label=Product&message=Piwigo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%2016.3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) + +### Description + +Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In more advanced scenarios, the Imagick support for Magick Scripting Language (MSL) may be abused to process attacker-controlled instructions, potentially leading to unauthorized server-side file writes and remote code execution, depending on configuration. This has been patched in 16.4.0. + +### POC + +#### Reference +- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-85990.md b/2026/CVE-2026-85990.md new file mode 100644 index 0000000000..3965a3b661 --- /dev/null +++ b/2026/CVE-2026-85990.md @@ -0,0 +1,18 @@ +### [CVE-2026-85990](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85990) +![](https://img.shields.io/static/v1?label=Product&message=leantime&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.10.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-269%3A%20Improper%20Privilege%20Management&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. A low-privilege authenticated user with an ordinary browser session can send the required X-Requested-With: XMLHttpRequest header and call leantime.rpc.api.api.createApiKeyWithProjects, which reaches Api::createApiKeyWithProjects, with an attacker-chosen role to create an interactive administrator account. The same missing per-method authorization exposes Plugins::installPlugin, Plugins::enablePlugin, Plugins::disablePlugin, and Plugins::removePlugin to ordinary authenticated users, permitting unauthorized plugin management. The complete provisionally grouped issue is fixed in version 3.10.0. + +### POC + +#### Reference +- https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-86476.md b/2026/CVE-2026-86476.md new file mode 100644 index 0000000000..55e2db998f --- /dev/null +++ b/2026/CVE-2026-86476.md @@ -0,0 +1,21 @@ +### [CVE-2026-86476](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86476) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%206&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%207&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Write&color=brightgreen) + +### Description + +A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process. + +### POC + +#### Reference +- https://redhat.atlassian.net/browse/PSIRTSUPT-23320 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-88998.md b/2026/CVE-2026-88998.md new file mode 100644 index 0000000000..d4b6027dc5 --- /dev/null +++ b/2026/CVE-2026-88998.md @@ -0,0 +1,17 @@ +### [CVE-2026-88998](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88998) +![](https://img.shields.io/static/v1?label=Product&message=Tickera&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-345%20Insufficient%20Verification%20of%20Data%20Authenticity&color=brightgreen) + +### Description + +The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/50fe4955-9193-4842-9ea6-1812d70d813e/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-89116.md b/2026/CVE-2026-89116.md new file mode 100644 index 0000000000..54c88c0c1c --- /dev/null +++ b/2026/CVE-2026-89116.md @@ -0,0 +1,17 @@ +### [CVE-2026-89116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89116) +![](https://img.shields.io/static/v1?label=Product&message=SAP%20yeoman-ui&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3F1.25.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command&color=brightgreen) + +### Description + +The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation. + +### POC + +#### Reference +- https://github.com/SAP/app-studio-toolkit/security/advisories/GHSA-vm9q-mf35-jwpx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-90502.md b/2026/CVE-2026-90502.md new file mode 100644 index 0000000000..d04bee6b6d --- /dev/null +++ b/2026/CVE-2026-90502.md @@ -0,0 +1,19 @@ +### [CVE-2026-90502](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-90502) +![](https://img.shields.io/static/v1?label=Product&message=ServerStatus&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) + +### Description + +A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/BlkSword/POC/blob/main/ServerStatus%20Stored%20.pdf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-91709.md b/2026/CVE-2026-91709.md new file mode 100644 index 0000000000..2486530fe7 --- /dev/null +++ b/2026/CVE-2026-91709.md @@ -0,0 +1,17 @@ +### [CVE-2026-91709](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-91709) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=153.0.8010.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Type%20confusion&color=brightgreen) + +### Description + +Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/547815507 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-91711.md b/2026/CVE-2026-91711.md new file mode 100644 index 0000000000..d65623dfcd --- /dev/null +++ b/2026/CVE-2026-91711.md @@ -0,0 +1,17 @@ +### [CVE-2026-91711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-91711) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=153.0.8010.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out%20of%20bounds%20write&color=brightgreen) + +### Description + +Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/558342353 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-91715.md b/2026/CVE-2026-91715.md new file mode 100644 index 0000000000..967d285698 --- /dev/null +++ b/2026/CVE-2026-91715.md @@ -0,0 +1,17 @@ +### [CVE-2026-91715](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-91715) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=153.0.8010.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Type%20confusion&color=brightgreen) + +### Description + +Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/558367547 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-91739.md b/2026/CVE-2026-91739.md new file mode 100644 index 0000000000..2ae9103df7 --- /dev/null +++ b/2026/CVE-2026-91739.md @@ -0,0 +1,17 @@ +### [CVE-2026-91739](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-91739) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=153.0.8010.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20authorization&color=brightgreen) + +### Description + +Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/521951328 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-91741.md b/2026/CVE-2026-91741.md new file mode 100644 index 0000000000..7a7530069e --- /dev/null +++ b/2026/CVE-2026-91741.md @@ -0,0 +1,17 @@ +### [CVE-2026-91741](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-91741) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=153.0.8010.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Type%20confusion&color=brightgreen) + +### Description + +Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/546413288 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-92156.md b/2026/CVE-2026-92156.md new file mode 100644 index 0000000000..8a6d3ec0fb --- /dev/null +++ b/2026/CVE-2026-92156.md @@ -0,0 +1,18 @@ +### [CVE-2026-92156](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-92156) +![](https://img.shields.io/static/v1?label=Product&message=fprime&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-131%3A%20Incorrect%20Calculation%20of%20Buffer%20Size&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-617%3A%20Reachable%20Assertion&color=brightgreen) + +### Description + +F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet descriptor, event identifier, and time-tag metadata consume part of the larger ComBuffer and leave a smaller remaining budget for log arguments; serialization failure then reaches an assertion. When a deployment bridges events through GenericHub into EventManager and forwards a legal Fw::LogBuffer larger than EventManager remaining log-argument budget, under standard F Prime assertion handling, a legal bridged event payload aborts or resets the process, causing denial of service. This issue is fixed in version 4.3.0. + +### POC + +#### Reference +- https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-92429.md b/2026/CVE-2026-92429.md new file mode 100644 index 0000000000..5e47787354 --- /dev/null +++ b/2026/CVE-2026-92429.md @@ -0,0 +1,17 @@ +### [CVE-2026-92429](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-92429) +![](https://img.shields.io/static/v1?label=Product&message=Rede%20Ita%C3%BA%20for%20WooCommerce&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.7.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-345%20Insufficient%20Verification%20of%20Data%20Authenticity&color=brightgreen) + +### Description + +The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/62c7edfc-2d18-4be6-ba36-215e90563d03/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9343.md b/2026/CVE-2026-9343.md new file mode 100644 index 0000000000..9e0801ac09 --- /dev/null +++ b/2026/CVE-2026-9343.md @@ -0,0 +1,49 @@ +### [CVE-2026-9343](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9343) +![](https://img.shields.io/static/v1?label=Product&message=EW-7438RPn&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.21%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.22%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.23%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.24%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.25%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.26%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.27%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.28%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.29%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.30%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.31%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=OS%20Command%20Injection&color=brightgreen) + +### Description + +A weakness has been identified in Edimax EW-7438RPn up to 1.31. The affected element is the function formWpsStart of the file /goform/formWpsStart of the component webs. This manipulation of the argument pinCode causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_1/1.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-93635.md b/2026/CVE-2026-93635.md new file mode 100644 index 0000000000..0fa1f47dd6 --- /dev/null +++ b/2026/CVE-2026-93635.md @@ -0,0 +1,17 @@ +### [CVE-2026-93635](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93635) +![](https://img.shields.io/static/v1?label=Product&message=Zimbra%20Collaboration%20Suite&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-90%20Improper%20neutralization%20of%20special%20elements%20used%20in%20an%20LDAP%20query%20('LDAP%20injection')&color=brightgreen) + +### Description + +LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries. + +### POC + +#### Reference +- https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-93637.md b/2026/CVE-2026-93637.md new file mode 100644 index 0000000000..f5fda8e48e --- /dev/null +++ b/2026/CVE-2026-93637.md @@ -0,0 +1,17 @@ +### [CVE-2026-93637](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93637) +![](https://img.shields.io/static/v1?label=Product&message=Zimbra%20Collaboration%20Suite&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-307%20Improper%20restriction%20of%20excessive%20authentication%20attempts&color=brightgreen) + +### Description + +An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request. + +### POC + +#### Reference +- https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-94034.md b/2026/CVE-2026-94034.md new file mode 100644 index 0000000000..40555feca9 --- /dev/null +++ b/2026/CVE-2026-94034.md @@ -0,0 +1,18 @@ +### [CVE-2026-94034](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94034) +![](https://img.shields.io/static/v1?label=Product&message=Drug%20Recommendation%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) + +### Description + +A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/change_password of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. + +### POC + +#### Reference +- https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/change_password/Readme.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-94035.md b/2026/CVE-2026-94035.md new file mode 100644 index 0000000000..dceb07942b --- /dev/null +++ b/2026/CVE-2026-94035.md @@ -0,0 +1,18 @@ +### [CVE-2026-94035](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94035) +![](https://img.shields.io/static/v1?label=Product&message=Drug%20Recommendation%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) + +### Description + +A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /drug_recommender/index.php. Executing a manipulation of the argument full name can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. + +### POC + +#### Reference +- https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/profile/Readme.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-94214.md b/2026/CVE-2026-94214.md index fe98a6ae4e..ee3aeaf982 100644 --- a/2026/CVE-2026-94214.md +++ b/2026/CVE-2026-94214.md @@ -1,12 +1,12 @@ ### [CVE-2026-94214](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94214) -![](https://img.shields.io/static/v1?label=Product&message=Evolution&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Velocity%20WebServer%20Evolution&color=blue) -![](https://img.shields.io/static/v1?label=Version&message=20260717%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Product&message=Evo%20iDX&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=iDX&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Open%20Redirect&color=brightgreen) ### Description -A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. +A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer. ### POC diff --git a/2026/CVE-2026-94216.md b/2026/CVE-2026-94216.md index 5a109271c4..1e8bd5ec01 100644 --- a/2026/CVE-2026-94216.md +++ b/2026/CVE-2026-94216.md @@ -1,13 +1,13 @@ ### [CVE-2026-94216](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94216) -![](https://img.shields.io/static/v1?label=Product&message=Evolution&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Velocity%20WebServer%20Evolution&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Evo%20iDX&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=iDX&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CRLF%20Injection&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=HTTP%20Response%20Splitting&color=brightgreen) ### Description -A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The validated environment is an EOL X7 (or an un-modelled legacy Evolution 21.x), and current supported releases (X10, X11, Velocity 5.x+) have no validated evidence of impact. +A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The validated environment is an EOL X7 (or an un-modelled legacy Evolution 21.x), and current supported releases (X10, X11, Velocity 5.x+) have no validated evidence of impact. This vulnerability only affects products that are no longer supported by the maintainer. ### POC diff --git a/2026/CVE-2026-94493.md b/2026/CVE-2026-94493.md new file mode 100644 index 0000000000..e7791809c2 --- /dev/null +++ b/2026/CVE-2026-94493.md @@ -0,0 +1,18 @@ +### [CVE-2026-94493](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94493) +![](https://img.shields.io/static/v1?label=Product&message=PDV5701&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0.31_240305_112640%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication&color=brightgreen) + +### Description + +A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/CSDVi/cve/issues/2 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-94494.md b/2026/CVE-2026-94494.md index 771318e457..11d54b7677 100644 --- a/2026/CVE-2026-94494.md +++ b/2026/CVE-2026-94494.md @@ -10,6 +10,7 @@ jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows ### POC #### Reference +- https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-09-tenant-cross-tenant-read.py - https://www.vulncheck.com/advisories/jsherp-through-3.6-tenant-information-disclosure-via-get-tenant-info #### Github diff --git a/2026/CVE-2026-9504.md b/2026/CVE-2026-9504.md new file mode 100644 index 0000000000..5930db982f --- /dev/null +++ b/2026/CVE-2026-9504.md @@ -0,0 +1,31 @@ +### [CVE-2026-9504](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9504) +![](https://img.shields.io/static/v1?label=Product&message=LibreDWG&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-Bounds%20Read&color=brightgreen) + +### Description + +A weakness has been identified in GNU LibreDWG up to 0.14. Affected is the function bit_convert_TU of the file programs/dwggrep.c of the component Dwggrep Utility. This manipulation causes out-of-bounds read. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: be996bf2178a40e98720f18c2414815d244413db. Applying a patch is the recommended action to fix this issue. + +### POC + +#### Reference +- https://github.com/LibreDWG/libredwg/issues/1246 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-95297.md b/2026/CVE-2026-95297.md new file mode 100644 index 0000000000..4cd4446041 --- /dev/null +++ b/2026/CVE-2026-95297.md @@ -0,0 +1,17 @@ +### [CVE-2026-95297](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-95297) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=154.0.8037.57%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20authorization&color=brightgreen) + +### Description + +Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/501648493 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9532.md b/2026/CVE-2026-9532.md new file mode 100644 index 0000000000..fb9bec4240 --- /dev/null +++ b/2026/CVE-2026-9532.md @@ -0,0 +1,18 @@ +### [CVE-2026-9532](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9532) +![](https://img.shields.io/static/v1?label=Product&message=CA750-PoE&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=6.2c.510%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=OS%20Command%20Injection&color=brightgreen) + +### Description + +A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Such manipulation of the argument FileName leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. + +### POC + +#### Reference +- https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_55/55.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9575.md b/2026/CVE-2026-9575.md new file mode 100644 index 0000000000..4c041ff5d8 --- /dev/null +++ b/2026/CVE-2026-9575.md @@ -0,0 +1,18 @@ +### [CVE-2026-9575](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9575) +![](https://img.shields.io/static/v1?label=Product&message=Student%20Transcript%20Processing%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0. This issue affects some unknown processing of the file /admin/modules/class/index.php?view=view. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +- https://github.com/nidieaaa/test/issues/14 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9581.md b/2026/CVE-2026-9581.md new file mode 100644 index 0000000000..533cf8b98d --- /dev/null +++ b/2026/CVE-2026-9581.md @@ -0,0 +1,21 @@ +### [CVE-2026-9581](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9581) +![](https://img.shields.io/static/v1?label=Product&message=JeecgBoot&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.9.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Privilege%20Assignment&color=brightgreen) + +### Description + +A vulnerability was identified in JeecgBoot up to 3.9.1. The impacted element is an unknown function of the file /sys/comment/add. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended. + +### POC + +#### Reference +- https://github.com/jeecgboot/JeecgBoot/issues/9598 +- https://github.com/jeecgboot/JeecgBoot/issues/9598#issuecomment-4385719753 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9631.md b/2026/CVE-2026-9631.md new file mode 100644 index 0000000000..6a1a6c7a99 --- /dev/null +++ b/2026/CVE-2026-9631.md @@ -0,0 +1,18 @@ +### [CVE-2026-9631](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9631) +![](https://img.shields.io/static/v1?label=Product&message=HiPER%201250GW&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.2.7-210907-180535%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/formConfigFastDirectionW of the component Web Management Interface. Performing a manipulation of the argument Profile results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/zhouguobing-maker/cve/blob/main/11.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-96512.md b/2026/CVE-2026-96512.md index 829e28169a..2150970c57 100644 --- a/2026/CVE-2026-96512.md +++ b/2026/CVE-2026-96512.md @@ -4,6 +4,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Hardened%20Images&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Update%20Infrastructure%205&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) diff --git a/2026/CVE-2026-96537.md b/2026/CVE-2026-96537.md new file mode 100644 index 0000000000..cccdca2905 --- /dev/null +++ b/2026/CVE-2026-96537.md @@ -0,0 +1,17 @@ +### [CVE-2026-96537](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96537) +![](https://img.shields.io/static/v1?label=Product&message=Tutor%20LMS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/e25ac9a8-a29d-4573-9d04-402a14515fb7/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-96596.md b/2026/CVE-2026-96596.md new file mode 100644 index 0000000000..daa11708ce --- /dev/null +++ b/2026/CVE-2026-96596.md @@ -0,0 +1,29 @@ +### [CVE-2026-96596](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96596) +![](https://img.shields.io/static/v1?label=Product&message=OTP&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=hex&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=hex_core&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=rebar3&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.14.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=13bb9fbba418a406af614790b8d5cd458259ee70%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.4.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=23dbdb5d1f87f56902aef296c88a20049cd0c6e4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=29.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.27.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5543a1919c709d8eb2b317f62aad76ca1eed375c%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=fbf2c7194f6fce4b7b66dc0bcaa4f6b4b85e088f%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-835%20Loop%20with%20Unreachable%20Exit%20Condition%20('Infinite%20Loop')&color=brightgreen) + +### Description + +Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member.When erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_file_loop/3 reads it in chunks of 65536 bytes by default. For a GNU sparse member whose sparse map ends before its real size, erl_tar:do_sparse_read/3 matches its trailing-hole clause before its zero-length clause. After the chunk is used up, the trailing-hole clause reads zero bytes, does not advance the position, and recurses forever. A 2048-byte archive keeps the extracting process and one scheduler busy until the process is killed. The {max_size, N} option prevents this only when N is below the real size of the member. Extraction with the memory option is not affected.hex_core ships its own copy of erl_tar as hex_erl_tar, and Hex and rebar3 ship hex_core with prefixed module names (mix_hex_erl_tar and r3_hex_erl_tar). These copies contain the same code and do not call stdlib's erl_tar, so they are affected on any OTP version. OTP 28 is not affected, but an application running on OTP 28 is affected if it extracts archives through an affected version of hex_core, Hex or rebar3.This issue affects OTP from OTP 29.0 before OTP 29.1.2, corresponding to stdlib from 8.0 before 8.1.1, and rebar3 from 3.27.1 onward, and hex from 2.4.2 before 2.5.3; hex_core: from 0.14.0 before 0.20.1. + +### POC + +#### Reference +- https://cna.erlef.org/cves/CVE-2026-96596.html +- https://osv.dev/vulnerability/EEF-CVE-2026-96596 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-97315.md b/2026/CVE-2026-97315.md new file mode 100644 index 0000000000..04c4d159c6 --- /dev/null +++ b/2026/CVE-2026-97315.md @@ -0,0 +1,17 @@ +### [CVE-2026-97315](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97315) +![](https://img.shields.io/static/v1?label=Product&message=Responsive%20Blocks&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-74%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Output%20Used%20by%20a%20Downstream%20Component%20('Injection')&color=brightgreen) + +### Description + +The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/83713678-7efc-4cfc-ba24-c624a1ef8622/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/references.txt b/references.txt index 05d76a38ef..2779edb0b5 100644 --- a/references.txt +++ b/references.txt @@ -50,6 +50,8 @@ CVE-2000-0267 - http://www.cisco.com/warp/public/707/catos-enable-bypass-pub.sht CVE-2000-0268 - http://www.cisco.com/warp/public/707/iostelnetopt-pub.shtml CVE-2000-0275 - http://www.l0pht.com/advisories/cc-pinextract.txt CVE-2000-0342 - http://news.cnet.com/news/0-1005-200-1773077.html?tag=st.ne.fd.lthd.1005-200-1773077 +CVE-2000-0357 - http://www.redhat.com/corp/support/errata/RHSA1999058-01.html +CVE-2000-0358 - http://www.redhat.com/corp/support/errata/RHSA1999058-01.html CVE-2000-0359 - http://www.securityfocus.com/bid/1248 CVE-2000-0368 - http://www.cisco.com/warp/public/770/ioshist-pub.shtml CVE-2000-0380 - http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml @@ -631,6 +633,11 @@ CVE-2003-0226 - https://oval.cisecurity.org/repository/search/definition/oval%3A CVE-2003-0227 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A936 CVE-2003-0227 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A966 CVE-2003-0232 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A303 +CVE-2003-0235 - http://www.coresecurity.com/common/showdoc.php?idx=315&idxseccion=10 +CVE-2003-0236 - http://www.coresecurity.com/common/showdoc.php?idx=315&idxseccion=10 +CVE-2003-0237 - http://www.coresecurity.com/common/showdoc.php?idx=315&idxseccion=10 +CVE-2003-0238 - http://www.coresecurity.com/common/showdoc.php?idx=315&idxseccion=10 +CVE-2003-0239 - http://www.coresecurity.com/common/showdoc.php?idx=315&idxseccion=10 CVE-2003-0255 - http://www.linuxsecurity.com/advisories/engarde_advisory-3258.html CVE-2003-0257 - http://www-1.ibm.com/services/continuity/recover1.nsf/MSS/MSS-OAR-E01-2003.0660.1 CVE-2003-0258 - http://www.cisco.com/warp/public/707/cisco-sa-20030507-vpn3k.shtml @@ -8108,6 +8115,7 @@ CVE-2007-1342 - http://securityreason.com/securityalert/2396 CVE-2007-1347 - http://lostmon.blogspot.com/2007/08/windows-extended-file-attributes-buffer.html CVE-2007-1347 - https://www.exploit-db.com/exploits/3419 CVE-2007-1350 - http://securityreason.com/securityalert/2395 +CVE-2007-1351 - http://sourceforge.net/project/shownotes.php?group_id=3157&release_id=498954 CVE-2007-1355 - http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx CVE-2007-1355 - http://securityreason.com/securityalert/2722 CVE-2007-1357 - http://www.novell.com/linux/security/advisories/2007_30_kernel.html @@ -13847,6 +13855,7 @@ CVE-2008-3522 - http://bugs.gentoo.org/attachment.cgi?id=163282&action=view CVE-2008-3522 - http://www.ubuntu.com/usn/USN-742-1 CVE-2008-3525 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9364 CVE-2008-3527 - http://www.redhat.com/support/errata/RHSA-2008-0957.html +CVE-2008-3528 - http://www.redhat.com/support/errata/RHSA-2009-0326.html CVE-2008-3528 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html CVE-2008-3529 - http://www.ubuntu.com/usn/USN-815-1 CVE-2008-3529 - https://www.exploit-db.com/exploits/8798 @@ -16032,6 +16041,7 @@ CVE-2008-5697 - http://securityreason.com/securityalert/4797 CVE-2008-5697 - https://www.exploit-db.com/exploits/6690 CVE-2008-5698 - http://securityreason.com/securityalert/4796 CVE-2008-5698 - https://www.exploit-db.com/exploits/6718 +CVE-2008-5700 - http://www.redhat.com/support/errata/RHSA-2009-0326.html CVE-2008-5700 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html CVE-2008-5705 - http://securityreason.com/securityalert/4800 CVE-2008-5705 - https://www.exploit-db.com/exploits/7183 @@ -17202,6 +17212,7 @@ CVE-2009-0023 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 CVE-2009-0023 - http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html CVE-2009-0023 - http://www.redhat.com/support/errata/RHSA-2009-1107.html CVE-2009-0026 - http://securityreason.com/securityalert/4942 +CVE-2009-0028 - http://www.redhat.com/support/errata/RHSA-2009-0326.html CVE-2009-0028 - http://www.ubuntu.com/usn/usn-751-1 CVE-2009-0028 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html CVE-2009-0031 - http://www.ubuntu.com/usn/usn-751-1 @@ -17364,6 +17375,7 @@ CVE-2009-0261 - https://www.exploit-db.com/exploits/7839 CVE-2009-0262 - https://www.exploit-db.com/exploits/7737 CVE-2009-0263 - https://www.exploit-db.com/exploits/7742 CVE-2009-0264 - http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html +CVE-2009-0269 - http://www.redhat.com/support/errata/RHSA-2009-0326.html CVE-2009-0269 - http://www.ubuntu.com/usn/usn-751-1 CVE-2009-0269 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html CVE-2009-0270 - http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html @@ -17393,6 +17405,7 @@ CVE-2009-0316 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493937 CVE-2009-0316 - https://bugzilla.redhat.com/show_bug.cgi?id=481565 CVE-2009-0317 - https://bugzilla.redhat.com/show_bug.cgi?id=481570 CVE-2009-0321 - http://lostmon.blogspot.com/2009/01/safari-for-windows-321-remote-http-uri.html +CVE-2009-0322 - http://www.redhat.com/support/errata/RHSA-2009-0326.html CVE-2009-0322 - http://www.ubuntu.com/usn/usn-751-1 CVE-2009-0322 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html CVE-2009-0323 - http://www.coresecurity.com/content/amaya-buffer-overflows @@ -17618,8 +17631,10 @@ CVE-2009-0673 - http://www.waraxe.us/advisory-72.html CVE-2009-0673 - https://www.exploit-db.com/exploits/8068 CVE-2009-0674 - http://www.waraxe.us/advisory-72.html CVE-2009-0674 - https://www.exploit-db.com/exploits/8068 +CVE-2009-0675 - http://www.redhat.com/support/errata/RHSA-2009-0326.html CVE-2009-0675 - http://www.ubuntu.com/usn/usn-751-1 CVE-2009-0675 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html +CVE-2009-0676 - http://www.redhat.com/support/errata/RHSA-2009-0326.html CVE-2009-0676 - http://www.ubuntu.com/usn/usn-751-1 CVE-2009-0676 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html CVE-2009-0677 - http://www.waraxe.us/advisory-72.html @@ -17706,6 +17721,7 @@ CVE-2009-0775 - https://bugzilla.mozilla.org/show_bug.cgi?id=474456 CVE-2009-0775 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9681 CVE-2009-0776 - http://www.redhat.com/support/errata/RHSA-2009-0258.html CVE-2009-0776 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9241 +CVE-2009-0778 - http://www.redhat.com/support/errata/RHSA-2009-0326.html CVE-2009-0778 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html CVE-2009-0781 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html CVE-2009-0783 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html @@ -30348,6 +30364,7 @@ CVE-2013-2294 - http://seclists.org/fulldisclosure/2013/Mar/174 CVE-2013-2294 - http://www.exploit-db.com/exploits/24862 CVE-2013-2296 - https://eucalyptus.atlassian.net/browse/EUCA-3074 CVE-2013-2299 - http://ics-cert.us-cert.gov/advisories/ICSA-13-225-01 +CVE-2013-2347 - http://ddilabs.blogspot.com/2014/02/fun-with-hp-data-protector-execbar.html CVE-2013-2347 - http://www.exploit-db.com/exploits/32164 CVE-2013-2352 - http://www.theregister.co.uk/2013/07/09/hp_storage_more_possible_backdoors/ CVE-2013-2371 - http://www.tibco.com/mk/advisory.jsp @@ -47319,6 +47336,7 @@ CVE-2016-15055 - https://www.exploit-db.com/exploits/40282 CVE-2016-15056 - https://seclists.org/fulldisclosure/2016/Jul/66 CVE-2016-15056 - https://web.archive.org/web/20160726145043/http://www.search-lab.hu/advisories/122-ubee-evw3226-modem-router-multiple-vulnerabilities CVE-2016-15056 - https://www.exploit-db.com/exploits/40156 +CVE-2016-15060 - https://www.exploit-db.com/exploits/40714 CVE-2016-1513 - http://www.openoffice.org/security/cves/CVE-2016-1513.html CVE-2016-1516 - https://github.com/opencv/opencv/issues/5956 CVE-2016-1517 - https://github.com/opencv/opencv/issues/5956 @@ -47770,6 +47788,8 @@ CVE-2016-20094 - https://www.exploit-db.com/exploits/40410 CVE-2016-20095 - https://www.exploit-db.com/exploits/39908 CVE-2016-20096 - https://web.archive.org/web/20160601102456/http://www.wooyun.org/bugs/wooyun-2010-0145458 CVE-2016-20097 - https://www.weaver.com.cn/cs/ecology_full_log_en.html +CVE-2016-20099 - https://hackmd.io/@haind-pwn/cve-2016-20099-2026-110599-l-smash-hevc-importer-double-free +CVE-2016-20099 - https://hackmd.io/@haind-pwn/l-smash-hevc-importer-double-free CVE-2016-2010 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564 CVE-2016-2011 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564 CVE-2016-2012 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564 @@ -79202,6 +79222,7 @@ CVE-2020-11655 - https://www.oracle.com/security-alerts/cpuApr2021.html CVE-2020-11655 - https://www.oracle.com/security-alerts/cpujan2021.html CVE-2020-11655 - https://www.oracle.com/security-alerts/cpujul2020.html CVE-2020-11655 - https://www.oracle.com/security-alerts/cpuoct2020.html +CVE-2020-11656 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2020-11656 - https://www.oracle.com/security-alerts/cpuApr2021.html CVE-2020-11656 - https://www.oracle.com/security-alerts/cpujan2021.html CVE-2020-11656 - https://www.oracle.com/security-alerts/cpujul2020.html @@ -80168,11 +80189,14 @@ CVE-2020-13626 - https://medium.com/@bugsbunnyy1107/the-tell-tale-of-cve-in-onep CVE-2020-13627 - https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/ CVE-2020-13628 - https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon/ CVE-2020-13630 - http://seclists.org/fulldisclosure/2020/Nov/19 +CVE-2020-13630 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2020-13630 - https://www.oracle.com/security-alerts/cpujul2020.html CVE-2020-13630 - https://www.oracle.com/security-alerts/cpuoct2020.html CVE-2020-13631 - http://seclists.org/fulldisclosure/2020/Nov/19 +CVE-2020-13631 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2020-13631 - https://www.oracle.com/security-alerts/cpujul2020.html CVE-2020-13631 - https://www.oracle.com/security-alerts/cpuoct2020.html +CVE-2020-13632 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2020-13632 - https://www.oracle.com/security-alerts/cpujul2020.html CVE-2020-13632 - https://www.oracle.com/security-alerts/cpuoct2020.html CVE-2020-13640 - http://www.openwall.com/lists/oss-security/2020/07/06/1 @@ -80262,6 +80286,7 @@ CVE-2020-13866 - http://seclists.org/fulldisclosure/2020/Jun/11 CVE-2020-13868 - https://github.com/verbb/comments/blob/craft-3/CHANGELOG.md#155---2020-05-28-critical CVE-2020-13869 - https://github.com/verbb/comments/blob/craft-3/CHANGELOG.md#155---2020-05-28-critical CVE-2020-13870 - https://github.com/verbb/comments/blob/craft-3/CHANGELOG.md#155---2020-05-28-critical +CVE-2020-13871 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2020-13871 - https://www.oracle.com/security-alerts/cpuApr2021.html CVE-2020-13871 - https://www.oracle.com/security-alerts/cpujan2021.html CVE-2020-13871 - https://www.sqlite.org/src/info/c8d3b9f0a750a529 @@ -81040,6 +81065,7 @@ CVE-2020-15357 - https://medium.com/csg-govtech/bolstering-security-how-i-breach CVE-2020-15357 - https://starlabs.sg/advisories/ CVE-2020-15357 - https://www.askey.com.tw/incident_report_notifications.html CVE-2020-15358 - http://seclists.org/fulldisclosure/2020/Nov/19 +CVE-2020-15358 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2020-15358 - https://usn.ubuntu.com/4438-1/ CVE-2020-15358 - https://www.oracle.com/security-alerts/cpuApr2021.html CVE-2020-15358 - https://www.oracle.com/security-alerts/cpuapr2022.html @@ -89415,6 +89441,7 @@ CVE-2021-22871 - http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0 CVE-2021-22872 - http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html CVE-2021-22872 - https://hackerone.com/reports/986365 CVE-2021-22873 - http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html +CVE-2021-22876 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22876 - https://www.oracle.com//security-alerts/cpujul2021.html CVE-2021-2288 - https://www.oracle.com/security-alerts/cpuapr2021.html CVE-2021-22883 - https://www.oracle.com//security-alerts/cpujul2021.html @@ -89425,9 +89452,11 @@ CVE-2021-22884 - https://www.oracle.com/security-alerts/cpuApr2021.html CVE-2021-22884 - https://www.oracle.com/security-alerts/cpuoct2021.html CVE-2021-22887 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44712 CVE-2021-2289 - https://www.oracle.com/security-alerts/cpuapr2021.html +CVE-2021-22890 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22890 - https://www.oracle.com//security-alerts/cpujul2021.html CVE-2021-22893 - https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html CVE-2021-22894 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/?kA23Z000000boUWSAY +CVE-2021-22897 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22897 - https://www.oracle.com//security-alerts/cpujul2021.html CVE-2021-22897 - https://www.oracle.com/security-alerts/cpuapr2022.html CVE-2021-22897 - https://www.oracle.com/security-alerts/cpujan2022.html @@ -89438,6 +89467,7 @@ CVE-2021-22898 - https://www.oracle.com/security-alerts/cpujan2022.html CVE-2021-22899 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/?kA23Z000000boUWSAY CVE-2021-2290 - https://www.oracle.com/security-alerts/cpuapr2021.html CVE-2021-22900 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/?kA23Z000000boUWSAY +CVE-2021-22901 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22901 - https://www.oracle.com//security-alerts/cpujul2021.html CVE-2021-22901 - https://www.oracle.com/security-alerts/cpuapr2022.html CVE-2021-22901 - https://www.oracle.com/security-alerts/cpujan2022.html @@ -89446,13 +89476,18 @@ CVE-2021-2291 - https://www.oracle.com/security-alerts/cpuapr2021.html CVE-2021-22911 - http://packetstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html CVE-2021-22911 - http://packetstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html CVE-2021-2292 - https://www.oracle.com/security-alerts/cpuapr2021.html +CVE-2021-22922 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22922 - https://www.oracle.com/security-alerts/cpuoct2021.html +CVE-2021-22923 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22923 - https://www.oracle.com/security-alerts/cpuoct2021.html +CVE-2021-22924 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22924 - https://www.oracle.com/security-alerts/cpujan2022.html CVE-2021-22924 - https://www.oracle.com/security-alerts/cpuoct2021.html CVE-2021-22925 - http://seclists.org/fulldisclosure/2021/Sep/39 +CVE-2021-22925 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22925 - https://www.oracle.com/security-alerts/cpujan2022.html CVE-2021-22925 - https://www.oracle.com/security-alerts/cpuoct2021.html +CVE-2021-22926 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22926 - https://www.oracle.com/security-alerts/cpujan2022.html CVE-2021-22926 - https://www.oracle.com/security-alerts/cpuoct2021.html CVE-2021-2293 - https://www.oracle.com/security-alerts/cpuapr2021.html @@ -89466,11 +89501,14 @@ CVE-2021-2294 - https://www.oracle.com/security-alerts/cpuapr2021.html CVE-2021-22940 - https://www.oracle.com/security-alerts/cpujan2022.html CVE-2021-22940 - https://www.oracle.com/security-alerts/cpujul2022.html CVE-2021-22940 - https://www.oracle.com/security-alerts/cpuoct2021.html +CVE-2021-22945 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22945 - https://www.oracle.com/security-alerts/cpuoct2021.html +CVE-2021-22946 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22946 - https://www.oracle.com/security-alerts/cpuapr2022.html CVE-2021-22946 - https://www.oracle.com/security-alerts/cpujan2022.html CVE-2021-22946 - https://www.oracle.com/security-alerts/cpujul2022.html CVE-2021-22946 - https://www.oracle.com/security-alerts/cpuoct2021.html +CVE-2021-22947 - https://cert-portal.siemens.com/productcert/html/ssa-389290.html CVE-2021-22947 - https://www.oracle.com/security-alerts/cpuapr2022.html CVE-2021-22947 - https://www.oracle.com/security-alerts/cpujan2022.html CVE-2021-22947 - https://www.oracle.com/security-alerts/cpujul2022.html @@ -96316,6 +96354,7 @@ CVE-2021-41614 - https://seth.engr.tamu.edu/software-releases/thehuzz/ CVE-2021-41615 - https://github.com/trenta3/goahead-versions/blob/master/2.1.8/230165webs218.tar.gz?raw=true CVE-2021-41617 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2021-41617 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2021-41617 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2021-41617 - https://www.oracle.com/security-alerts/cpuapr2022.html CVE-2021-41617 - https://www.oracle.com/security-alerts/cpujul2022.html CVE-2021-41617 - https://www.tenable.com/plugins/nessus/154174 @@ -97738,6 +97777,7 @@ CVE-2021-44848 - https://github.com/cybelesoft/virtualui/issues/1 CVE-2021-44864 - https://github.com/zhlu32/cve/blob/main/tplink/wr886n/Tplink-wr886n-V3-Ping-DOS.md CVE-2021-44868 - https://github.com/ming-soft/MCMS/issues/58 CVE-2021-44879 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3 +CVE-2021-44879 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2021-44879 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9056d6489f5a41cfbb67f719d2c0ce61ead72d9f CVE-2021-44880 - https://www.dlink.com/en/security-bulletin/ CVE-2021-44881 - https://www.dlink.com/en/security-bulletin/ @@ -113431,6 +113471,7 @@ CVE-2023-28528 - http://packetstormsecurity.com/files/172458/IBM-AIX-7.2-inscout CVE-2023-28528 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1691 CVE-2023-28531 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2023-28531 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2023-28531 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2023-28536 - https://patchstack.com/database/wordpress/plugin/branded-social-images/vulnerability/wordpress-branded-social-images-plugin-1-1-0-broken-access-control-vulnerability?_s_id=cve CVE-2023-2859 - https://huntr.dev/bounties/d7b8ea75-c74a-4721-89bb-12e5c80fb0ba CVE-2023-28596 - https://explore.zoom.us/en/trust/security/security-bulletin/ @@ -115262,6 +115303,7 @@ CVE-2023-3582 - https://mattermost.com/security-updates CVE-2023-35823 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.2 CVE-2023-35824 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.2 CVE-2023-35826 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.2 +CVE-2023-35827 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2023-35828 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.2 CVE-2023-35829 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.2 CVE-2023-35839 - https://github.com/noear/solon/issues/145 @@ -116475,6 +116517,7 @@ CVE-2023-40291 - https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-i CVE-2023-40292 - https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/ CVE-2023-40293 - https://autohack.in/2023/07/26/dude-its-my-car-how-to-develop-intimacy-with-your-car/ CVE-2023-40297 - https://github.com/sahar042/CVE-2023-40297 +CVE-2023-40299 - https://github.com/Kong/insomnia/releases CVE-2023-40305 - https://savannah.gnu.org/bugs/index.php?64503 CVE-2023-40307 - https://github.com/SAP/macOS-enterprise-privileges/security/advisories/GHSA-rgq4-wxpj-5jv9 CVE-2023-4033 - https://huntr.dev/bounties/5312d6f8-67a5-4607-bd47-5e19966fa321 @@ -117676,6 +117719,7 @@ CVE-2023-45852 - https://github.com/Push3AX/vul/blob/main/viessmann/Vitogate300_ CVE-2023-45854 - https://kafka-esc.com/posts/2024/09/cve-2023-45854-interger-overflow-in-shopkit-1.0/ CVE-2023-45862 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.5 CVE-2023-45863 - https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.3 +CVE-2023-45863 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2023-45864 - https://semiconductor.samsung.com/support/quality-support/product-security-updates/ CVE-2023-45866 - https://github.com/skysafe/reblog/tree/main/cve-2023-45866 CVE-2023-45867 - https://rehmeinfosec.de/labor/cve-2023-45867 @@ -118903,6 +118947,7 @@ CVE-2023-5133 - https://wpscan.com/vulnerability/36c30e54-75e4-4df1-b01a-60c51c0 CVE-2023-5137 - https://wpscan.com/vulnerability/79b79e9c-ea4f-4188-a1b5-61dda0b5d434 CVE-2023-51384 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2023-51384 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2023-51384 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2023-51385 - http://www.openwall.com/lists/oss-security/2025/10/07/1 CVE-2023-51385 - http://www.openwall.com/lists/oss-security/2025/10/12/1 CVE-2023-51385 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html @@ -118996,6 +119041,7 @@ CVE-2023-51775 - https://bitbucket.org/b_c/jose4j/issues/212 CVE-2023-51776 - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf CVE-2023-51777 - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf CVE-2023-51778 - https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf +CVE-2023-5178 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2023-51790 - https://github.com/Piwigo/AdminTools/issues/21 CVE-2023-51790 - https://github.com/Piwigo/Piwigo/issues/2069 CVE-2023-51791 - https://ffmpeg.org/ @@ -119167,6 +119213,7 @@ CVE-2023-5261 - https://github.com/csbsong/bug_report/blob/main/sql2.md CVE-2023-52614 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2023-5262 - https://vuldb.com/?id.240871 CVE-2023-52620 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2023-52622 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2023-5264 - https://github.com/yhy217/huakecms-vul/issues/1 CVE-2023-5265 - https://github.com/YaGaoT/cve/blob/main/sql.md CVE-2023-52664 - https://git.kernel.org/stable/c/b3cb7a830a24527877b0bc900b9bd74a96aea928 @@ -119186,6 +119233,8 @@ CVE-2023-5289 - https://huntr.dev/bounties/8d0e0804-d3fd-49fe-bfa4-7a91135767ce CVE-2023-52922 - https://allelesecurity.com/use-after-free-vulnerability-in-can-bcm-subsystem-leading-to-information-disclosure-cve-2023-52922/ CVE-2023-52927 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2023-52927 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2023-52927 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2023-52927 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2023-52927 - https://seadragnol.github.io/posts/CVE-2023-52927/ CVE-2023-5294 - https://vuldb.com/?id.240925 CVE-2023-5297 - https://vuldb.com/?id.240927 @@ -119213,6 +119262,8 @@ CVE-2023-5325 - https://wpscan.com/vulnerability/e93841ef-e113-41d3-9fa1-b21af85 CVE-2023-5326 - https://vuldb.com/?id.241027 CVE-2023-5329 - https://vuldb.com/?id.241030 CVE-2023-53292 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2023-53292 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2023-53292 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2023-5330 - https://mattermost.com/security-updates CVE-2023-5331 - https://mattermost.com/security-updates CVE-2023-5333 - https://mattermost.com/security-updates @@ -119426,6 +119477,7 @@ CVE-2023-5421 - https://otrs.com/release-notes/otrs-security-advisory-2023-09/ CVE-2023-5422 - https://otrs.com/release-notes/otrs-security-advisory-2023-10/ CVE-2023-5427 - http://packetstormsecurity.com/files/176029/ARM-Mali-r44p0-Use-After-Free.html CVE-2023-5427 - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities +CVE-2023-54271 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2023-54327 - https://www.exploit-db.com/exploits/51732 CVE-2023-54327 - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5787.php CVE-2023-54328 - https://www.exploit-db.com/exploits/51196 @@ -119590,6 +119642,7 @@ CVE-2023-5700 - https://github.com/istlnight/cve/blob/main/NS-ASG-sql-uploadiscg CVE-2023-5708 - https://www.wordfence.com/threat-intel/vulnerabilities/id/d96e5986-8c89-4e7e-aa63-f41aa13eeff4?source=cve CVE-2023-5711 - https://research.cleantalk.org/cve-2023-5711/ CVE-2023-5713 - https://research.cleantalk.org/cve-2023-5713/ +CVE-2023-5717 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2023-5718 - https://gist.github.com/CalumHutton/bdb97077a66021ed455f87823cd7c7cb CVE-2023-5724 - https://bugzilla.mozilla.org/show_bug.cgi?id=1836705 CVE-2023-5725 - https://bugzilla.mozilla.org/show_bug.cgi?id=1845739 @@ -119972,6 +120025,7 @@ CVE-2023-6592 - https://research.cleantalk.org/cve-2023-6592-fastdup-database-us CVE-2023-6592 - https://wpscan.com/vulnerability/a39bb807-b143-4863-88ff-1783e407d7d4/ CVE-2023-6593 - https://devolutions.net/security/advisories/DEVO-2023-0023/ CVE-2023-6599 - https://huntr.com/bounties/6198785c-bf60-422e-9b80-68a6e658a10e +CVE-2023-6606 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2023-6607 - https://github.com/willchen0011/cve/blob/main/sql.md CVE-2023-6608 - https://github.com/willchen0011/cve/blob/main/sql2.md CVE-2023-6609 - https://vuldb.com/?id.247245 @@ -122927,6 +122981,7 @@ CVE-2024-23148 - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024 CVE-2024-23149 - https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009 CVE-2024-2316 - https://drive.google.com/file/d/1v_Ee2FWlbpLgHYIl88COPp05EHSxUWI0/view?usp=sharing CVE-2024-2317 - https://vuldb.com/?ctiid.256271 +CVE-2024-23173 - https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/965214 CVE-2024-2318 - https://gist.github.com/whiteman007/a3b25a7ddf38774329d72930e0cd841a CVE-2024-23184 - http://seclists.org/fulldisclosure/2024/Aug/17 CVE-2024-23185 - http://seclists.org/fulldisclosure/2024/Aug/18 @@ -123756,12 +123811,19 @@ CVE-2024-26633 - https://git.kernel.org/stable/c/d375b98e0248980681e5e56b7120261 CVE-2024-26633 - https://git.kernel.org/stable/c/da23bd709b46168f7dfc36055801011222b076cd CVE-2024-26642 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-26643 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-26645 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-26651 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-26659 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-26671 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html +CVE-2024-26679 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-2674 - https://vuldb.com/?id.257374 CVE-2024-2676 - https://vuldb.com/?id.257376 +CVE-2024-26772 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html +CVE-2024-26773 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-26773 - https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d +CVE-2024-26777 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-26783 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-26783 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-26787 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-26798 - https://git.kernel.org/stable/c/00d6a284fcf3fad1b7e1b5bc3cd87cbfb60ce03f CVE-2024-26798 - https://git.kernel.org/stable/c/20a4b5214f7bee13c897477168c77bbf79683c3d @@ -123769,11 +123831,13 @@ CVE-2024-26798 - https://git.kernel.org/stable/c/2f91a96b892fab2f2543b4a55740c5b CVE-2024-26798 - https://git.kernel.org/stable/c/73a6bd68a1342f3a44cac9dffad81ad6a003e520 CVE-2024-26798 - https://git.kernel.org/stable/c/a2c881413dcc5d801bdc9535e51270cc88cb9cd8 CVE-2024-26801 - https://git.kernel.org/stable/c/98fb98fd37e42fd4ce13ff657ea64503e24b6090 +CVE-2024-26805 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-26810 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-26812 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-26816 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-26817 - https://git.kernel.org/stable/c/e6768c6737f4c02cba193a3339f0cc2907f0b86a CVE-2024-26820 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-26835 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-26840 - https://git.kernel.org/stable/c/43eccc5823732ba6daab2511ed32dfc545a666d8 CVE-2024-26851 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-26852 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html @@ -123834,6 +123898,7 @@ CVE-2024-26979 - https://git.kernel.org/stable/c/9cb3755b1e3680b720b74dbedfac889 CVE-2024-26979 - https://git.kernel.org/stable/c/c560327d900bab968c2e1b4cd7fa2d46cd429e3d CVE-2024-26979 - https://git.kernel.org/stable/c/ff41e0d4f3fa10d7cdd7d40f8026bea9fcc8b000 CVE-2024-26982 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-26982 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-26988 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-26988 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-26993 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html @@ -123856,6 +123921,7 @@ CVE-2024-2705 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC CVE-2024-27052 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-27053 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-27056 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-27056 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-27059 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-2706 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.49/more/formWifiWpsStart.md CVE-2024-27065 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html @@ -124426,6 +124492,7 @@ CVE-2024-28955 - http://seclists.org/fulldisclosure/2024/Jul/0 CVE-2024-28955 - https://jvn.jp/en/vu/JVNVU93051062/ CVE-2024-28955 - https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html CVE-2024-28956 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-28956 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-28957 - https://www.cente.jp/obstacle/4963/ CVE-2024-2896 - https://vuldb.com/?id.257939 CVE-2024-28965 - https://www.dell.com/support/kbdoc/en-us/000225910/dsa-2024-181-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities @@ -125961,6 +126028,7 @@ CVE-2024-36007 - https://cert-portal.siemens.com/productcert/html/ssa-265688.htm CVE-2024-36007 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-36008 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-36008 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html +CVE-2024-36017 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-36020 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-36049 - https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-007/ CVE-2024-36051 - https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184 @@ -126190,6 +126258,7 @@ CVE-2024-3690 - https://vuldb.com/?submit.312974 CVE-2024-36902 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-36902 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-36903 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-36903 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-36904 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-36904 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-36905 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html @@ -126199,9 +126268,12 @@ CVE-2024-3691 - https://vuldb.com/?submit.312975 CVE-2024-36916 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-36916 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-3692 - https://wpscan.com/vulnerability/6f100f85-3a76-44be-8092-06eb8595b0c9/ +CVE-2024-36922 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-36927 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-36927 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-36929 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-36929 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html +CVE-2024-36934 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-36939 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-36940 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-36940 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html @@ -126654,6 +126726,7 @@ CVE-2024-39250 - https://github.com/efrann/CVE-2024-39250 CVE-2024-39251 - https://github.com/Souhardya/Exploit-PoCs/tree/main/ThundeRobot_Control_center CVE-2024-39274 - https://mattermost.com/security-updates CVE-2024-3928 - https://github.com/ggfzx/OCP-Security-Misconfiguration/tree/main +CVE-2024-39292 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-3930 - https://portal.perforce.com/s/detail/a91PA000001SUKLYA4 CVE-2024-39304 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-2rh6-gr3h-83j9 CVE-2024-39307 - https://github.com/Kareadita/Kavita/security/advisories/GHSA-r4qc-3w52-2v84 @@ -126682,6 +126755,7 @@ CVE-2024-3948 - https://github.com/xuanluansec/vul/issues/5 CVE-2024-39482 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-39482 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-39482 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html +CVE-2024-39487 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-39489 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-39489 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-39493 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html @@ -127081,6 +127155,7 @@ CVE-2024-40942 - https://cert-portal.siemens.com/productcert/html/ssa-355557.htm CVE-2024-40945 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-40945 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-40945 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html +CVE-2024-40945 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-40958 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-40958 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-40958 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html @@ -127122,6 +127197,7 @@ CVE-2024-41006 - https://cert-portal.siemens.com/productcert/html/ssa-265688.htm CVE-2024-41006 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-41006 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-41016 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-41046 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-4105 - https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf CVE-2024-4106 - https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf CVE-2024-4109 - https://bugzilla.redhat.com/show_bug.cgi?id=2272325 @@ -127396,6 +127472,7 @@ CVE-2024-42055 - https://github.com/CervantesSec/cervantes/commit/78631a034d0fb3 CVE-2024-42070 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-42070 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-42079 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-42079 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-42082 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-42082 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-42082 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html @@ -127409,9 +127486,12 @@ CVE-2024-42094 - https://cert-portal.siemens.com/productcert/html/ssa-613116.htm CVE-2024-42096 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-42097 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-4210 - https://hackerone.com/reports/2431562 +CVE-2024-42106 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-42114 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-42131 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-42140 - https://git.kernel.org/stable/c/7692c9b6baacdee378435f58f19baf0eb69e4155 CVE-2024-42140 - https://git.kernel.org/stable/c/bb80a7911218bbab2a69b5db7d2545643ab0073d +CVE-2024-42154 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html CVE-2024-4217 - https://wpscan.com/vulnerability/55cb43bf-7c8f-4df7-b4de-bf2bb1c2766d/ CVE-2024-4224 - https://takeonme.org/cves/CVE-2024-4224.html CVE-2024-42259 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html @@ -128341,6 +128421,7 @@ CVE-2024-4677 - https://vuldb.com/?id.263598 CVE-2024-46783 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-46783 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-46786 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-46786 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-46829 - https://git.kernel.org/stable/c/6a976e9a47e8e5b326de671811561cab12e6fb1f CVE-2024-46854 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-46865 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html @@ -128512,6 +128593,7 @@ CVE-2024-47735 - https://cert-portal.siemens.com/productcert/html/ssa-265688.htm CVE-2024-47735 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-47736 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-47736 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2024-47736 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-47737 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-47737 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-47745 - https://git.kernel.org/stable/c/0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1 @@ -128528,6 +128610,8 @@ CVE-2024-47770 - https://github.com/wazuh/wazuh/security/advisories/GHSA-648q-8m CVE-2024-47796 - https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=89a6e399f1e17d08a8bc8cdaa05b2ac9a50cd4f6 CVE-2024-47809 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-47809 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2024-47809 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2024-47809 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-47810 - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2094 CVE-2024-47810 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2094 CVE-2024-47814 - https://github.com/vim/vim/security/advisories/GHSA-rj48-v4mq-j4vg @@ -128968,15 +129052,19 @@ CVE-2024-49952 - https://cert-portal.siemens.com/productcert/html/ssa-355557.htm CVE-2024-49955 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-49955 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-49968 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-49968 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-49973 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-49973 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-49977 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-49977 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-49994 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-49994 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-49997 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-49997 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-49998 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-49998 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2024-49998 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2024-49998 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-50001 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-50001 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-50001 - https://git.kernel.org/stable/c/fc357e78176945ca7bcacf92ab794b9ccd41b4f4 @@ -128986,6 +129074,7 @@ CVE-2024-50008 - https://cert-portal.siemens.com/productcert/html/ssa-265688.htm CVE-2024-50008 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-50010 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-50014 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-50014 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-50015 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-50015 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-5002 - https://wpscan.com/vulnerability/da09b99a-fa40-428f-80b4-0af764fd2f4f/ @@ -129008,6 +129097,7 @@ CVE-2024-50046 - https://cert-portal.siemens.com/productcert/html/ssa-355557.htm CVE-2024-50052 - https://mattermost.com/security-updates CVE-2024-50058 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-50063 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-50063 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-50066 - https://www.vicarius.io/vsociety/posts/cve-2024-50066-kernel-detection-vulnerability CVE-2024-50066 - https://www.vicarius.io/vsociety/posts/cve-2024-50066-kernel-mitigation-vulnerability CVE-2024-50073 - https://git.kernel.org/stable/c/0eec592c6a7460ba795d7de29f3dc95cb5422e62 @@ -129029,6 +129119,7 @@ CVE-2024-50151 - https://cert-portal.siemens.com/productcert/html/ssa-265688.htm CVE-2024-50153 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-50153 - https://git.kernel.org/stable/c/39e02fa90323243187c91bb3e8f2f5f6a9aacfc7 CVE-2024-50164 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-50164 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-5017 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1932 CVE-2024-50188 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-50188 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html @@ -129046,6 +129137,7 @@ CVE-2024-5028 - https://wpscan.com/vulnerability/0bae8494-7b01-4203-a4f7-ccc60ef CVE-2024-5029 - https://wpscan.com/vulnerability/f0f4a33c-9dd2-45ee-82e7-4b8bc2c20094/ CVE-2024-50298 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-50298 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2024-50298 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-50299 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-50299 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-5030 - https://wpscan.com/vulnerability/2c2e994c-31bd-4de4-9480-b86f980d4130/ @@ -129524,9 +129616,12 @@ CVE-2024-53101 - https://cert-portal.siemens.com/productcert/html/ssa-265688.htm CVE-2024-53101 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html CVE-2024-53124 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-53124 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-53124 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-53150 - https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b CVE-2024-53166 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2024-53166 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-53170 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-53170 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-53171 - https://git.kernel.org/stable/c/4d9807048b851d7a58d5bd089c16254af896e4df CVE-2024-5318 - https://gitlab.com/gitlab-org/gitlab/-/issues/427526 CVE-2024-53255 - https://github.com/BoidCMS/BoidCMS/security/advisories/GHSA-7q7m-cgw8-px4r @@ -129716,6 +129811,7 @@ CVE-2024-54448 - http://seclists.org/fulldisclosure/2026/Aug/85 CVE-2024-54448 - https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html CVE-2024-54449 - https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html CVE-2024-54458 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-54458 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-5447 - https://wpscan.com/vulnerability/a692b869-1666-42d1-b56d-dfcccd68ab67/ CVE-2024-54471 - https://news.ycombinator.com/item?id=43425605 CVE-2024-54471 - https://wts.dev/posts/password-leak/ @@ -129994,12 +130090,18 @@ CVE-2024-5658 - http://www.openwall.com/lists/oss-security/2024/06/06/2 CVE-2024-5658 - https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use CVE-2024-56631 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-56631 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-56631 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2024-56647 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2024-56657 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-56669 - https://git.kernel.org/stable/c/9a0a72d3ed919ebe6491f527630998be053151d8 CVE-2024-56672 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-56703 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-56703 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-56705 - https://git.kernel.org/stable/c/0c25ab93f2878cab07d37ca5afd302283201e5af CVE-2024-56719 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-56719 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2024-56719 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2024-56719 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-5672 - http://seclists.org/fulldisclosure/2024/Jul/6 CVE-2024-56732 - https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-qmp9-xqm5-jh6m CVE-2024-5676 - http://seclists.org/fulldisclosure/2024/Jun/8 @@ -130312,9 +130414,11 @@ CVE-2024-57901 - https://cert-portal.siemens.com/productcert/html/ssa-265688.htm CVE-2024-57902 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-57913 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-57917 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-57917 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-5792 - https://favethemes.zendesk.com/hc/en-us/articles/360041639432-Changelog CVE-2024-57924 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-57924 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2024-57924 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-57929 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-5793 - https://favethemes.zendesk.com/hc/en-us/articles/360041639432-Changelog CVE-2024-57940 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html @@ -130325,39 +130429,72 @@ CVE-2024-57965 - https://github.com/axios/axios/issues/6351 CVE-2024-57965 - https://github.com/axios/axios/pull/6714 CVE-2024-57971 - https://github.com/darumaseye/CVEs/blob/ec2de9f7ecffde466e687745bfdfc672e86241d7/CVE-2024-57971.md CVE-2024-57973 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-57973 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-57977 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-57977 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2024-57977 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-57977 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2024-57977 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-57979 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-57979 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-57979 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2024-57979 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2024-57980 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-57981 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-57981 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-57986 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-57986 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-5799 - https://wpscan.com/vulnerability/3ee3023a-541c-40e6-8d62-24b4b110633c/ +CVE-2024-57993 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-57996 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2024-57996 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2024-58002 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-58005 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2024-58005 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-58005 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-58009 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-58009 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-58011 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-58011 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2024-58013 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-58014 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-58014 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-58016 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-58016 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-58016 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-58017 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-58017 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-5802 - https://wpscan.com/vulnerability/cd37f702-9144-4c98-9b08-c63e510cd97f/ CVE-2024-58020 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-58020 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-58020 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2024-58020 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-5803 - https://support.norton.com/sp/static/external/tools/security-advisories.html CVE-2024-58051 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-58056 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-58056 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-58058 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2024-58058 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-58058 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2024-58058 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-58061 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-58061 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2024-58061 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-58063 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-58063 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2024-58068 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-5807 - https://wpscan.com/vulnerability/badb16b5-8c06-4170-b605-ea7af8982c1f/ CVE-2024-58071 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-58071 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-58072 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2024-58072 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2024-58077 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2024-58079 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-5808 - https://wpscan.com/vulnerability/1783bbce-3cc3-4a7e-a491-b713cee8278b/ +CVE-2024-58083 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2024-58085 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-58086 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2024-58086 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2024-5809 - https://wpscan.com/vulnerability/0af9fbcf-5f0e-4f7f-ae60-b46e704cf0a5/ CVE-2024-58101 - https://www.tarlogic.com/blog/cve-2024-58101 CVE-2024-5811 - https://wpscan.com/vulnerability/bf6c2e28-51ef-443b-b1c2-d555c7e12f7f/ @@ -130444,6 +130581,7 @@ CVE-2024-5838 - https://issues.chromium.org/issues/342522151 CVE-2024-58385 - https://cn-sec.com/archives/3234745.html CVE-2024-58387 - https://cn-sec.com/archives/3372984.html CVE-2024-58387 - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/hcm/hcm-cloud-lfi.yaml +CVE-2024-58388 - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/crocus-lfi.yaml CVE-2024-58388 - https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html#pre-auth-lfi CVE-2024-5844 - https://issues.chromium.org/issues/331960660 CVE-2024-5846 - https://issues.chromium.org/issues/341095523 @@ -134015,6 +134153,7 @@ CVE-2025-13488 - https://support.sonatype.com/hc/en-us/articles/46896142768019 CVE-2025-1352 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2025-1352 - https://vuldb.com/?submit.495965 CVE-2025-13523 - https://mattermost.com/security-updates +CVE-2025-13533 - https://gist.github.com/e578d548291225c116a5827ad205a9e9 CVE-2025-13538 - https://themeforest.net/item/findall-business-directory-theme/24415962 CVE-2025-13539 - https://themeforest.net/item/findall-business-directory-theme/24415962 CVE-2025-13547 - https://github.com/QIU-DIE/CVE/issues/30 @@ -135513,19 +135652,25 @@ CVE-2025-21638 - https://cert-portal.siemens.com/productcert/html/ssa-265688.htm CVE-2025-21639 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21640 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21645 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21645 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21647 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21648 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21648 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21648 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21653 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21655 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21655 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21664 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21666 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21669 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21676 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21676 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-21676 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21678 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21682 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21682 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-21682 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21682 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21683 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21692 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21692 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html @@ -135538,112 +135683,207 @@ CVE-2025-21692 - https://git.kernel.org/stable/c/f4168299e553f17aa2ba4016e77a9c3 CVE-2025-21692 - https://git.kernel.org/stable/c/f6b0f05fbfa4044f890e8a348288c0d9a20bd1d0 CVE-2025-21694 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21694 - https://cert-portal.siemens.com/productcert/html/ssa-355557.html +CVE-2025-21700 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21701 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-21702 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21702 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-21702 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21702 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2025-21703 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21704 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21704 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21705 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21705 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21705 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21706 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21706 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21706 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21707 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21707 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21707 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2025-21708 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21711 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21712 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-21716 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21718 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21718 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21719 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21719 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21724 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-21724 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2025-21725 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21726 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21726 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21727 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21727 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21728 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-21728 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21728 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-2173 - https://vuldb.com/?id.299202 CVE-2025-21731 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21731 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21731 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21735 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21735 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2025-21738 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21742 - https://git.kernel.org/stable/c/86586dcb75cb8fd062a518aca8ee667938b91efb CVE-2025-21744 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21744 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21745 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21745 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-21745 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21745 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21745 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21753 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21753 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21756 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-21756 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21756 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21758 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21758 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-21758 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21758 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21760 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21760 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21760 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21760 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21761 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21761 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21762 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21762 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21763 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21763 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21764 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21764 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21764 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21764 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21765 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21765 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-21765 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21765 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21765 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21766 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-21766 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21767 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-21767 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-2177 - https://vuldb.com/?id.299206 CVE-2025-21772 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2025-21776 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21776 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2025-21779 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21780 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21780 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21787 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21787 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2025-21790 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2025-21791 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21795 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21795 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-21795 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21795 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21795 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21796 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21796 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-21796 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21796 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21796 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21802 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21802 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21806 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21806 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21814 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21814 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21814 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21814 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21826 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21830 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2025-21832 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21835 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21835 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2025-21838 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21844 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21844 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21846 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21846 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21846 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21846 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21848 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-21853 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21853 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21858 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21858 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21859 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21859 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21861 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21861 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21862 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-21862 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21862 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21863 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21863 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21863 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21864 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-21864 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-21864 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-21864 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21865 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-21865 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html +CVE-2025-21865 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-21867 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21867 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21875 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21875 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21876 - https://git.kernel.org/stable/c/4117c72938493a77ab53cc4b8284be8fb6ec8065 CVE-2025-21887 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21887 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21913 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21913 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21919 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21919 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21925 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21925 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21926 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21926 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21938 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21938 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21959 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21959 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-21999 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-21999 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-22005 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-22005 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-22015 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-22015 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-2203 - https://wpscan.com/vulnerability/d553cff4-074a-44e7-aebe-e61c86ab8042/ CVE-2025-2205 - https://research.cleantalk.org/cve-2025-1622/ CVE-2025-2205 - https://wpscan.com/vulnerability/7a903d61-2792-4fe0-a26b-f400f4a3124b/ CVE-2025-22055 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-22055 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-22056 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-22056 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-2206 - https://github.com/uglory-gll/javasec/blob/main/spring-manage.md CVE-2025-2206 - https://vuldb.com/?id.299277 CVE-2025-22060 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-22060 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-2207 - https://github.com/uglory-gll/javasec/blob/main/spring-manage.md CVE-2025-2208 - https://github.com/uglory-gll/javasec/blob/main/spring-manage.md CVE-2025-2208 - https://vuldb.com/?id.299279 CVE-2025-22083 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-22083 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-2209 - https://github.com/uglory-gll/javasec/blob/main/spring-manage.md CVE-2025-22090 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-22090 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-22095 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-22095 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-2210 - https://github.com/uglory-gll/javasec/blob/main/spring-manage.md +CVE-2025-22105 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-22107 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-22107 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-2211 - https://github.com/uglory-gll/javasec/blob/main/spring-manage.md CVE-2025-22111 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-22111 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-22121 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-22121 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-2213 - https://vuldb.com/?id.299284 CVE-2025-22131 - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-79xx-vf93-p7cx CVE-2025-22132 - https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-h8hr-jhcx-fcv9 @@ -135833,8 +136073,11 @@ CVE-2025-23107 - https://semiconductor.samsung.com/support/quality-support/produ CVE-2025-23108 - https://bugzilla.mozilla.org/show_bug.cgi?id=1933172 CVE-2025-23109 - https://bugzilla.mozilla.org/show_bug.cgi?id=1419275 CVE-2025-23120 - https://labs.watchtowr.com/by-executive-order-we-are-banning-blacklists-domain-level-rce-in-veeam-backup-replication-cve-2025-23120/ +CVE-2025-23131 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-23136 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-23136 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-23143 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-23143 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-23184 - https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability CVE-2025-23184 - https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability CVE-2025-23198 - https://github.com/librenms/librenms/security/advisories/GHSA-pm8j-3v64-92cq @@ -137920,6 +138163,7 @@ CVE-2025-34153 - https://gist.github.com/VAMorales/32794cccc2195a935623a12ef3276 CVE-2025-34154 - https://gist.github.com/Janrdrz/3cf67a9ad488e07ceaacd7c1a7e59ae7 CVE-2025-34157 - https://github.com/Eyodav/CVE-2025-34157 CVE-2025-34158 - https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md +CVE-2025-34158 - https://github.com/lufinkey/vulnerability-research/tree/main/CVE-2025-34158 CVE-2025-34158 - https://www.bleepingcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerability-immediately/ CVE-2025-34158 - https://www.vulncheck.com/advisories/plex-media-server-unspecified CVE-2025-34159 - https://github.com/Eyodav/CVE-2025-34159 @@ -138231,20 +138475,28 @@ CVE-2025-3765 - https://www.sourcecodester.com/ CVE-2025-3768 - https://devolutions.net/security/advisories/DEVO-2025-0011/ CVE-2025-37756 - http://www.openwall.com/lists/oss-security/2026/05/07/1 CVE-2025-37785 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-37785 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-3783 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/upload_in_add-product.md CVE-2025-3783 - https://www.sourcecodester.com/ CVE-2025-3786 - https://github.com/CH13hh/cve/tree/AC15WifiExtraSet CVE-2025-37899 - https://news.ycombinator.com/item?id=44081338 CVE-2025-37909 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-37909 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-37917 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-37917 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-37945 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-37945 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-37945 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-37947 - https://github.com/doyensec/KSMBD-CVE-2025-37947/blob/main/CVE-2025-37947.c CVE-2025-37959 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-37959 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-37964 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-37964 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-37972 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-37972 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-37980 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-37980 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-37980 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-3800 - https://vuldb.com/?id.305653 CVE-2025-3801 - https://github.com/yaowenxiao721/Poc/blob/main/One-API/One-API-poc.md CVE-2025-38058 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html @@ -138259,11 +138511,15 @@ CVE-2025-38089 - http://www.openwall.com/lists/oss-security/2025/07/02/2 CVE-2025-38089 - https://github.com/keymaker-arch/NFSundown CVE-2025-38089 - https://www.openwall.com/lists/oss-security/2025/07/02/2 CVE-2025-38100 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-38105 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-38111 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38124 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38125 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-38125 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-38162 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-38162 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-38162 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-38162 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-38167 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-3817 - https://github.com/88hsb88/cve/blob/main/sql.md CVE-2025-3817 - https://www.sourcecodester.com/ @@ -138271,9 +138527,12 @@ CVE-2025-3819 - https://github.com/wcndy13/cve/issues/1 CVE-2025-3819 - https://vuldb.com/?id.305725 CVE-2025-38192 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-38192 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-38192 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-38192 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-38198 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38201 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-38201 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-38201 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-3821 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/xss_from_input_with_post.md CVE-2025-3821 - https://www.sourcecodester.com/ CVE-2025-38212 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html @@ -138287,11 +138546,13 @@ CVE-2025-3823 - https://vuldb.com/?id.305730 CVE-2025-3823 - https://www.sourcecodester.com/ CVE-2025-38231 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38232 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-38232 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-38236 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-3824 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/xss_from_input_with_post.md CVE-2025-3824 - https://www.sourcecodester.com/ CVE-2025-3825 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/xss_from_input_with_post.md CVE-2025-3825 - https://www.sourcecodester.com/ +CVE-2025-38250 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-3826 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/xss_from_input_with_post.md CVE-2025-3826 - https://www.sourcecodester.com/ CVE-2025-3827 - https://github.com/NuoNuo-L/cve/issues/1 @@ -138301,6 +138562,7 @@ CVE-2025-38285 - https://cert-portal.siemens.com/productcert/html/ssa-082556.htm CVE-2025-3829 - https://github.com/NuoNuo-L/cve/issues/3 CVE-2025-38312 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38322 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-38322 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-38342 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38350 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38352 - https://github.com/farazsth98/chronomaly @@ -138326,25 +138588,36 @@ CVE-2025-38499 - https://cert-portal.siemens.com/productcert/html/ssa-082556.htm CVE-2025-38501 - http://www.openwall.com/lists/oss-security/2025/09/15/2 CVE-2025-38501 - https://github.com/keymaker-arch/KSMBDrain CVE-2025-3854 - https://github.com/CH13hh/tmp_store_cc/blob/main/H3C%20GR-3000AX/1.md +CVE-2025-38584 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-38591 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-38591 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-38614 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-38614 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-38614 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-38681 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-38681 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-38685 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38691 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38701 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38702 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38704 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-38704 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-38704 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-38704 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-38708 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38721 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-38721 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-38721 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-38724 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-38725 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-38725 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-38727 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-38727 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-38727 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-38732 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-38732 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-38736 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-38736 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-3886 - https://support.catonetworks.com/hc/en-us/articles/26903049677597-Security-Vulnerability-CVE-2025-3886-that-Impacts-macOS-Client-Versions-Lower-than-5-8 CVE-2025-3913 - https://mattermost.com/security-updates CVE-2025-3928 - https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/ @@ -138382,85 +138655,118 @@ CVE-2025-3967 - https://github.com/uglory-gll/javasec/blob/main/paicoding.md CVE-2025-3967 - https://github.com/uglory-gll/javasec/blob/main/paicoding.md#22articleapipost-horizontal-overstepping-of-authority CVE-2025-3968 - https://github.com/zzZxby/Vulnerability-Exploration/blob/main/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A11.md CVE-2025-39681 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39681 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39683 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-39689 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-3969 - https://github.com/zzZxby/Vulnerability-Exploration/blob/main/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A12.md CVE-2025-39691 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39691 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39697 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-39721 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39721 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39724 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-3973 - https://github.com/skyrainoh/CVE/issues/3 CVE-2025-3974 - https://github.com/skyrainoh/CVE/issues/4 CVE-2025-39748 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-39748 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-39748 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-39748 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-39756 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-39756 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-39756 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-3976 - https://github.com/skyrainoh/CVE/issues/6 CVE-2025-39764 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-39764 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-39764 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39770 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-39770 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-39770 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39773 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-39773 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-39773 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39782 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39782 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39783 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-39787 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-3979 - https://github.com/dtwin88/cve-md/blob/main/lecms%20V3.0.3/lecms_3.md CVE-2025-39795 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-39795 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-39795 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39798 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-3980 - https://github.com/38279/3/issues/1 CVE-2025-3981 - https://github.com/38279/3/issues/1 CVE-2025-3982 - https://gist.github.com/superboy-zjc/a31b8ea7466f91b437598297bf5cbce8 CVE-2025-39826 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39826 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39827 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39827 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-3983 - https://github.com/MichaelZhuang521/cve/blob/main/rce.md CVE-2025-39845 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39845 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-39863 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-39866 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-39866 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-39866 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39871 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39871 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39913 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2025-39929 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-39931 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-39931 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-39931 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-3995 - https://vuldb.com/?id.306331 CVE-2025-39953 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39953 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39955 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39955 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39964 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39964 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-3997 - https://github.com/dtwin88/cve-md/blob/main/lecms%20V3.0.3/lecms_4.md CVE-2025-39977 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-39977 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-39977 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-39978 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39978 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-3998 - https://github.com/lyg986443/cve/issues/4 CVE-2025-39980 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-39980 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-39997 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-40022 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-40022 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-40022 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-4003 - https://github.com/RefindPlusRepo/RefindPlus/issues/206 CVE-2025-4003 - https://github.com/RefindPlusRepo/RefindPlus/issues/206#event-16595888967 CVE-2025-4004 - https://github.com/wyl091256/CVE/issues/1 CVE-2025-4005 - https://github.com/wyl091256/CVE/issues/2 CVE-2025-40070 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-40070 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-40078 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-40078 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-4008 - https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008 CVE-2025-40080 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-40080 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-40105 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-40105 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-4013 - https://github.com/ljfhhh/CVE/issues/1 CVE-2025-40135 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-40135 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-4014 - https://github.com/ljfhhh/CVE/issues/2 CVE-2025-40149 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-40149 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-4016 - https://www.cnblogs.com/aibot/p/18827506 CVE-2025-4017 - https://www.cnblogs.com/aibot/p/18827507 CVE-2025-4018 - https://vuldb.com/?id.306371 CVE-2025-4018 - https://www.cnblogs.com/aibot/p/18827504 CVE-2025-4019 - https://www.cnblogs.com/aibot/p/18827469 CVE-2025-40196 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-40196 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-4020 - https://github.com/Q3qc1n/myCVE/issues/1 CVE-2025-4021 - https://github.com/plj-sudo/cve/blob/main/README.md CVE-2025-40214 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2025-40214 - https://mohandacherir.github.io/Qdiv7/posts/unix_new_gc/ CVE-2025-40219 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-40219 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-40219 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-4022 - https://vuldb.com/?id.306376 CVE-2025-4023 - https://github.com/xingyu-wu4678/cve/issues/1 CVE-2025-4024 - https://github.com/xingyu-wu4678/cve/issues/2 @@ -138476,6 +138782,7 @@ CVE-2025-4026 - https://github.com/changan520374/cve/issues/1 CVE-2025-40261 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-40261 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2025-40261 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +CVE-2025-40261 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-40262 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2025-40263 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2025-40264 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html @@ -138488,6 +138795,7 @@ CVE-2025-40281 - https://cert-portal.siemens.com/productcert/html/ssa-253495.htm CVE-2025-4029 - https://github.com/zzzxc643/cve/blob/main/Diary%20Management%20System%20Stack%20Buffer%20Overflow.md CVE-2025-4030 - https://github.com/JunZ-Leo/CVE/issues/2 CVE-2025-40300 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-40300 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-4031 - https://github.com/tailin1122/myCVE/issues/1 CVE-2025-4033 - https://github.com/bluechips-zhao/myCVE/issues/2 CVE-2025-4034 - https://github.com/hhhanxx/attack/issues/1 @@ -141290,6 +141598,7 @@ CVE-2025-57296 - https://github.com/ZZ2266/.github.io/blob/main/Tenda/readme.md CVE-2025-57296 - https://github.com/ZZ2266/.github.io/tree/main/Tenda CVE-2025-5730 - https://wpscan.com/vulnerability/e1e7f423-f981-413c-a99a-e5927fc1cd0c/ CVE-2025-57305 - https://www.mattz.io/posts/cve-2025-57305/ +CVE-2025-57310 - https://gist.github.com/MMAKINGDOM/a6c2c8c70145cbea4e119525651e9a8d CVE-2025-5732 - https://github.com/tuooo/CVE/issues/3 CVE-2025-57347 - https://github.com/tbo47/dagre-es/issues/52 CVE-2025-57353 - https://github.com/messageformat/messageformat/issues/453 @@ -141369,6 +141678,7 @@ CVE-2025-57772 - https://github.com/dataease/dataease/security/advisories/GHSA-v CVE-2025-5778 - https://1000projects.org/ CVE-2025-5778 - https://github.com/ubfbuz3/cve/issues/18 CVE-2025-57788 - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/#wt-2025-0047hardcoded-credentials +CVE-2025-57798 - https://github.com/laurent22/joplin/security/advisories/GHSA-6jm8-gr87-q69x CVE-2025-57799 - https://github.com/lemon8866/StreamVault/security/advisories/GHSA-qg4r-92hv-g9f4 CVE-2025-57800 - https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-vpc2-w73p-39px CVE-2025-57803 - https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm @@ -141760,6 +142070,7 @@ CVE-2025-59948 - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-r CVE-2025-59949 - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w7f5-8vf9-f966 CVE-2025-59950 - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j66v-hvqx-5vh3 CVE-2025-59951 - https://github.com/LukeGus/Termix/security/advisories/GHSA-92cw-877q-6r94 +CVE-2025-59953 - https://github.com/InternLM/lmdeploy/security/advisories/GHSA-5h8j-6crg-7rmw CVE-2025-59954 - https://github.com/KnowageLabs/Knowage-Server/security/advisories/GHSA-96cv-75hg-xrgq CVE-2025-59955 - https://github.com/coollabsio/coolify/security/advisories/GHSA-927g-56xp-6427 CVE-2025-59956 - https://mcpsec.dev/advisories/2025-09-19-coder-chat-exfiltration @@ -142222,10 +142533,12 @@ CVE-2025-6195 - https://gitlab.com/gitlab-org/gitlab/-/issues/549937 CVE-2025-61984 - http://www.openwall.com/lists/oss-security/2025/10/07/1 CVE-2025-61984 - http://www.openwall.com/lists/oss-security/2025/10/12/1 CVE-2025-61984 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-61984 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-61984 - https://dgl.cx/2025/10/bash-a-newline-ssh-proxycommand-cve-2025-61984 CVE-2025-61984 - https://www.vicarius.io/vsociety/posts/cve-2025-61984-detection-script-remote-code-execution-vulnerability-affecting-openssh CVE-2025-61984 - https://www.vicarius.io/vsociety/posts/cve-2025-61984-mitigation-script-remote-code-execution-vulnerability-affecting-openssh CVE-2025-61985 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-61985 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6200 - https://wpscan.com/vulnerability/27c35255-4963-4d93-85e7-9e7688e5eb2e/ CVE-2025-62156 - https://github.com/argoproj/argo-workflows/security/advisories/GHSA-p84v-gxvw-73pf CVE-2025-62162 - https://github.com/cel-rust/cel-rust/security/advisories/GHSA-wxwx-9fh7-5mrw @@ -142526,6 +142839,7 @@ CVE-2025-63601 - https://fptcloud.com/en/cve-2025-63601-proof-of-concept/ CVE-2025-63602 - https://dreadsec.co/p/cve-2025-63602-hijacking-system-calls-with-a-popular-crypto-miner.html CVE-2025-63603 - https://github.com/reading-plus-ai/mcp-server-data-exploration/issues/12 CVE-2025-63604 - https://github.com/baryhuang/mcp-server-aws-resources-python/issues/8 +CVE-2025-63607 - https://gist.github.com/7Horrus/7c419516b064f6bac638736819e24583 CVE-2025-63608 - https://github.com/Huu1j/CSZ_CMS-exploit/blob/main/csz-cms-vulnerability-analysis.md CVE-2025-6361 - https://github.com/rom4j/cve/issues/9 CVE-2025-63617 - https://github.com/ChangeYourWay/post/blob/main/ktg-mes.md @@ -142594,6 +142908,7 @@ CVE-2025-63744 - https://github.com/marlinkcyber/advisories/blob/main/advisories CVE-2025-63744 - https://github.com/marlinkcyber/advisories/blob/main/advisories/radare2-nullptr-deref-bin_dyldcache.md CVE-2025-63744 - https://github.com/radareorg/radare2/issues/24661 CVE-2025-63745 - https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-001-radare2-nullptr-deref-bin_ne.md +CVE-2025-63745 - https://github.com/marlinkcyber/advisories/blob/main/advisories/radare2-nullptr-deref-bin_ne.md CVE-2025-63747 - https://bitsbyamg.com/blog/post/2025/10/19/qatraq-692-default-creds-and-file-upload-rce CVE-2025-63748 - https://bitsbyamg.com/blog/post/2025/10/19/qatraq-692-default-creds-and-file-upload-rce CVE-2025-63749 - https://github.com/XunMInt/cve/blob/main/Pnetlab-20251013.md @@ -142605,6 +142920,8 @@ CVE-2025-63822 - https://github.com/Leoccc98/cve-reports/blob/main/advisories/CV CVE-2025-63828 - https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt CVE-2025-63829 - https://gist.github.com/lkloliver/b00377bec754d4aa1dc731be210d5889 CVE-2025-63830 - https://github.com/Shubham03007/CVE-2025-63830/blob/main/README.md +CVE-2025-63842 - https://github.com/ciernyvlk/CVE/blob/main/CVE-2025-63842.md +CVE-2025-63878 - https://github.com/rumanaemu/CVE-Research/blob/main/CVE-2025-63878.md CVE-2025-63879 - https://github.com/rumanaemu/CVE-Research/blob/main/CVE-2025-63879.md CVE-2025-63883 - https://github.com/minhajultaivin/security-advisories/blob/main/CVE-2025-63883.md CVE-2025-63891 - https://github.com/lucascdsm/CVEs/blob/main/CVE-2025-63891.md @@ -143458,20 +143775,28 @@ CVE-2025-6819 - https://github.com/AlbaDove/cve/issues/2 CVE-2025-6820 - https://github.com/AlbaDove/cve/issues/3 CVE-2025-68206 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-68206 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-68206 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-68206 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-6821 - https://github.com/Dav1d-safe/cve/issues/3 CVE-2025-6822 - https://github.com/Dav1d-safe/cve/issues/2 CVE-2025-6822 - https://vuldb.com/?ctiid.314260 CVE-2025-6823 - https://github.com/Dav1d-safe/cve/issues/1 +CVE-2025-68239 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-6824 - https://github.com/awindog/cve/blob/main/688/28.md CVE-2025-6824 - https://github.com/awindog/cve/blob/main/688/28.md#poc CVE-2025-6825 - https://github.com/awindog/cve/blob/main/688/29.md CVE-2025-6825 - https://github.com/awindog/cve/blob/main/688/29.md#poc CVE-2025-6826 - https://github.com/Cashbeebee/CVE/issues/1 CVE-2025-68261 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68261 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68264 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68264 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68265 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-68265 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-68265 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2025-68265 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2025-68266 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68266 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6827 - https://github.com/YunQipao/cve/issues/3 CVE-2025-68272 - https://github.com/SignalK/signalk-server/security/advisories/GHSA-7rqc-ff8m-7j23 CVE-2025-68273 - https://github.com/SignalK/signalk-server/security/advisories/GHSA-fpf5-w967-rr2m @@ -143480,14 +143805,19 @@ CVE-2025-68277 - https://github.com/openemr/openemr/security/advisories/GHSA-566 CVE-2025-68278 - https://github.com/tinacms/tinacms/security/advisories/GHSA-529f-9qwm-9628 CVE-2025-6828 - https://github.com/YunQipao/cve/issues/2 CVE-2025-68291 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68291 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68337 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68337 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6834 - https://github.com/xiaoqitc/cve-/issues/5 CVE-2025-68349 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68349 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6835 - https://github.com/blueandhack/cve/issues/6 CVE-2025-6836 - https://github.com/blueandhack/cve/issues/4 CVE-2025-68363 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68363 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6837 - https://github.com/blueandhack/cve/issues/7 CVE-2025-68371 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68371 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68399 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-gfxf-w4cg-c54j CVE-2025-6840 - https://github.com/ez-lbz/poc/issues/10 CVE-2025-68400 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v54g-2pvg-gvp2 @@ -143568,30 +143898,45 @@ CVE-2025-68721 - https://github.com/osmancanvural/CVE-2025-68721 CVE-2025-68722 - https://github.com/osmancanvural/CVE-2025-68722 CVE-2025-68723 - https://github.com/osmancanvural/CVE-2025-68723 CVE-2025-68724 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68724 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68725 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68725 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6873 - https://github.com/ez-lbz/poc/issues/29 CVE-2025-6873 - https://vuldb.com/?submit.603645 CVE-2025-6873 - https://www.sourcecodester.com/ CVE-2025-6874 - https://www.sourcecodester.com/ CVE-2025-68742 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68742 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6875 - https://www.sourcecodester.com/ CVE-2025-6876 - https://www.sourcecodester.com/ CVE-2025-68764 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68764 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6877 - https://www.sourcecodester.com/ CVE-2025-68773 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68773 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68776 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68776 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6878 - https://www.sourcecodester.com/ CVE-2025-68782 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68782 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68787 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68787 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68788 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68788 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6879 - https://www.sourcecodester.com/ CVE-2025-68798 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68798 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6880 - https://www.sourcecodester.com/ CVE-2025-68803 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68803 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68814 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68814 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68816 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68816 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68818 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68818 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-68820 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-68820 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-6883 - https://github.com/qingchuana/q1ngchuan/issues/7 CVE-2025-6884 - https://github.com/qingchuana/q1ngchuan/issues/8 CVE-2025-6885 - https://github.com/louis-zly/myCVE/issues/2 @@ -143620,9 +143965,11 @@ CVE-2025-6906 - https://github.com/zzb1388/cve/issues/14 CVE-2025-6907 - https://github.com/zzb1388/cve/issues/13 CVE-2025-6915 - https://vuldb.com/?submit.605080 CVE-2025-6916 - https://github.com/c0nyy/IoT_vuln/blob/main/TOTOLINK%20T6%20Vuln.md +CVE-2025-69196 - https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-5h2m-4q8j-pqpj CVE-2025-69200 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9cg9-4h4f-j6fg CVE-2025-69202 - https://github.com/arthurfiorette/axios-cache-interceptor/security/advisories/GHSA-x4m5-4cw8-vc44 CVE-2025-69205 - https://github.com/olell/uURU/security/advisories/GHSA-xvrh-pm3f-79v4 +CVE-2025-69206 - https://github.com/HemmeligOrg/Hemmelig.app/security/advisories/GHSA-vvxf-wj5w-6gj5 CVE-2025-69207 - https://github.com/khoj-ai/khoj/security/advisories/GHSA-6whj-7qmg-86qj CVE-2025-69212 - https://github.com/devcode-it/openstamanager/security/advisories/GHSA-25fp-8w8p-mx36 CVE-2025-69214 - https://github.com/devcode-it/openstamanager/security/advisories/GHSA-qjv8-63xq-gq8m @@ -143949,38 +144296,57 @@ CVE-2025-71031 - https://suphawith-phusanbai.gitbook.io/book-of-suphawith/my-exp CVE-2025-71058 - https://github.com/FPokerFace/Security-Advisory/blob/main/CVE-2025-71058/poc.c CVE-2025-71058 - https://github.com/FPokerFace/Security-Advisory/tree/main/CVE-2025-71058 CVE-2025-71064 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71064 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7107 - https://github.com/vri-report/reports/issues/2 CVE-2025-7107 - https://github.com/vri-report/reports/issues/2#issue-3161840085 CVE-2025-71075 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71075 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71079 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71079 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7108 - https://github.com/ShenxiuSec/cve-proofs/blob/main/POC-20250621-01.md CVE-2025-7108 - https://vuldb.com/?ctiid.315019 CVE-2025-71085 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71085 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71086 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71086 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71088 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71088 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7109 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README11.md CVE-2025-7109 - https://vuldb.com/?submit.604790 CVE-2025-71095 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71095 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71097 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71097 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71098 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71098 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7110 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README12.md CVE-2025-71104 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71104 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7111 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README13.md CVE-2025-71112 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71112 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71113 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71113 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71114 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71114 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7112 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README14.md CVE-2025-71120 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71120 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71123 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71123 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7113 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README15.md CVE-2025-71131 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71131 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7114 - https://github.com/vri-report/reports/issues/3 CVE-2025-7116 - https://github.com/d2pq/cve/blob/main/616/10.md CVE-2025-7116 - https://github.com/d2pq/cve/blob/main/616/10.md#poc CVE-2025-71161 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-71161 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-71161 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71162 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71162 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71163 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71163 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71164 - https://github.com/Typesetter/Typesetter/issues/706 CVE-2025-71165 - https://github.com/Typesetter/Typesetter/issues/709 CVE-2025-71166 - https://github.com/Typesetter/Typesetter/issues/707 @@ -143993,22 +144359,29 @@ CVE-2025-7118 - https://github.com/d2pq/cve/blob/main/616/8.md CVE-2025-7118 - https://github.com/d2pq/cve/blob/main/616/8.md#poc CVE-2025-71185 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-71185 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +CVE-2025-71185 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71186 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-71186 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +CVE-2025-71186 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71188 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2025-71189 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-71189 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +CVE-2025-71189 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7119 - https://github.com/ez-lbz/poc/issues/42 CVE-2025-71190 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-71190 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +CVE-2025-71190 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71191 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-71191 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +CVE-2025-71191 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71197 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2025-71197 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7120 - https://github.com/ez-lbz/poc/issues/43 CVE-2025-7121 - https://github.com/ez-lbz/poc/issues/44 CVE-2025-7122 - https://github.com/ez-lbz/poc/issues/45 CVE-2025-71221 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-71221 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-71221 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7123 - https://github.com/y2xsec324/cve/issues/2 CVE-2025-7124 - https://github.com/yihaofuweng/cve/issues/2 CVE-2025-71257 - https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/ @@ -144021,10 +144394,13 @@ CVE-2025-71260 - https://labs.watchtowr.com/thanks-itsms-threat-actors-have-neve CVE-2025-71260 - https://www.vulncheck.com/advisories/bmc-footprints-itsm-viewstate-deserialization-rce CVE-2025-71265 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-71265 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-71265 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71266 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-71266 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-71266 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-71267 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2025-71267 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2025-71267 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2025-7128 - https://github.com/wyl091256/CVE/issues/15 CVE-2025-7129 - https://github.com/wyl091256/CVE/issues/16 CVE-2025-7130 - https://github.com/wyl091256/CVE/issues/17 @@ -146020,6 +146396,7 @@ CVE-2026-0929 - https://wpscan.com/vulnerability/c0f17d83-6199-4676-90ec-4fba1e7 CVE-2026-0962 - https://gitlab.com/wireshark/wireshark/-/issues/20945 CVE-2026-0963 - https://gitlab.com/crafty-controller/crafty-4/-/issues/660 CVE-2026-0972 - http://seclists.org/fulldisclosure/2026/Apr/8 +CVE-2026-0993 - https://hml.io/posts/blog-post-cve-2026-0993/ CVE-2026-0997 - https://mattermost.com/security-updates CVE-2026-0998 - https://mattermost.com/security-updates CVE-2026-0999 - https://mattermost.com/security-updates @@ -146044,6 +146421,7 @@ CVE-2026-100287 - https://devolutions.net/security/advisories/DEVO-2026-0034/ CVE-2026-100288 - https://devolutions.net/security/advisories/DEVO-2026-0034/ CVE-2026-100289 - https://devolutions.net/security/advisories/DEVO-2026-0034/ CVE-2026-100303 - https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-missing-authorization-in-form-theme-management-endpoints +CVE-2026-100304 - https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_details_orphan.py CVE-2026-100304 - https://www.vulncheck.com/advisories/tduck-survey-form-6.0-information-disclosure-via-fail-open-form-ownership-check CVE-2026-100305 - https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_create_bypass.py CVE-2026-100305 - https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-fill-in-restriction-bypass-via-authenticated-submission-endpoint @@ -146051,6 +146429,7 @@ CVE-2026-100306 - https://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78c CVE-2026-100306 - https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-write-password-bypass-via-client-side-enforcement CVE-2026-100310 - http://www.openwall.com/lists/oss-security/2026/09/25/25 CVE-2026-100310 - https://github.com/Haitam-lazaar/libextractor-privesc +CVE-2026-100312 - https://github.com/JaconiasDev/Advisory-CloundClassroom-PHP-Project-1.0 CVE-2026-10036 - https://github.com/SaiTeja-Erukude/CVE-2026-10036-speechbrain-rce CVE-2026-100372 - https://hackmd.io/@leediay/S1AIRjzqfx CVE-2026-100389 - https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/ @@ -146065,24 +146444,42 @@ CVE-2026-100523 - https://github.com/Cotonti/Cotonti/issues/1907 CVE-2026-100524 - https://github.com/Cotonti/Cotonti/issues/1907 CVE-2026-10054 - https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/376 CVE-2026-10060 - https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_1/1.md +CVE-2026-100607 - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cffm-583c-vffr +CVE-2026-100609 - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-27w2-26m5-x82c CVE-2026-10061 - https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_2/2.md CVE-2026-10062 - https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_3/3.md +CVE-2026-100621 - https://github.com/Cap-go/capgo.app/security/advisories/GHSA-5rg9-rhwj-wj76 CVE-2026-10063 - https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_4/4.md CVE-2026-10064 - https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_5/5.md +CVE-2026-100644 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc +CVE-2026-100675 - https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8 +CVE-2026-100676 - https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qv38-hwhv-jm49 CVE-2026-100676 - https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-local-filesystem-read-via-svg +CVE-2026-100681 - https://github.com/Budibase/budibase/security/advisories/GHSA-942w-fccr-8r3c CVE-2026-1007 - https://devolutions.net/security/advisories/DEVO-2026-0003/ +CVE-2026-100720 - https://github.com/froxlor/froxlor/security/advisories/GHSA-89vj-gqqr-73p8 +CVE-2026-100721 - https://github.com/patriksimek/vm2/security/advisories/GHSA-5h3f-q97h-ccvc CVE-2026-10077 - https://wpscan.com/vulnerability/89877758-50f1-4a4b-a622-e417571a5b14/ CVE-2026-10080 - https://mattermost.com/security-updates CVE-2026-10081 - https://wpscan.com/vulnerability/e5cde405-5b34-4d3d-bfda-325402b0a5bc/ CVE-2026-10082 - https://wpscan.com/vulnerability/088a832d-2153-432e-849f-2c22b63a1b54/ CVE-2026-10083 - https://wpscan.com/vulnerability/e591b3f3-6e21-44f7-b374-4753689532fe/ +CVE-2026-100836 - https://github.com/edgelesssys/contrast/security/advisories/GHSA-3ccm-4qq2-5wrp +CVE-2026-100848 - https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-4h6m-rrxm-7w3m CVE-2026-10085 - https://mattermost.com/security-updates +CVE-2026-100852 - https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-73rf-jp3g-8rcf +CVE-2026-100854 - https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-4fm3-ggg2-c6qx +CVE-2026-100860 - https://github.com/heymrun/heym/security/advisories/GHSA-fmpw-hj3m-xvj6 +CVE-2026-100865 - https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h CVE-2026-100868 - https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm +CVE-2026-100882 - https://github.com/carlosalbertotuma/advisory/blob/main/advisory-04-stored-xss-via-footer.md +CVE-2026-100882 - https://github.com/krayin/laravel-crm/issues/2622 CVE-2026-100888 - https://weitongli.com/share/opendkim-h-tag-oob-write.html CVE-2026-100889 - https://weitongli.com/share/opendkim-qp-off-by-one.html CVE-2026-100890 - https://weitongli.com/share/opendmarc-ip6-wild-pointer.html CVE-2026-100891 - https://weitongli.com/share/opendmarc-ulabel-not-converted.html CVE-2026-100893 - https://is.yuum.me/posts/2026-08-06-ssrf-vulnerability-in-vocechat-server-v0520/ +CVE-2026-100894 - https://github.com/JaconiasDev/Advisory-CloundClassroom-PHP-Project-1.0.git CVE-2026-100895 - https://weitongli.com/share/openarc-c-tag-null-deref.html CVE-2026-100903 - https://pastebin.com/3VsEG3Rg CVE-2026-10097 - https://github.com/wolfSSL/wolfssl/pull/10430 @@ -146094,10 +146491,13 @@ CVE-2026-101015 - https://weitongli.com/share/opendmarc-unicode-dot-bypass.html CVE-2026-10103 - https://mattermost.com/security-updates CVE-2026-101036 - https://allannjuguna.github.io/blog/flb_music/flb_music_player/ CVE-2026-101040 - https://vuldb.com/submit/927478 +CVE-2026-101049 - https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h CVE-2026-10105 - https://github.com/agno-agi/agno/issues/7866 +CVE-2026-101050 - https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h CVE-2026-10106 - https://mattermost.com/security-updates CVE-2026-10107 - https://github.com/jxxghp/MoviePilot/issues/5823 CVE-2026-10108 - https://github.com/hanxi/xiaomusic/issues/890 +CVE-2026-101093 - https://github.com/Cotonti/Cotonti/issues/1907#issuecomment-5845691148 CVE-2026-10110 - https://github.com/Xmyronn/Student-Details-Management-System-1.0---SQL-Injection-Unauthenticated-.git CVE-2026-10113 - https://github.com/open5gs/open5gs/pull/4527 CVE-2026-101141 - https://drive.google.com/file/d/1gPjhTSB7uWmsnBlfq5h9h6qzJj9j_Lxo/view?usp=sharing @@ -146121,6 +146521,8 @@ CVE-2026-10122 - https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_9/9. CVE-2026-10123 - https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_10/10.md CVE-2026-101258 - https://access.redhat.com/security/cve/CVE-2026-101258 CVE-2026-101258 - https://bugzilla.redhat.com/show_bug.cgi?id=2542396 +CVE-2026-101290 - https://www.first.org/cvss/calculator/3.1 +CVE-2026-101301 - https://wpscan.com/vulnerability/e60dade1-a7af-4570-bfd6-669d10991d67/ CVE-2026-10152 - https://github.com/TaleLin/lin-cms-spring-boot/issues/336 CVE-2026-10154 - https://vuldb.com/submit/818838 CVE-2026-10155 - https://github.com/kevin57545/CVE/blob/main/README.md @@ -146177,6 +146579,7 @@ CVE-2026-10221 - https://gist.github.com/YLChen-007/d343fcfe2c009cd45f56dc475fd5 CVE-2026-10222 - https://gist.github.com/YLChen-007/7ee2eeaa383b3540d2e8854250c03fb0 CVE-2026-10223 - https://gist.github.com/YLChen-007/a1fb77ad2488c545a35d0f66356ea7b4 CVE-2026-10224 - https://gist.github.com/YLChen-007/0304e313d811f187ade93d3b01de0f87 +CVE-2026-102248 - https://github.com/ASantsSec/CVE/issues/25 CVE-2026-102249 - https://github.com/ASantsSec/CVE/issues/26 CVE-2026-10225 - https://github.com/raisulislamg4/student_management_system_by_php/issues/2 CVE-2026-10226 - https://github.com/raisulislamg4/student_management_system_by_php/issues/3 @@ -146200,6 +146603,7 @@ CVE-2026-102322 - https://issues.chromium.org/issues/527023137 CVE-2026-10233 - https://github.com/assimp/assimp/issues/6619 CVE-2026-10233 - https://github.com/user-attachments/files/27228962/poc.zip CVE-2026-102333 - https://github.com/cle-b/httpdbg/issues/220 +CVE-2026-102360 - https://github.com/dmonad/lib0/security/advisories/GHSA-r5c8-rf4w-qrq8 CVE-2026-102361 - https://www.vulncheck.com/advisories/mall4j-through-4.0-missing-authentication-in-password-update-endpoint CVE-2026-102362 - https://www.vulncheck.com/advisories/mall4j-through-4.0-missing-authentication-in-product-review-deletion CVE-2026-102363 - https://www.vulncheck.com/advisories/mall4j-through-4.0-unauthenticated-shipment-tracking-disclosure-via-order-number @@ -146261,6 +146665,7 @@ CVE-2026-10281 - https://github.com/Enderfga/claw-orchestrator/issues/61 CVE-2026-102820 - https://github.com/Eugeny/russh/security/advisories/GHSA-g4mp-vgx3-xrvm CVE-2026-102822 - https://github.com/Eugeny/russh/security/advisories/GHSA-p8qx-h547-fjw9 CVE-2026-102823 - https://github.com/Eugeny/russh/security/advisories/GHSA-47hw-gvq5-r2gm +CVE-2026-102825 - https://github.com/Eugeny/russh/security/advisories/GHSA-g6xm-f9xp-qq35 CVE-2026-102829 - https://github.com/steveukx/git-js/commit/68874c239f0c7a87f4a68c3d2c4a0d7c75bb27f4 CVE-2026-10286 - https://github.com/yihaofuweng/cve/issues/65 CVE-2026-10287 - https://hackmd.io/@Kq4PsjnpQ5WfoMt8ho48LA/By9GXDkyGe @@ -146277,7 +146682,9 @@ CVE-2026-10295 - https://pastebin.com/Ud5vaGp6 CVE-2026-10296 - https://github.com/ltranquility/vuln_submit/issues/7 CVE-2026-10297 - https://github.com/ltranquility/vuln_submit/issues/8 CVE-2026-10298 - https://github.com/ggml-org/whisper.cpp/issues/3807 +CVE-2026-102980 - https://github.com/makeplane/plane/security/advisories/GHSA-ghcr-frqr-6pqr CVE-2026-10299 - https://github.com/Carm3nc1ta/vuln-test/blob/main/Online%20Hospital%20Management%20System%20has%20IDOR%20vulnerability%20in%20viewdoctortimings_php.md +CVE-2026-102992 - https://github.com/piscinajs/piscina/security/advisories/GHSA-67c8-pqhq-4rmx CVE-2026-103001 - https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q CVE-2026-10302 - https://github.com/ltranquility/vuln_submit/issues/10 CVE-2026-10303 - https://remyhax.xyz/posts/reproducing-lawful-tls-wiretapping/ @@ -146314,10 +146721,13 @@ CVE-2026-103262 - https://github.com/tornadoweb/tornado/security/advisories/GHSA CVE-2026-103263 - https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r CVE-2026-103270 - https://github.com/ModelTC/LightLLM/issues/1609 CVE-2026-103293 - https://wpscan.com/vulnerability/810447c9-4a8b-4d80-af7c-2f5fa8b13609/ +CVE-2026-103304 - https://wpscan.com/vulnerability/99069eac-aa52-41da-9d63-3fb9e2a05f4a/ CVE-2026-103305 - https://wpscan.com/vulnerability/9fde6498-7d23-4419-9416-d5f50ca97c4a/ CVE-2026-103307 - https://wpscan.com/vulnerability/4e67fefd-56d9-4bfd-9e19-a2b5fff1e7a2/ +CVE-2026-103308 - https://wpscan.com/vulnerability/26bae5f0-510b-403e-bd69-c4aa2392406d/ CVE-2026-103309 - https://wpscan.com/vulnerability/e791e349-932b-4e59-bacb-a49b57343cf3/ CVE-2026-103323 - https://wpscan.com/vulnerability/f1859c64-e1d1-4efc-9f34-15d1f4aa3311/ +CVE-2026-103324 - https://wpscan.com/vulnerability/4e23c520-bb92-47b8-a617-0d334820db50/ CVE-2026-103329 - https://wpscan.com/vulnerability/aefba87d-fa4c-4b7c-9436-6e79e966e8a5/ CVE-2026-103378 - https://wpscan.com/vulnerability/f95d8558-2225-416c-8968-752a40cdc17f/ CVE-2026-103395 - https://github.com/ModelTC/LightLLM/issues/1610 @@ -146382,6 +146792,7 @@ CVE-2026-104079 - https://lazytitan.ro/envira CVE-2026-104118 - https://wpscan.com/vulnerability/d94ebc87-c404-4b30-8291-26c4bc2eb63b/ CVE-2026-104119 - https://wpscan.com/vulnerability/d6ee7720-9c2d-48b3-b238-0da4fed398a3/ CVE-2026-104140 - https://github.com/qgis/QGIS/security/advisories/GHSA-cr49-pm9v-m788 +CVE-2026-104250 - https://github.com/Unstructured-IO/unstructured/security/advisories/GHSA-v5mq-3xhg-98m9 CVE-2026-104432 - https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-h8m8-844p-v3m9 CVE-2026-104442 - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-jwh5-j4f4-c6xp CVE-2026-104443 - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-9j7h-ccj2-jxv6 @@ -146403,6 +146814,7 @@ CVE-2026-104634 - https://cna.erlef.org/cves/CVE-2026-104634.html CVE-2026-104634 - https://osv.dev/vulnerability/EEF-CVE-2026-104634 CVE-2026-104635 - https://cna.erlef.org/cves/CVE-2026-104635.html CVE-2026-104635 - https://osv.dev/vulnerability/EEF-CVE-2026-104635 +CVE-2026-104643 - https://wpscan.com/vulnerability/8b75ec7a-2b37-4e77-a83a-18b5e6f71d51/ CVE-2026-104644 - https://wpscan.com/vulnerability/874eeea9-59a1-4ec0-b884-76d1bb6dba22/ CVE-2026-104645 - https://wpscan.com/vulnerability/fe1a3c33-637c-426c-91f8-8b15f556b4b2/ CVE-2026-104646 - https://wpscan.com/vulnerability/d5ba5fe5-aec0-4df3-b990-775358c3e80a/ @@ -146433,6 +146845,8 @@ CVE-2026-104967 - https://github.com/makeplane/plane/security/advisories/GHSA-6c CVE-2026-104968 - https://github.com/makeplane/plane/security/advisories/GHSA-32q3-mqpc-3mhv CVE-2026-104973 - https://github.com/cthackers/adm-zip/security/advisories/GHSA-j5f4-cc29-5x44 CVE-2026-104974 - https://github.com/makeplane/plane/security/advisories/GHSA-rmmf-rj2q-3rrg +CVE-2026-104982 - https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2 +CVE-2026-104983 - https://gist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2 CVE-2026-104983 - https://github.com/linuxmint/xreader/issues/714 CVE-2026-1050 - https://github.com/risesoft-y9/Digital-Infrastructure/issues/2 CVE-2026-1050 - https://github.com/risesoft-y9/Digital-Infrastructure/issues/2#issue-3777863959 @@ -146466,6 +146880,8 @@ CVE-2026-105198 - https://wpscan.com/vulnerability/736056ca-5825-4cb7-8775-4010e CVE-2026-10522 - https://wpscan.com/vulnerability/8d531f22-1e8b-4e35-adec-c9304f4f7a07/ CVE-2026-105224 - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44 CVE-2026-105225 - https://github.com/osCommerce/oscommerce2/issues/677 +CVE-2026-105236 - https://cna.erlef.org/cves/CVE-2026-105236.html +CVE-2026-105236 - https://osv.dev/vulnerability/EEF-CVE-2026-105236 CVE-2026-10524 - https://wpscan.com/vulnerability/99986e13-d38d-4890-b935-9f6fd238ec61/ CVE-2026-105245 - https://github.com/sgl-project/sglang/issues/30166 CVE-2026-105247 - https://github.com/memory0433/cve/issues/2 @@ -146516,6 +146932,8 @@ CVE-2026-105640 - https://github.com/makeplane/plane/security/advisories/GHSA-7j CVE-2026-105643 - https://github.com/penpot/penpot/security/advisories/GHSA-qvq5-c536-pmx8 CVE-2026-10565 - https://github.com/open5gs/open5gs/issues/4497 CVE-2026-10565 - https://github.com/open5gs/open5gs/pull/4501 +CVE-2026-105659 - https://cna.erlef.org/cves/CVE-2026-105659.html +CVE-2026-105659 - https://osv.dev/vulnerability/EEF-CVE-2026-105659 CVE-2026-10566 - https://github.com/FoundationAgents/MetaGPT/issues/2038 CVE-2026-105668 - https://cna.erlef.org/cves/CVE-2026-105668.html CVE-2026-105668 - https://osv.dev/vulnerability/EEF-CVE-2026-105668 @@ -146570,13 +146988,17 @@ CVE-2026-105990 - https://wpscan.com/vulnerability/211d7613-a7e0-45f9-b262-66651 CVE-2026-105995 - https://wpscan.com/vulnerability/a778a758-4c44-45d6-bd34-9668bba2a95c/ CVE-2026-10600 - https://mattermost.com/security-updates CVE-2026-106029 - https://wpscan.com/vulnerability/7a08e8fd-9795-4aac-b023-5e75b741400b/ +CVE-2026-106031 - https://wpscan.com/vulnerability/51b61b2b-6bf7-4dee-be8a-907cf5071920/ +CVE-2026-106037 - https://github.com/kvcache-ai/Mooncake/issues/4476 CVE-2026-106039 - https://github.com/kvcache-ai/Mooncake/issues/4475 +CVE-2026-106041 - https://github.com/kvcache-ai/Mooncake/issues/4479 CVE-2026-10606 - https://vuldb.com/submit/829413 CVE-2026-106066 - https://bugzilla.redhat.com/show_bug.cgi?id=2547459 CVE-2026-106095 - https://wpscan.com/vulnerability/4aeddbb6-d7a9-48cb-96ea-5898586bce04/ CVE-2026-106097 - https://wpscan.com/vulnerability/f5206366-2e9c-42d5-90b9-ddfaf39aa02f/ CVE-2026-106098 - https://wpscan.com/vulnerability/f062a098-c00c-49f8-a32a-58b18ebcebe2/ CVE-2026-106099 - https://wpscan.com/vulnerability/65544ed7-d80b-439e-bf8e-73e94041b6bb/ +CVE-2026-106116 - https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-wmxv-xphr-5c9g CVE-2026-106120 - https://github.com/harttle/liquidjs/security/advisories/GHSA-fwxr-j5w2-587m CVE-2026-10616 - https://github.com/nextlevelbuilder/goclaw/issues/1133 CVE-2026-106166 - https://wpscan.com/vulnerability/aa33ce05-091d-4fef-b875-4fedb8b8fc9d/ @@ -146588,9 +147010,11 @@ CVE-2026-106193 - https://issues.chromium.org/issues/557729858 CVE-2026-106196 - https://issues.chromium.org/issues/504215649 CVE-2026-10620 - https://github.com/Xu-Zhihan/CVE/issues/12 CVE-2026-10620 - https://github.com/Xu-Zhihan/CVE/issues/13 +CVE-2026-106210 - https://issues.chromium.org/issues/556304559 CVE-2026-106213 - https://issues.chromium.org/issues/520153320 CVE-2026-106214 - https://issues.chromium.org/issues/533493992 CVE-2026-106223 - https://issues.chromium.org/issues/501633302 +CVE-2026-106238 - https://issues.chromium.org/issues/492374387 CVE-2026-10624 - https://r4sh7n.medium.com/insecure-direct-object-reference-idor-vulnerability-in-employee-management-functionality-70df8ac5b1d3?postPublishedType=repub CVE-2026-106242 - https://issues.chromium.org/issues/501647772 CVE-2026-106245 - https://issues.chromium.org/issues/550302121 @@ -146603,21 +147027,28 @@ CVE-2026-106273 - https://issues.chromium.org/issues/553118338 CVE-2026-106274 - https://issues.chromium.org/issues/497842821 CVE-2026-106277 - https://issues.chromium.org/issues/517708426 CVE-2026-106280 - https://issues.chromium.org/issues/517366426 +CVE-2026-106283 - https://issues.chromium.org/issues/499468981 CVE-2026-106289 - https://issues.chromium.org/issues/517700327 CVE-2026-106291 - https://issues.chromium.org/issues/499571442 CVE-2026-106292 - https://issues.chromium.org/issues/524587778 CVE-2026-106293 - https://issues.chromium.org/issues/547343108 CVE-2026-1063 - https://github.com/AnalogyC0de/public_exp/blob/main/archives/Bastillion/report1.md CVE-2026-106300 - https://issues.chromium.org/issues/500106110 +CVE-2026-106307 - https://issues.chromium.org/issues/537832408 +CVE-2026-106308 - https://issues.chromium.org/issues/560055258 CVE-2026-106313 - https://issues.chromium.org/issues/498770931 CVE-2026-106315 - https://issues.chromium.org/issues/497652727 CVE-2026-106322 - https://issues.chromium.org/issues/517213220 CVE-2026-106326 - https://issues.chromium.org/issues/511745101 CVE-2026-106332 - https://issues.chromium.org/issues/553454734 +CVE-2026-106336 - https://issues.chromium.org/issues/522722456 CVE-2026-106341 - https://issues.chromium.org/issues/558539954 CVE-2026-106342 - https://issues.chromium.org/issues/512998592 CVE-2026-106352 - https://issues.chromium.org/issues/553139506 CVE-2026-106360 - https://issues.chromium.org/issues/535639435 +CVE-2026-106364 - https://issues.chromium.org/issues/540018068 +CVE-2026-106365 - https://issues.chromium.org/issues/498075038 +CVE-2026-106370 - https://issues.chromium.org/issues/517033396 CVE-2026-106372 - https://issues.chromium.org/issues/557288890 CVE-2026-106373 - https://issues.chromium.org/issues/523699645 CVE-2026-106374 - https://issues.chromium.org/issues/552832446 @@ -146631,6 +147062,7 @@ CVE-2026-106399 - https://issues.chromium.org/issues/530237174 CVE-2026-1064 - https://github.com/AnalogyC0de/public_exp/blob/main/archives/Bastillion/report2.md CVE-2026-106401 - https://issues.chromium.org/issues/553129739 CVE-2026-106403 - https://issues.chromium.org/issues/523601696 +CVE-2026-106406 - https://issues.chromium.org/issues/505186109 CVE-2026-106407 - https://issues.chromium.org/issues/502648640 CVE-2026-106409 - https://issues.chromium.org/issues/559097675 CVE-2026-10641 - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wx5j-q6f2-59p3 @@ -146766,6 +147198,7 @@ CVE-2026-10802 - https://vuldb.com/cve/CVE-2026-10802 CVE-2026-10803 - https://github.com/mlflow/mlflow/issues/22419 CVE-2026-10806 - https://github.com/mjperpinosa/stumasy/issues/1 CVE-2026-108064 - https://wpscan.com/vulnerability/5657137d-f496-43f7-9067-e05b99c36006/ +CVE-2026-108065 - https://www.rapid7.com/blog/post/ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce/ CVE-2026-108066 - https://wpscan.com/vulnerability/a41461a7-c9f4-4d80-9f15-1ab934206de8/ CVE-2026-108069 - https://wpscan.com/vulnerability/db8bf2bf-1c15-4d41-b576-7c30a92a0e37/ CVE-2026-10807 - https://github.com/mjperpinosa/stumasy/issues/3 @@ -146787,9 +147220,11 @@ CVE-2026-10827 - https://wpscan.com/vulnerability/068ac525-423b-42f8-9ef4-f102f9 CVE-2026-10830 - https://wpscan.com/vulnerability/194e35d8-08ca-402d-a9bb-52383bc3dfab/ CVE-2026-10834 - https://wpscan.com/vulnerability/5b939f98-0fbd-4f89-9948-77dbcc67f9d3/ CVE-2026-10835 - https://wpscan.com/vulnerability/3c7b37ab-b069-4257-82b2-5b4c54f7e503/ +CVE-2026-108390 - https://ravindulakmina.pages.dev/advisories/cve-2026-108390-hestiacp-apostrophe-to-root CVE-2026-10848 - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-jgqq-7mjj-w642 CVE-2026-10849 - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-39h3-7phx-pwhv CVE-2026-10850 - https://fluidattacks.com/es/advisories/earth +CVE-2026-108544 - https://github.com/Secsys-FDU/AF_CVEs/issues/31 CVE-2026-108546 - https://hackmd.io/@haind/spotweb-runcommand-title-injection CVE-2026-108593 - https://hackmd.io/@haind/9router-hermes-config-injection CVE-2026-108595 - https://hackmd.io/@haind/phi-subagent-workdir-workspace-escape @@ -146973,6 +147408,7 @@ CVE-2026-109106 - https://docs.google.com/document/d/1HtHrkT1NRX7ZY8uyu_C0F2Scp7 CVE-2026-10912 - https://issues.chromium.org/issues/496614553 CVE-2026-10913 - https://issues.chromium.org/issues/497450927 CVE-2026-109143 - https://gist.github.com/k4z01/7f7739e59ae595f7bdd45922adf2b547 +CVE-2026-109145 - https://wpscan.com/vulnerability/62aa4b8c-b9f5-44f4-ac5a-220c14eb719a/ CVE-2026-10915 - https://issues.chromium.org/issues/497612174 CVE-2026-109153 - https://github.com/mosaicml/composer/issues/3942 CVE-2026-109164 - https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-authorization-bypass-via-user-controlled-submission-ids-in-post-user-form-data-delete-formkey @@ -146983,6 +147419,7 @@ CVE-2026-109168 - https://www.vulncheck.com/advisories/lamp-cloud-through-5.10.1 CVE-2026-109169 - https://github.com/logicaldoc/community/discussions/119 CVE-2026-109170 - https://github.com/logicaldoc/community/discussions/119 CVE-2026-109171 - https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-admin-api-crm-contract-check +CVE-2026-109172 - https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/yshop-crm/poc_crm_receivables_check.py CVE-2026-109172 - https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-contract-receivables-check-endpoint CVE-2026-109173 - https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-invoice-check-endpoint CVE-2026-109174 - https://www.vulncheck.com/advisories/mogublog-through-6.2-credential-disclosure-via-oauth-getsystemconfig @@ -146997,7 +147434,9 @@ CVE-2026-109181 - https://www.vulncheck.com/advisories/jsherp-through-3.6-author CVE-2026-109182 - https://www.vulncheck.com/advisories/jsherp-through-3.6-incorrect-authorization-via-supplier-exportexcel CVE-2026-109183 - https://www.vulncheck.com/advisories/jsherp-through-3.6-approval-bypass-via-adddepotheadanddetail-status-parameter CVE-2026-109184 - https://www.vulncheck.com/advisories/jsherp-through-3.6-data-scope-bypass-via-account-findaccountinoutlist +CVE-2026-109185 - https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_identity_privilege_write.py CVE-2026-109185 - https://www.vulncheck.com/advisories/jsherp-through-3.6-privilege-escalation-via-put-user-updateuser +CVE-2026-109186 - https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_identity_privilege_write.py CVE-2026-109186 - https://www.vulncheck.com/advisories/jsherp-through-3.6-mass-assignment-via-put-user-update CVE-2026-109187 - https://www.vulncheck.com/advisories/jsherp-through-3.6-information-disclosure-via-platformconfig-getinfobykey CVE-2026-109188 - https://www.vulncheck.com/advisories/jsherp-through-3.6-missing-authorization-in-master-data-add-and-import-endpoints @@ -147015,16 +147454,21 @@ CVE-2026-10922 - https://issues.chromium.org/issues/499164652 CVE-2026-10924 - https://issues.chromium.org/issues/500055357 CVE-2026-109249 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gvq8-v2fm-ffxv CVE-2026-10925 - https://issues.chromium.org/issues/500071763 +CVE-2026-109255 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hxw3-57rq-3v4m CVE-2026-10926 - https://issues.chromium.org/issues/500075522 CVE-2026-10927 - https://issues.chromium.org/issues/500090141 CVE-2026-10928 - https://issues.chromium.org/issues/500124367 CVE-2026-10929 - https://issues.chromium.org/issues/500429259 +CVE-2026-109299 - https://github.com/open-webui/open-webui/security/advisories/GHSA-5w58-mwmh-vf2m CVE-2026-10930 - https://issues.chromium.org/issues/500472605 +CVE-2026-109309 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-phmw-4rgv-r4xv CVE-2026-10931 - https://issues.chromium.org/issues/501115599 CVE-2026-10932 - https://issues.chromium.org/issues/501335606 CVE-2026-10933 - https://issues.chromium.org/issues/501557633 +CVE-2026-109330 - https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-hr6v-mfxm-4438 CVE-2026-10937 - https://issues.chromium.org/issues/502651056 CVE-2026-10939 - https://issues.chromium.org/issues/503502607 +CVE-2026-109397 - https://github.com/thelia/thelia/security/advisories/GHSA-5524-qfxp-33v9 CVE-2026-109409 - https://drive.google.com/drive/folders/19JuQt4385UFpRyLXglv80V0uxZujxUE9?usp=drive_link CVE-2026-10943 - https://issues.chromium.org/issues/504194151 CVE-2026-10944 - https://issues.chromium.org/issues/504215814 @@ -147034,7 +147478,10 @@ CVE-2026-10949 - https://issues.chromium.org/issues/504644843 CVE-2026-10951 - https://issues.chromium.org/issues/505191883 CVE-2026-109526 - https://drive.google.com/drive/folders/13MjPi0zInT9Caau_fqD68FQ0z5fH0YsX?usp=sharing CVE-2026-10953 - https://issues.chromium.org/issues/506147564 +CVE-2026-109558 - https://github.com/tianma-if/edgeever/issues/533 +CVE-2026-109570 - https://github.com/Pratham-16/fireboltt-Bsw013-BLE-vuln CVE-2026-109570 - https://www.vulncheck.com/advisories/fire-boltt-bsw013-through-v0-0.8-unauthenticated-ble-notification-injection +CVE-2026-109571 - https://github.com/Pratham-16/fireboltt-Bsw013-BLE-vuln CVE-2026-109571 - https://www.vulncheck.com/advisories/fire-boltt-bsw013-firmware-through-v0-0.8-unauthenticated-heart-rate-disclosure-via-ble CVE-2026-10959 - https://issues.chromium.org/issues/507258648 CVE-2026-10960 - https://issues.chromium.org/issues/507258786 @@ -147045,9 +147492,13 @@ CVE-2026-10961 - https://issues.chromium.org/issues/508281950 CVE-2026-109620 - https://tracexlabs.com/releases/online-reviewer-sqli-admin.html CVE-2026-10966 - https://issues.chromium.org/issues/511713779 CVE-2026-10968 - https://issues.chromium.org/issues/511758373 +CVE-2026-109680 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4ww8-3vqm-jgcf CVE-2026-10970 - https://issues.chromium.org/issues/512772489 CVE-2026-109786 - https://coredump.ws/repos/mail-hardening.git/ CVE-2026-10979 - https://issues.chromium.org/issues/513468021 +CVE-2026-109827 - https://github.com/gpac/gpac/issues/3930 +CVE-2026-109827 - https://github.com/gpac/gpac/pull/3932 +CVE-2026-109827 - https://www.mediafire.com/file/zbpfhkgaf18cntf/poc_gpac_g1.zip/file CVE-2026-10987 - https://issues.chromium.org/issues/515431687 CVE-2026-10991 - https://issues.chromium.org/issues/503553614 CVE-2026-10992 - https://issues.chromium.org/issues/493534964 @@ -147064,6 +147515,7 @@ CVE-2026-11003 - https://issues.chromium.org/issues/494823867 CVE-2026-11004 - https://issues.chromium.org/issues/494823889 CVE-2026-11005 - https://issues.chromium.org/issues/495052581 CVE-2026-11009 - https://issues.chromium.org/issues/496233132 +CVE-2026-110097 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-110097-ikaros-2fa-bypass-temp-token CVE-2026-110097 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ikaros-2fa-bypass-temp-token CVE-2026-11010 - https://issues.chromium.org/issues/496266444 CVE-2026-110109 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/jetlinks-community-transparent-codec-save-authz-bypass @@ -147073,6 +147525,7 @@ CVE-2026-110114 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/oms-erp-es-test-unau CVE-2026-110115 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/digital-infrastructure-filemanager-path-traversal-rw CVE-2026-110116 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/digital-infrastructure-filemanager-path-traversal-rw CVE-2026-110117 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/smart-admin-level3-protect-config-missing-authz +CVE-2026-110119 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-110119-110120-yshopmall-member-api-ownership-idor CVE-2026-110119 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yshopmall-member-api-ownership-idor CVE-2026-110120 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yshopmall-member-api-ownership-idor CVE-2026-110121 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/lilishop-seller-goods-cross-store-authz-bypass @@ -147128,23 +147581,78 @@ CVE-2026-11052 - https://issues.chromium.org/issues/498834967 CVE-2026-11055 - https://issues.chromium.org/issues/498881735 CVE-2026-11056 - https://issues.chromium.org/issues/498887785 CVE-2026-11058 - https://issues.chromium.org/issues/498986406 +CVE-2026-110596 - https://hackmd.io/@haind-pwn/quirc-alignment-pattern-infinite-loop-dos +CVE-2026-110597 - https://hackmd.io/@haind-pwn/tinyexr-multipart-header-stale-size-oob-read +CVE-2026-110598 - https://hackmd.io/@haind-pwn/libpff-multivalue-offset-underflow-oob-read +CVE-2026-110599 - https://hackmd.io/@haind-pwn/cve-2016-20099-2026-110599-l-smash-hevc-importer-double-free +CVE-2026-110599 - https://hackmd.io/@haind-pwn/l-smash-hevc-importer-double-free CVE-2026-1106 - https://note-hxlab.wetolink.com/share/w92t1Q0a74Gj CVE-2026-11060 - https://issues.chromium.org/issues/499018355 +CVE-2026-110600 - https://hackmd.io/@haind-pwn/xlsxio-relationship-missing-id-null-deref +CVE-2026-110601 - https://hackmd.io/@haind-pwn/libsixel-gif-transparent-index-oob-write +CVE-2026-110602 - https://hackmd.io/@haind-pwn/libmspack-kwaj-uninitialized-free +CVE-2026-110603 - https://hackmd.io/@haind-pwn/laszip-vlr-uninitialized-free +CVE-2026-110604 - https://hackmd.io/@haind-pwn/cve-2026-110604-mxml-strtod-locale-stack-overflow +CVE-2026-110604 - https://hackmd.io/@haind-pwn/mxml-strtod-locale-stack-overflow +CVE-2026-110605 - https://hackmd.io/@haind-pwn/libschrift-unitsperem-zero-oob +CVE-2026-110606 - https://hackmd.io/@haind-pwn/libdxfrw-dwg-header-oob-read +CVE-2026-110609 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/skyeye-erp-statistics-keyword-sqli CVE-2026-11061 - https://issues.chromium.org/issues/499031961 +CVE-2026-110610 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yudao-ai-image-midjourney-ssrf +CVE-2026-110611 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/getrebuild-rebuild-aibot-chat-idor +CVE-2026-110612 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/vlife-hardcoded-jwt-secret-token-forgery +CVE-2026-110613 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/youlai-mall-order-list-cross-member-disclosure +CVE-2026-110614 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/citrus-generic-query-orderby-sqli +CVE-2026-110615 - https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/jsherp-user-account-lifecycle-missing-authz CVE-2026-11062 - https://issues.chromium.org/issues/499033012 +CVE-2026-110625 - https://hackmd.io/@leediay/BJR_lh2ifg +CVE-2026-110626 - https://hackmd.io/@leediay/BJR_lh2ifg +CVE-2026-110627 - https://hackmd.io/@leediay/BJR_lh2ifg +CVE-2026-110628 - https://hackmd.io/@leediay/HyIxU63ofg +CVE-2026-110632 - https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html +CVE-2026-110633 - https://blog.quarkslab.com/myreport-updater-from-grpc-to-system.html CVE-2026-11064 - https://issues.chromium.org/issues/499075743 CVE-2026-11065 - https://issues.chromium.org/issues/499093536 +CVE-2026-110654 - https://hackmd.io/@haind-pwn/zvbi-teletext-drcs-mode-oob-write +CVE-2026-110655 - https://github.com/miniupnp/miniupnp/blob/bf4215a7574f88aa55859db9db00e3ae58cf42d6/miniupnpc/src/minixml.c#L61 +CVE-2026-110655 - https://github.com/miniupnp/miniupnp/commit/3cfb4fb78d5ac04ed0dadc8dd842fc9e448916db +CVE-2026-110655 - https://hackmd.io/@haind-pwn/miniupnpc-minixml-oob-read +CVE-2026-110656 - https://github.com/miniupnp/miniupnp/blob/bf4215a7574f88aa55859db9db00e3ae58cf42d6/miniupnpc/src/minixml.c#L141 +CVE-2026-110656 - https://github.com/miniupnp/miniupnp/commit/64ef08a12aabab57be0bf7e40f047c8f14dedf9c +CVE-2026-110656 - https://hackmd.io/@haind-pwn/miniupnpc-minixml-oob-read +CVE-2026-110658 - https://hackmd.io/@haind-pwn/sofia-sip-multipart-oob-read +CVE-2026-110659 - https://hackmd.io/@haind-pwn/elfio-relocation-get-entry-null-deref +CVE-2026-110660 - https://hackmd.io/@haind-pwn/vgmstream-g7221-bitreader-oob-read +CVE-2026-110661 - https://hackmd.io/@haind-pwn/cgns-adf-node-header-oob-read +CVE-2026-110689 - https://github.com/openclaw/clawscan/issues/39 CVE-2026-11069 - https://issues.chromium.org/issues/499213367 CVE-2026-11071 - https://issues.chromium.org/issues/499227659 +CVE-2026-110712 - https://hackmd.io/@haind-pwn/libsmb2-query-info-reply-oob-read +CVE-2026-110713 - https://hackmd.io/@haind-pwn/libsmb2-query-info-reply-oob-read +CVE-2026-110714 - https://hackmd.io/@haind-pwn/libsmb2-query-info-reply-oob-read +CVE-2026-110715 - https://hackmd.io/@haind-pwn/mujs-array-length-flat-oob +CVE-2026-110716 - https://hackmd.io/@haind-pwn/unshield-header-filetable-oob-read CVE-2026-11072 - https://issues.chromium.org/issues/499238195 CVE-2026-11073 - https://issues.chromium.org/issues/499365904 +CVE-2026-110734 - https://github.com/godotengine/godot/issues/123608 +CVE-2026-110735 - https://github.com/godotengine/godot/issues/123608 +CVE-2026-110736 - https://github.com/godotengine/godot/issues/123608 CVE-2026-11075 - https://issues.chromium.org/issues/499659070 +CVE-2026-110763 - https://hackmd.io/@hieuPenguinnn/lamp-boot-finddeptbycompany-employee-idor +CVE-2026-110766 - https://hackmd.io/@hieuPenguinnn/colanode-avatar-download-path-traversal +CVE-2026-110767 - https://hackmd.io/@hieuPenguinnn/gitingest-blob-symlink-arbitrary-file-read CVE-2026-11077 - https://issues.chromium.org/issues/499908918 +CVE-2026-110770 - https://hackmd.io/@hieuPenguinnn/databasus-password-reset-code-brute-force +CVE-2026-110771 - https://hackmd.io/@hieuPenguinnn/shopizer-rest-product-review-idor +CVE-2026-110772 - https://hackmd.io/@hieuPenguinnn/we-promise-sure-transactions-bulk-update-missing-authz +CVE-2026-110773 - https://hackmd.io/@hieuPenguinnn/growchief-all-users-missing-authz-cross-tenant-disclosure +CVE-2026-110775 - https://hackmd.io/@hieuPenguinnn/nexent-knowledge-base-cross-tenant-file-read CVE-2026-1108 - https://github.com/fizz-is-on-the-way/vuls_protocol/blob/main/librtsp_rtsp_rely_dumps/librtsp_rtsp_rely_dumps.md CVE-2026-11082 - https://issues.chromium.org/issues/500079715 CVE-2026-11084 - https://issues.chromium.org/issues/500124500 CVE-2026-11085 - https://issues.chromium.org/issues/500132379 CVE-2026-11087 - https://issues.chromium.org/issues/500140149 +CVE-2026-110871 - https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27 CVE-2026-1109 - https://github.com/fizz-is-on-the-way/vuls_protocol/blob/main/librtsp_rtsp_parse_request/librtsp_rtsp_parse_request.md CVE-2026-11090 - https://issues.chromium.org/issues/500161302 CVE-2026-11091 - https://issues.chromium.org/issues/500162791 @@ -148650,6 +149158,7 @@ CVE-2026-15508 - https://github.com/oscar2744/CVE-Submit/issues/1 CVE-2026-15509 - https://bytium.com/insights/leantime-priv-escalation-vulnerability-low-priv-to-owner CVE-2026-15509 - https://vuldb.com/vuln/377838 CVE-2026-15509 - https://vuldb.com/vuln/377838/cti +CVE-2026-15512 - https://vuldb.com/submit/847500 CVE-2026-15513 - https://github.com/0xcc12138/wavlink-nu516u1-csrf-command-injection- CVE-2026-15515 - https://github.com/subsubsub1231/qmukiller CVE-2026-15516 - https://github.com/trustbigcat/CVE/ @@ -148932,6 +149441,7 @@ CVE-2026-16300 - https://wpscan.com/vulnerability/0508f8c8-8ecc-4982-b14c-bf5f1c CVE-2026-1631 - https://wpscan.com/vulnerability/b19596c2-69bc-4e15-8632-eb80f4577e3c/ CVE-2026-16334 - https://github.com/LiamJim/cve/issues/1 CVE-2026-16337 - https://github.com/dotCMS/core/pull/36344 +CVE-2026-16349 - https://bugzilla.mozilla.org/show_bug.cgi?id=2034682 CVE-2026-16360 - https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022635%2C2028004%2C2035756%2C2045184%2C2045185%2C2045198%2C2045392%2C2045395%2C2045396%2C2045397%2C2045405%2C2045414%2C2045415%2C2045451%2C2045454%2C2045508%2C2045510%2C2045513%2C2045515%2C2045518%2C2045604%2C2045607%2C2045612%2C2045617%2C2045619%2C2045624%2C2045625%2C2045729%2C2045737%2C2045741%2C2045742%2C2045763%2C2045767%2C2045770%2C2045772%2C2045773%2C2045783%2C2045833%2C2045848%2C2045865%2C2045875%2C2045957%2C2047723%2C2047729%2C2048795%2C2048799%2C2048801%2C2049392%2C2049397%2C2049398%2C2049399%2C2049404%2C2049405%2C2049407%2C2049812%2C2050657%2C2050668%2C2050990%2C2053166%2C2053273%2C2053576%2C2053583%2C2053587 CVE-2026-1637 - https://github.com/LX-LX88/cve/issues/25 CVE-2026-16373 - https://bugzilla.mozilla.org/show_bug.cgi?id=2021964 @@ -148951,6 +149461,9 @@ CVE-2026-16422 - https://issues.chromium.org/issues/533515002 CVE-2026-16423 - https://issues.chromium.org/issues/534582496 CVE-2026-16426 - https://www.ibm.com/support/pages/node/7288830 CVE-2026-16434 - https://github.com/vrana/adminer/security/advisories/GHSA-fr74-9mf9-gf44 +CVE-2026-16436 - https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf +CVE-2026-16437 - https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf +CVE-2026-16438 - https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf CVE-2026-16440 - https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-ch6r-v7rg-4jqx CVE-2026-16445 - https://bugzilla.redhat.com/show_bug.cgi?id=2459963 CVE-2026-16449 - https://github.com/zsadmin2025/zs-admin-java/issues/4 @@ -149414,6 +149927,7 @@ CVE-2026-18646 - https://github.com/orionyan520/cve_report/issues/7 CVE-2026-18647 - https://github.com/orionyan520/cve_report/issues/8 CVE-2026-18649 - https://0xsemizzz.vercel.app/blog/cve-2026-18649-gstreamer-rtp-dos/ CVE-2026-18649 - https://0xsemizzz.vercel.app/projects/cve-2026-18649-gstreamer-rtp-dos/ +CVE-2026-18649 - https://github.com/0xSemizzz/CVE-2026-18649 CVE-2026-18653 - https://wpscan.com/vulnerability/e064c261-bc7b-4605-8da7-c7036fc396fc/ CVE-2026-18666 - https://wpscan.com/vulnerability/7a9b3fff-f454-4764-ad60-0b273781f7b4/ CVE-2026-1867 - https://wpscan.com/vulnerability/a78ebcd2-9355-4f4e-829e-b10867463576/ @@ -149425,8 +149939,10 @@ CVE-2026-18721 - https://github.com/sjmycz/cve/issues/6 CVE-2026-18737 - https://github.com/theopaid/SQL-injection-in-GET-rest-v-n-tags-stats-via-the-orderBy-parameter-shlink- CVE-2026-18756 - https://fluidattacks.com/es/advisories/turizo CVE-2026-18770 - https://asciinema.org/a/1230301 +CVE-2026-18773 - https://gist.github.com/YLChen-007/f0036aa1c410b70f5e41272947180645 CVE-2026-18774 - https://gist.github.com/YLChen-007/7c71603a25d84f372f2275dd570e99d4 CVE-2026-18774 - https://vuldb.com/cve/CVE-2026-18774 +CVE-2026-18775 - https://gist.github.com/YLChen-007/2e5bf7fa58113967807425032234cc89 CVE-2026-18776 - https://wpscan.com/vulnerability/4b6abb2d-941b-429f-a480-33d1aafad450/ CVE-2026-18777 - https://wpscan.com/vulnerability/05a09ba7-b781-4462-8c50-3a45f2757cb2/ CVE-2026-18778 - https://wpscan.com/vulnerability/0a9b6706-ff3a-4a41-b85c-fce696471217/ @@ -149467,6 +149983,7 @@ CVE-2026-18945 - https://wpscan.com/vulnerability/0d43b739-90de-4bae-90c1-3acaee CVE-2026-18946 - https://wpscan.com/vulnerability/fa13ebbb-8eea-492d-8f59-58228efb94d8/ CVE-2026-18960 - https://wpscan.com/vulnerability/c80abded-9f0e-4e44-8c8a-b0d1bc1b16d0/ CVE-2026-18962 - https://wpscan.com/vulnerability/146079f7-d4e5-4f1e-a715-f681fc33ed6a/ +CVE-2026-18968 - https://gist.github.com/hackusman/a1ba43253d6a62ace31ef39ec325e973 CVE-2026-18973 - https://gist.github.com/YLChen-007/2f12ffb785d975b46b73896c0fb8cb5d CVE-2026-18974 - https://gist.github.com/YLChen-007/479bfabb441bd6cc5337db910b004841 CVE-2026-18976 - https://github.com/NousResearch/hermes-agent/issues/46171 @@ -149474,9 +149991,12 @@ CVE-2026-18980 - https://github.com/nearai/ironclaw/issues/4861 CVE-2026-18980 - https://github.com/nearai/ironclaw/issues/4862 CVE-2026-18990 - https://gist.github.com/YLChen-007/2ba2e586f3d16cb368c8dcd6ef680178 CVE-2026-18991 - https://github.com/nanocoai/nanoclaw/issues/2760 +CVE-2026-18992 - https://github.com/zhayujie/CowAgent/issues/2904 +CVE-2026-18992 - https://github.com/zhayujie/CowAgent/issues/2904#issuecomment-4756833239 CVE-2026-18993 - https://github.com/NousResearch/hermes-agent/issues/46171 CVE-2026-18993 - https://github.com/NousResearch/hermes-agent/issues/48181 CVE-2026-18995 - https://github.com/netease-youdao/LobsterAI/issues/2176 +CVE-2026-18996 - https://github.com/cosmicstack-labs/mercury-agent/issues/72 CVE-2026-18997 - https://github.com/cosmicstack-labs/mercury-agent/issues/73 CVE-2026-1900 - https://wpscan.com/vulnerability/dc10b627-7981-4c53-bc9d-e87418f3fcfc/ CVE-2026-19005 - https://github.com/nanocoai/nanoclaw/issues/2807 @@ -149532,6 +150052,8 @@ CVE-2026-19073 - https://wpscan.com/vulnerability/8c8ca8ff-e0e8-4e9c-b79b-7f9581 CVE-2026-19074 - https://wpscan.com/vulnerability/657cb9f9-8be6-4841-b8a1-93d26a3d7984/ CVE-2026-19075 - https://wpscan.com/vulnerability/ad70162f-5514-41b8-84af-c79c2f881567/ CVE-2026-19077 - https://wpscan.com/vulnerability/dcced434-f7c0-4e19-b3cb-8196f6636aa3/ +CVE-2026-19082 - https://github.com/tonycoz/imager/commit/24bde0427a113264d53f45a9c29ae756d84c82fe.patch +CVE-2026-19082 - https://github.com/tonycoz/imager/security/advisories/GHSA-hx46-55wp-hv6m CVE-2026-19084 - https://wpscan.com/vulnerability/48b86169-5ccf-4111-be15-9dd45d478465/ CVE-2026-19085 - https://wpscan.com/vulnerability/bf9fc250-7a45-48f2-9b43-c4aaf5c9b862/ CVE-2026-19088 - https://wpscan.com/vulnerability/f58066e9-8066-43bc-8778-7ded279e8ee2/ @@ -149625,6 +150147,7 @@ CVE-2026-19328 - https://github.com/aktsmm/skill-ninja-mcp-server/issues/2 CVE-2026-19329 - https://github.com/andreahaku/codex_mcp/issues/1 CVE-2026-19330 - https://github.com/angrysky56/advanced-reasoning-mcp/issues/3 CVE-2026-19333 - https://github.com/NightTrek/Supabase-MCP/issues/2 +CVE-2026-19335 - https://github.com/Jane-xiaoer/skill-vision-control/issues/2 CVE-2026-19336 - https://vuldb.com/vuln/387172 CVE-2026-19336 - https://vuldb.com/vuln/387172/cti CVE-2026-19337 - https://github.com/adenot/mcp-google-search/issues/11 @@ -149715,6 +150238,7 @@ CVE-2026-19730 - https://bugzilla.redhat.com/show_bug.cgi?id=2508234 CVE-2026-19739 - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-84v8-vgp5-4vc9 CVE-2026-1974 - https://github.com/free5gc/free5gc/issues/816 CVE-2026-1974 - https://github.com/free5gc/free5gc/issues/816#issue-3832055233 +CVE-2026-19744 - https://github.com/ccyl13/Pentestify/commit/272f7d6033fd93fbc858835f55d616157041f123 CVE-2026-19744 - https://secur0.com/en/cna/cve-list/cve-2026-19744-stored-xss-in-pentestify-markdown-renderer-via-unescaped-quotes CVE-2026-19747 - https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Command%20Injection/Tenda%20Command%20Injection.md CVE-2026-19748 - https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Weak%20Bypass/Tenda%20Camera%20Weak%20Session%20Authentication%20Bypass.md @@ -149748,6 +150272,7 @@ CVE-2026-19814 - https://github.com/panda666-888/vuls/blob/main/totolink/a800r/s CVE-2026-19816 - https://github.com/PackageKit/PackageKit/security/advisories/GHSA-g5gf-h68q-gxc8 CVE-2026-19820 - https://www.backblaze.com/computer-backup/docs/backup-client-release-notes-windows CVE-2026-19823 - https://github.com/paueger/mycve/blob/main/Tenda_W20E/4.md +CVE-2026-19826 - https://github.com/alldatacenter/alldata/issues/832 CVE-2026-19827 - https://github.com/alldatacenter/alldata/issues/834 CVE-2026-19828 - https://github.com/648540858/wvp-GB28181-pro/issues/2175 CVE-2026-19840 - https://wpscan.com/vulnerability/030939ee-9aa9-4082-934e-c9a07fc3dfc3/ @@ -150310,19 +150835,31 @@ CVE-2026-2293 - https://fluidattacks.com/advisories/neton CVE-2026-22976 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2026-22977 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-22977 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +CVE-2026-22977 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-22979 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-22979 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-22980 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-22980 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-22982 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-22982 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-22992 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-22992 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-22994 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-22994 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23003 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23003 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23005 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23005 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23010 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23010 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23011 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23011 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23019 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23019 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23025 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2026-23026 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23026 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +CVE-2026-23026 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23030 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2026-23031 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2026-23032 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html @@ -150330,31 +150867,53 @@ CVE-2026-23033 - https://cert-portal.siemens.com/productcert/html/ssa-253495.htm CVE-2026-23037 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2026-23038 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23038 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +CVE-2026-23038 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23054 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23054 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23060 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23060 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23066 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23083 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23083 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23084 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23084 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23086 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23086 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23087 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23087 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23095 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23095 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23100 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23100 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23100 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23100 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23103 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23103 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23110 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23110 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23111 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23111 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2026-23111 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +CVE-2026-23111 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23112 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2026-23113 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23113 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23113 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23113 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23141 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23154 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23154 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23154 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23154 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23157 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-2316 - https://issues.chromium.org/issues/422531206 CVE-2026-2317 - https://issues.chromium.org/issues/464173573 CVE-2026-2318 - https://issues.chromium.org/issues/363930141 CVE-2026-2320 - https://issues.chromium.org/issues/435684924 CVE-2026-23204 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23204 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23204 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23204 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-2322 - https://issues.chromium.org/issues/470928605 CVE-2026-23220 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2026-23222 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html @@ -150364,116 +150923,225 @@ CVE-2026-23230 - https://cert-portal.siemens.com/productcert/html/ssa-253495.htm CVE-2026-23231 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23231 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2026-23231 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html +CVE-2026-23231 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23231 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23236 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2026-23238 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2026-23242 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23242 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23242 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23243 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23243 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23243 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23245 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23245 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23245 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23245 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-2325 - https://mattermost.com/security-updates +CVE-2026-23253 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23255 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23255 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23255 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23268 - https://www.qualys.com/2026/03/10/crack-armor.txt CVE-2026-23269 - https://www.qualys.com/2026/03/10/crack-armor.txt CVE-2026-2327 - https://gist.github.com/ltduc147/c9abecae1b291ede4f692f2ab988c917 CVE-2026-2327 - https://security.snyk.io/vuln/SNYK-JS-MARKDOWNIT-10666750 CVE-2026-23270 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23270 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23270 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23270 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23271 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23271 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23271 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23271 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23272 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23273 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23273 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23273 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23273 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23274 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23274 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23274 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23274 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23277 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23277 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23277 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23277 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23278 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23279 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23281 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23284 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23284 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23284 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23287 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23287 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23287 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-2329 - https://firmware.grandstream.com/Release_Note_GXP16xx_1.0.7.81.pdf CVE-2026-23290 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23290 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23290 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23290 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23291 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23292 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23293 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23293 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23293 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23296 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-2330 - https://www.first.org/cvss/calculator/3.1 CVE-2026-23300 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23300 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23300 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23300 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23302 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23303 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23304 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23304 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23304 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23304 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-2331 - https://www.first.org/cvss/calculator/3.1 +CVE-2026-23310 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23312 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23315 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23317 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23318 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23319 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23319 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23319 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23319 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-2332 - https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf CVE-2026-23321 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23321 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23321 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23321 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23335 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23335 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23335 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23336 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23339 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23340 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23340 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23340 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23340 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23343 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23343 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23343 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23343 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23351 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23351 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23351 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23351 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23352 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23356 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23357 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23359 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23359 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23359 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23359 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23364 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23365 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23365 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23365 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23365 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23367 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23368 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23368 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23368 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23368 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23370 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23370 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23370 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23370 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23372 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23378 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23378 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23378 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23378 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23379 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23379 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23379 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23379 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23381 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23381 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23381 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23381 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23382 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23388 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23389 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23391 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23391 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23391 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23391 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23392 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23392 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23392 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23392 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23395 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23396 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23397 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23397 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23397 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23397 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23398 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23398 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23398 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23398 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23399 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-23399 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23399 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23414 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23414 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23414 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23422 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23422 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23422 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-2343 - https://wpscan.com/vulnerability/ac1572ca-7994-401d-a268-6a8773e60ab1/ CVE-2026-23434 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23434 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23434 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23438 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23438 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23438 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23439 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23439 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23439 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-23442 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-23444 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-23446 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23446 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23446 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23449 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23449 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23449 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23450 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23450 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23450 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23452 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23452 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23452 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23454 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23454 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23454 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23455 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23455 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23455 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23456 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23456 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23456 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23457 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23457 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23457 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23458 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23458 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23458 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23463 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23463 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23463 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23474 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23474 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23474 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23475 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-23475 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-23475 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-23477 - https://github.com/RocketChat/Rocket.Chat/security/advisories/GHSA-g4wm-fg3c-g4p2 CVE-2026-23490 - https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq CVE-2026-23491 - https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-88gq-mv54-v3fc @@ -151271,6 +151939,7 @@ CVE-2026-27127 - https://github.com/craftcms/cms/security/advisories/GHSA-x27p-w CVE-2026-27129 - https://github.com/craftcms/cms/security/advisories/GHSA-x27p-wfqw-hfcc CVE-2026-27130 - https://github.com/Dokploy/dokploy/security/advisories/GHSA-fcgq-jjfg-hrhj CVE-2026-27135 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-27135 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-27146 - https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-26rv-8wpp-q84r CVE-2026-27147 - https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-5gmq-hrcx-6w45 CVE-2026-27161 - https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-f63g-xh6j-q56g @@ -151449,6 +152118,7 @@ CVE-2026-27884 - https://github.com/Pennyw0rth/NetExec/issues/1120 CVE-2026-27884 - https://github.com/Pennyw0rth/NetExec/pull/1121 CVE-2026-27889 - https://github.com/nats-io/nats-server/security/advisories/GHSA-pq2q-rcw4-3hr6 CVE-2026-27890 - https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-6crx-4g37-7j49 +CVE-2026-27891 - https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-3pgc-xqg9-cfr6 CVE-2026-27897 - https://github.com/WanderingAstronomer/Vociferous/security/advisories/GHSA-7cpr-frgj-h85v CVE-2026-27903 - https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj CVE-2026-27904 - https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74 @@ -152133,38 +152803,56 @@ CVE-2026-31354 - https://github.com/liufee/cms/issues/85 CVE-2026-3137 - https://github.com/910biter/cve/issues/3 CVE-2026-31389 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31389 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31389 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31391 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31391 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31391 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31396 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31396 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31396 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31402 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31402 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31402 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31403 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31403 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31403 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-31407 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-31411 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31411 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31411 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31414 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31414 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31414 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31415 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31415 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31415 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31416 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31416 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31416 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31417 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31417 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31417 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31418 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31418 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31418 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31421 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31421 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31421 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31422 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31422 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31422 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31423 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31423 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31423 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31424 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31424 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31424 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31427 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31427 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31427 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31428 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31428 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31428 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31431 - http://www.openwall.com/lists/oss-security/2026/04/29/23 CVE-2026-31431 - http://www.openwall.com/lists/oss-security/2026/04/29/26 CVE-2026-31431 - http://www.openwall.com/lists/oss-security/2026/04/30/5 @@ -152192,107 +152880,186 @@ CVE-2026-31431 - https://www.kb.cert.org/vuls/id/260001 CVE-2026-31431 - https://xint.io/blog/copy-fail-linux-distributions#the-fix-6 CVE-2026-31441 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31441 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31441 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31446 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31446 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31446 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31447 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31447 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31447 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31448 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31448 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31448 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31449 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-31449 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-31449 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-31450 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31450 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31450 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-31451 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-31452 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31452 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31452 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31466 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31466 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31466 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31469 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31469 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31469 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-3147 - https://vuldb.com/?submit.758692 CVE-2026-3148 - https://github.com/xiaoxiaojie12/CVE/issues/1 CVE-2026-3148 - https://www.sourcecodester.com/ CVE-2026-31485 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31485 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31485 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-31488 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-3149 - https://github.com/Zhangchao404/cve/issues/1 CVE-2026-31494 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31494 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31494 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31495 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31495 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31495 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31496 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31496 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31496 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-3150 - https://github.com/Zhangchao404/cve/issues/2 +CVE-2026-31500 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-31503 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31503 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31503 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31504 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31504 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31504 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31507 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31507 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31507 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31508 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31508 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31508 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-3151 - https://github.com/Zhangchao404/cve/issues/3 CVE-2026-31515 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31515 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31515 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31518 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31518 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31518 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-3152 - https://github.com/ltranquility/cve_submit/issues/6 CVE-2026-31521 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31521 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31521 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-3153 - https://github.com/ltranquility/CVE/issues/42 +CVE-2026-31532 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-31533 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31533 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31533 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31546 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31546 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31546 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31555 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31555 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31555 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31563 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31563 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31563 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31565 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31565 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31565 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-31580 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31583 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31586 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31611 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31612 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31613 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31617 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31622 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31624 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31625 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-31628 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31628 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31628 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-31629 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-3163 - https://www.sourcecodester.com/ +CVE-2026-31630 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-31634 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31634 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31634 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31635 - https://github.com/v12-security/pocs/tree/main/dirtydecrypt +CVE-2026-31637 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-3164 - https://github.com/a936848435/cve-report-cyy/issues/1 +CVE-2026-31642 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-31649 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31649 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31649 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-3165 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_64/README.md CVE-2026-31651 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31651 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31651 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31658 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31658 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31658 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-3166 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_65/README.md CVE-2026-31664 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31664 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31664 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31665 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31665 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31665 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31669 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31669 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31669 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-3167 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_66/README.md CVE-2026-31670 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31670 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31670 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31671 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31671 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31671 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-31673 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-31674 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31674 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31674 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-31676 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-3168 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_67/README.md CVE-2026-31680 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31680 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31680 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31681 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-31681 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-31681 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-31682 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31682 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31682 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-31685 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-3169 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_68/README.md +CVE-2026-31694 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31696 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31697 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31698 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31699 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-3170 - https://gist.github.com/archana1122m/e2953222b47c29c8c69855f5d623267d CVE-2026-31700 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-31700 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-31700 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31704 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31705 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31708 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31709 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-3171 - https://gist.github.com/archana1122m/2aed32e2a7ca5a648105bfdffd72a955 +CVE-2026-31711 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-31712 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-31737 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31737 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31737 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31752 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31752 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31752 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31761 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31761 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31761 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31768 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-31768 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-31768 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-31792 - https://github.com/InternationalColorConsortium/iccDEV/issues/633 CVE-2026-31793 - https://github.com/InternationalColorConsortium/iccDEV/issues/644 CVE-2026-31794 - https://github.com/InternationalColorConsortium/iccDEV/issues/645 @@ -152607,6 +153374,7 @@ CVE-2026-33052 - https://mantisbt.org/bugs/view.php?id=36974 CVE-2026-33054 - https://github.com/mesop-dev/mesop/security/advisories/GHSA-8qvf-mr4w-9x2c CVE-2026-33055 - https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-gchp-q4r4-x4ff CVE-2026-33057 - https://github.com/mesop-dev/mesop/security/advisories/GHSA-gjgx-rvqr-6w6v +CVE-2026-33058 - https://github.com/kanboard/kanboard/security/advisories/GHSA-f62r-m4mr-2xhh CVE-2026-33060 - https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-3xm7-qw7j-qc8v CVE-2026-33061 - https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2 CVE-2026-33066 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4663-4mpg-879v @@ -152638,6 +153406,9 @@ CVE-2026-33147 - https://github.com/GenericMappingTools/gmt/security/advisories/ CVE-2026-33148 - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-43p3-wx6h-9g7w CVE-2026-33149 - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-x636-4jx6-xc4w CVE-2026-33150 - https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx +CVE-2026-33152 - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-7m7c-jjqc-r522 +CVE-2026-33153 - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f83r-v3h5-pchf +CVE-2026-33154 - https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p CVE-2026-33155 - https://github.com/qlustered/deepdiff/security/advisories/GHSA-54jj-px8x-5w5q CVE-2026-33156 - https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2 CVE-2026-33164 - https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r @@ -152652,6 +153423,7 @@ CVE-2026-33211 - https://github.com/tektoncd/pipeline/security/advisories/GHSA-j CVE-2026-33226 - https://github.com/Budibase/budibase/security/advisories/GHSA-4647-wpjq-hh7f CVE-2026-33230 - https://github.com/nltk/nltk/security/advisories/GHSA-gfwx-w7gr-fvh7 CVE-2026-33231 - https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g +CVE-2026-33232 - https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-374w-2pxq-c9jp CVE-2026-33233 - https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-rfg2-37xq-w4m9 CVE-2026-33234 - https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-4jwj-6mg5-wrwf CVE-2026-33235 - https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-ppw9-h7rv-gwq9 @@ -152664,6 +153436,7 @@ CVE-2026-3326 - https://wpscan.com/vulnerability/2c5bdb17-8b12-45b5-878b-627056d CVE-2026-33265 - https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251205-01_LibreChat_RAG_API_Authentication_Bypass CVE-2026-33265 - https://www.openwall.com/lists/oss-security/2026/03/18/3 CVE-2026-33284 - https://github.com/globaleaks/globaleaks-whistleblowing-software/security/advisories/GHSA-84wr-q36q-wqhv +CVE-2026-33287 - https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v CVE-2026-33290 - https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-9hc3-mh5h-4fgh CVE-2026-33292 - https://github.com/WWBN/AVideo/security/advisories/GHSA-pw4v-x838-w5pg CVE-2026-33293 - https://github.com/WWBN/AVideo/security/advisories/GHSA-xmjm-86qv-g226 @@ -152681,6 +153454,7 @@ CVE-2026-33309 - https://github.com/langflow-ai/langflow/security/advisories/GHS CVE-2026-33310 - https://github.com/intake/intake/security/advisories/GHSA-37g4-qqqv-7m99 CVE-2026-33314 - https://github.com/pyload/pyload/security/advisories/GHSA-q485-cg9q-xq2r CVE-2026-33315 - https://github.com/go-vikunja/vikunja/security/advisories/GHSA-47cr-f226-r4pq +CVE-2026-33316 - https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vq4q-79hh-q767 CVE-2026-33318 - https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp CVE-2026-33320 - https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8 CVE-2026-33324 - https://github.com/dataease/SQLBot/security/advisories/GHSA-q2q6-gqqh-4xrx @@ -152696,6 +153470,7 @@ CVE-2026-33345 - https://github.com/solidtime-io/solidtime/security/advisories/G CVE-2026-33346 - https://github.com/openemr/openemr/security/advisories/GHSA-qvf6-6xc6-9qv7 CVE-2026-33349 - https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g CVE-2026-33353 - https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-xgxp-f695-6vrp +CVE-2026-33396 - https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cqpg-phpp-9jjg CVE-2026-33398 - https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2r6x-cv4f-h8fx CVE-2026-33399 - https://github.com/ellite/Wallos/security/advisories/GHSA-mfjc-3258-cq3j CVE-2026-33400 - https://github.com/ellite/Wallos/security/advisories/GHSA-p6v5-227f-f3fv @@ -152713,6 +153488,7 @@ CVE-2026-33432 - https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3 CVE-2026-33433 - https://github.com/traefik/traefik/security/advisories/GHSA-qr99-7898-vr7c CVE-2026-33434 - https://github.com/wazuh/wazuh/security/advisories/GHSA-37qc-8242-6crg CVE-2026-33436 - https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-q5j3-4m5w-wp75 +CVE-2026-33437 - https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-qc47-qgh9-xj63 CVE-2026-33438 - https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-3932-2rfq-87xm CVE-2026-33439 - https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-2cqq-rpvq-g5qj CVE-2026-33469 - https://github.com/blakeblackshear/frigate/security/advisories/GHSA-26g3-f8g8-9ffh @@ -152725,8 +153501,11 @@ CVE-2026-33476 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA- CVE-2026-33477 - https://github.com/error311/FileRise/security/advisories/GHSA-62wx-vp78-2p83 CVE-2026-33478 - https://github.com/WWBN/AVideo/security/advisories/GHSA-687q-32c6-8x68 CVE-2026-33479 - https://github.com/WWBN/AVideo/security/advisories/GHSA-xggw-g9pm-9qhh +CVE-2026-33480 - https://github.com/WWBN/AVideo/security/advisories/GHSA-p3gr-g84w-g8hh CVE-2026-33482 - https://github.com/WWBN/AVideo/security/advisories/GHSA-pmj8-r2j7-xg6c CVE-2026-33483 - https://github.com/WWBN/AVideo/security/advisories/GHSA-vv7w-qf5c-734w +CVE-2026-33484 - https://github.com/langflow-ai/langflow/security/advisories/GHSA-7grx-3xcx-2xv5 +CVE-2026-33485 - https://github.com/WWBN/AVideo/security/advisories/GHSA-8p58-35c3-ccxx CVE-2026-33486 - https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g CVE-2026-33488 - https://github.com/WWBN/AVideo/security/advisories/GHSA-6m5f-j7w2-w953 CVE-2026-33489 - https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3 @@ -152780,6 +153559,8 @@ CVE-2026-33633 - https://github.com/kovidgoyal/kitty/security/advisories/GHSA-j6 CVE-2026-33634 - https://www.wiz.io/blog/teampcp-attack-kics-github-action CVE-2026-33635 - https://github.com/icalendar/icalendar/security/advisories/GHSA-pv9c-9mfh-hvxq CVE-2026-33637 - https://github.com/lostisland/faraday/security/advisories/GHSA-5rv5-xj5j-3484 +CVE-2026-33639 - https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-34g5-4hfc-g983 +CVE-2026-33640 - https://github.com/outline/outline/security/advisories/GHSA-cwhc-53hw-qqx6 CVE-2026-33641 - https://github.com/nicolargo/glances/security/advisories/GHSA-qhj7-v7h7-q4c7 CVE-2026-33642 - https://github.com/kovidgoyal/kitty/security/advisories/GHSA-qfgm-2c64-6x3x CVE-2026-33643 - https://gist.github.com/b0b0haha/fb59199fb1fdf9414e76442e0599bfed @@ -152789,6 +153570,7 @@ CVE-2026-33647 - https://github.com/WWBN/AVideo/security/advisories/GHSA-wxjw-ph CVE-2026-33648 - https://github.com/WWBN/AVideo/security/advisories/GHSA-5m4q-5cvx-36mw CVE-2026-33649 - https://github.com/WWBN/AVideo/security/advisories/GHSA-g8x9-7mgh-7cvj CVE-2026-33650 - https://github.com/WWBN/AVideo/security/advisories/GHSA-8x77-f38v-4m5j +CVE-2026-33651 - https://github.com/WWBN/AVideo/security/advisories/GHSA-pvw4-p2jm-chjm CVE-2026-33653 - https://github.com/farisc0de/Uploady/security/advisories/GHSA-2834-m7xm-fqr5 CVE-2026-33654 - https://github.com/HKUDS/nanobot/security/advisories/GHSA-4gmr-2vc8-7qh3 CVE-2026-33656 - https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x @@ -152810,9 +153592,12 @@ CVE-2026-33681 - https://github.com/WWBN/AVideo/security/advisories/GHSA-3hwv-x8 CVE-2026-33683 - https://github.com/WWBN/AVideo/security/advisories/GHSA-ghx5-7jjg-q2j7 CVE-2026-33684 - https://github.com/WWBN/AVideo/security/advisories/GHSA-8j8m-p79x-g4jm CVE-2026-33685 - https://github.com/WWBN/AVideo/security/advisories/GHSA-j36m-74g2-7m95 +CVE-2026-33686 - https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958 CVE-2026-33688 - https://github.com/WWBN/AVideo/security/advisories/GHSA-m99f-mmvg-3xmx CVE-2026-33690 - https://github.com/WWBN/AVideo/security/advisories/GHSA-8p2x-5cpm-qrqw CVE-2026-33693 - https://github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35 +CVE-2026-33693 - https://github.com/advisories/GHSA-7723-35v7-qcxw +CVE-2026-33711 - https://github.com/lxc/incus/security/advisories/GHSA-q9vp-3wcg-8p4x CVE-2026-33716 - https://github.com/WWBN/AVideo/security/advisories/GHSA-9hv9-gvwm-95f2 CVE-2026-33717 - https://github.com/WWBN/AVideo/security/advisories/GHSA-8wf4-c4x3-h952 CVE-2026-33719 - https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh @@ -152826,9 +153611,11 @@ CVE-2026-33734 - https://github.com/FOSSBilling/FOSSBilling/security/advisories/ CVE-2026-33735 - https://github.com/franklioxygen/MyTube/security/advisories/GHSA-63cf-662x-crp2 CVE-2026-33738 - https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5574-7f3r-hm9j CVE-2026-33739 - https://github.com/FOGProject/fogproject/security/advisories/GHSA-8m2f-4x7g-p8f3 +CVE-2026-33740 - https://github.com/espocrm/espocrm/security/advisories/GHSA-wr7j-hxf8-hc4w CVE-2026-33741 - https://github.com/espocrm/espocrm/security/advisories/GHSA-5wh5-ccv2-m3pv CVE-2026-33743 - https://github.com/lxc/incus/security/advisories/GHSA-vg76-xmhg-j5x3 CVE-2026-33745 - https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-6hrp-7fq9-3qv2 +CVE-2026-33752 - https://github.com/lexiforest/curl_cffi/security/advisories/GHSA-qw2m-4pqf-rmpp CVE-2026-33754 - https://github.com/wazuh/wazuh/security/advisories/GHSA-476v-28pp-5wg9 CVE-2026-3376 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_76/README.md CVE-2026-33760 - https://github.com/langflow-ai/langflow/security/advisories/GHSA-9c59-2mvc-vfr8 @@ -152860,6 +153647,7 @@ CVE-2026-3384 - https://github.com/ChaiScript/ChaiScript/issues/633#issue-382817 CVE-2026-33857 - http://www.openwall.com/lists/oss-security/2026/05/04/15 CVE-2026-33865 - https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors CVE-2026-33866 - https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors +CVE-2026-33867 - https://github.com/WWBN/AVideo/security/advisories/GHSA-363v-5rh8-23wg CVE-2026-33870 - https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8 CVE-2026-33870 - https://w4ke.info/2025/06/18/funky-chunks.html CVE-2026-33873 - https://github.com/langflow-ai/langflow/security/advisories/GHSA-v8hw-mh8c-jxfc @@ -152901,6 +153689,8 @@ CVE-2026-33950 - https://github.com/SignalK/signalk-server/security/advisories/G CVE-2026-33952 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4v4p-9v5x-hc93 CVE-2026-33953 - https://github.com/Kovah/LinkAce/security/advisories/GHSA-wp4g-qw9j-wfjg CVE-2026-33954 - https://github.com/Kovah/LinkAce/security/advisories/GHSA-88h3-cq25-vw8q +CVE-2026-33955 - https://github.com/streetwriters/notesnook/security/advisories/GHSA-45g3-cv93-q59v +CVE-2026-33975 - https://github.com/twentyhq/twenty/security/advisories/GHSA-vrcj-hv2q-c58m CVE-2026-33976 - https://github.com/streetwriters/notesnook/security/advisories/GHSA-f42f-phvp-43x5 CVE-2026-33977 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8f2g-3q27-6xm5 CVE-2026-33978 - https://github.com/streetwriters/notesnook/security/advisories/GHSA-f27j-fqc6-v7pm @@ -153231,6 +154021,7 @@ CVE-2026-34966 - https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4 CVE-2026-34968 - https://github.com/vrana/adminer/security/advisories/GHSA-6pg3-chwq-wgqc CVE-2026-34969 - https://github.com/nhost/nhost/security/advisories/GHSA-g2qj-prgh-4g9r CVE-2026-3497 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-3497 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-34973 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gcp9-5jc8-976x CVE-2026-34974 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-5crx-pfhq-4hgg CVE-2026-34976 - https://github.com/dgraph-io/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw @@ -153249,12 +154040,16 @@ CVE-2026-35029 - http://seclists.org/fulldisclosure/2026/Apr/17 CVE-2026-3503 - https://github.com/wolfSSL/wolfssl/pull/9734 CVE-2026-35031 - https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3 CVE-2026-35032 - https://github.com/jellyfin/jellyfin/security/advisories/GHSA-8fw7-f233-ffr8 +CVE-2026-35033 - https://github.com/jellyfin/jellyfin/security/advisories/GHSA-jh22-fw8w-2v9x +CVE-2026-35036 - https://github.com/lin-snow/Ech0/security/advisories/GHSA-wc4h-2348-jc3p +CVE-2026-35037 - https://github.com/lin-snow/Ech0/security/advisories/GHSA-cqgf-f4x7-g6wc CVE-2026-35038 - https://github.com/SignalK/signalk-server/security/advisories/GHSA-qh3j-mrg8-f234 CVE-2026-35041 - https://github.com/nearform/fast-jwt/security/advisories/GHSA-cjw9-ghj4-fwxf CVE-2026-35042 - https://github.com/nearform/fast-jwt/security/advisories/GHSA-hm7r-c7qw-ghp6 CVE-2026-35043 - https://github.com/bentoml/BentoML/security/advisories/GHSA-fgv4-6jr3-jgfw CVE-2026-35044 - https://github.com/bentoml/BentoML/security/advisories/GHSA-v959-cwq9-7hr6 CVE-2026-35045 - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-v8x3-w674-55p5 +CVE-2026-35046 - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-9hhh-g2fc-r8x2 CVE-2026-35053 - https://github.com/OneUptime/oneuptime/security/advisories/GHSA-6c3w-7xg4-4cf7 CVE-2026-35057 - https://github.com/methosiea/xenforo-2-xss CVE-2026-35058 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2381 @@ -153267,9 +154062,12 @@ CVE-2026-35153 - https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060 CVE-2026-35154 - https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities CVE-2026-35168 - https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98 CVE-2026-35173 - https://github.com/xenocrat/chyrp-lite/security/advisories/GHSA-8c3h-rh2j-fxr9 +CVE-2026-35176 - https://github.com/trabucayre/openFPGALoader/security/advisories/GHSA-9x7m-m8gv-px2j +CVE-2026-35181 - https://github.com/WWBN/AVideo/security/advisories/GHSA-4q27-4rrq-fx95 CVE-2026-35184 - https://gist.github.com/NicolasPauferro/d877992327592f1e8eb4e2c9dce1ae9b CVE-2026-35185 - https://github.com/haxtheweb/issues/security/advisories/GHSA-3676-wj6r-hwh7 CVE-2026-35187 - https://github.com/pyload/pyload/security/advisories/GHSA-2wvg-62qm-gj33 +CVE-2026-35196 - https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-crc6-r6c7-44q3 CVE-2026-35198 - https://github.com/heyform/heyform/security/advisories/GHSA-chmm-jqpm-3pwx CVE-2026-35208 - https://vimeo.com/1175908262 CVE-2026-35210 - https://github.com/OpenCTI-Platform/opencti/releases/tag/7.260326.0 @@ -153282,6 +154080,7 @@ CVE-2026-3524 - https://mattermost.com/security-updates CVE-2026-35287 - https://www.oracle.com/security-alerts/cpujul2026.html CVE-2026-35290 - https://www.oracle.com/security-alerts/cpujul2026.html CVE-2026-3536 - https://issues.chromium.org/issues/485622239 +CVE-2026-35368 - https://github.com/uutils/coreutils/issues/10327 CVE-2026-3537 - https://issues.chromium.org/issues/474266014 CVE-2026-3538 - https://issues.chromium.org/issues/484983991 CVE-2026-35396 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-4qxc-5j5f-4gp5 @@ -153293,15 +154092,22 @@ CVE-2026-3542 - https://issues.chromium.org/issues/485152421 CVE-2026-3543 - https://issues.chromium.org/issues/485267831 CVE-2026-3544 - https://issues.chromium.org/issues/485683110 CVE-2026-35443 - https://github.com/NamelessMC/Nameless/security/advisories/GHSA-wcrf-5gcp-pf64 +CVE-2026-35448 - https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9 +CVE-2026-35449 - https://github.com/WWBN/AVideo/security/advisories/GHSA-hg8q-8wqr-35xx CVE-2026-35452 - https://github.com/WWBN/AVideo/security/advisories/GHSA-99j6-hj87-6fcf +CVE-2026-35453 - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6wpp-88cp-7q68 CVE-2026-35455 - https://github.com/immich-app/immich/security/advisories/GHSA-9qx4-67jm-cc66 +CVE-2026-35458 - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fmwg-qcqh-m992 CVE-2026-35459 - https://github.com/pyload/pyload/security/advisories/GHSA-7gvf-3w72-p2pg CVE-2026-35460 - https://github.com/papra-hq/papra/security/advisories/GHSA-6f8x-2rc9-vgh4 +CVE-2026-35461 - https://github.com/papra-hq/papra/security/advisories/GHSA-cjw7-qg95-58mq CVE-2026-35462 - https://github.com/papra-hq/papra/security/advisories/GHSA-866c-mc22-wvv5 CVE-2026-35463 - https://github.com/pyload/pyload/security/advisories/GHSA-w48f-wwwf-f5fr +CVE-2026-35464 - https://github.com/pyload/pyload/security/advisories/GHSA-4744-96p5-mp2j CVE-2026-35464 - https://github.com/pyload/pyload/security/advisories/GHSA-r7mc-x6x7-cqxx CVE-2026-35469 - https://bugzilla.redhat.com/show_bug.cgi?id=2457729 CVE-2026-3547 - https://github.com/wolfSSL/wolfssl/pull/9859 +CVE-2026-35472 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-h8wm-6xhv-r547 CVE-2026-35473 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-q72f-4qx3-cvp7 CVE-2026-3548 - https://github.com/wolfSSL/wolfssl/pull/9628/ CVE-2026-3548 - https://github.com/wolfSSL/wolfssl/pull/9873/ @@ -153311,8 +154117,12 @@ CVE-2026-35486 - https://github.com/oobabooga/text-generation-webui/security/adv CVE-2026-35488 - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-xvmf-cfrq-4j8f CVE-2026-35489 - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-8w8h-3pv2-3554 CVE-2026-3549 - https://github.com/wolfSSL/wolfssl/pull/9817 +CVE-2026-35490 - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-jmrh-xmgh-x9j4 CVE-2026-35491 - https://github.com/pi-hole/FTL/security/advisories/GHSA-r7g8-3fj7-m5qq +CVE-2026-35492 - https://github.com/kedro-org/kedro/issues/5452 +CVE-2026-35514 - https://github.com/chartbrew/chartbrew/security/advisories/GHSA-g47g-v5cp-j8hp CVE-2026-35517 - https://github.com/pi-hole/FTL/security/advisories/GHSA-23w8-7333-p9fj +CVE-2026-35519 - https://github.com/pi-hole/FTL/security/advisories/GHSA-wxhv-w77q-6qwp CVE-2026-35534 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pqp6-54p2-m66f CVE-2026-35535 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html CVE-2026-35535 - https://www.qualys.com/2026/03/10/crack-armor.txt @@ -153320,17 +154130,26 @@ CVE-2026-35548 - https://servicedesk.guardsix.com/hc/en-us/articles/355556832050 CVE-2026-35569 - https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292 CVE-2026-35573 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r6cr-mvr9-f6wx CVE-2026-35574 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cx82-8xrh-7f5c +CVE-2026-35575 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-gc8q-2gw7-qj7w +CVE-2026-35579 - https://github.com/coredns/coredns/security/advisories/GHSA-vp29-5652-4fw9 CVE-2026-35582 - https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-3p24-9x7v-7789 CVE-2026-35584 - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-873c-r7v5-g98v +CVE-2026-35585 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw +CVE-2026-35586 - https://github.com/pyload/pyload/security/advisories/GHSA-ppvx-rwh9-7rj7 +CVE-2026-35587 - https://github.com/nicolargo/glances/security/advisories/GHSA-g5pq-48mj-jvw8 CVE-2026-35588 - https://github.com/nicolargo/glances/security/advisories/GHSA-grp3-h8m8-45p7 CVE-2026-35589 - https://github.com/HKUDS/nanobot/security/advisories/GHSA-v5j3-4q66-58cf CVE-2026-35592 - https://github.com/pyload/pyload/security/advisories/GHSA-mvwx-582f-56r7 +CVE-2026-35596 - https://github.com/go-vikunja/vikunja/commit/fc216c38afaa51dd56dde7a97343d2148ecf24c1 +CVE-2026-35596 - https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hj5c-mhh2-g7jq CVE-2026-35597 - https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fgfv-pv97-6cmj CVE-2026-35598 - https://github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x CVE-2026-35599 - https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r4fg-73rc-hhh7 CVE-2026-35600 - https://github.com/go-vikunja/vikunja/security/advisories/GHSA-45q4-x4r9-8fqj CVE-2026-35601 - https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r +CVE-2026-35602 - https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54 CVE-2026-35604 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-v9w4-gm2x-6rvf +CVE-2026-35605 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5q48-q4fm-g3m6 CVE-2026-35607 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7526-j432-6ppp CVE-2026-35615 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-693f-pf34-72c5 CVE-2026-35619 - https://github.com/openclaw/openclaw/security/advisories/GHSA-68f8-9mhj-h2mp @@ -153338,8 +154157,11 @@ CVE-2026-3563 - https://devolutions.net/security/advisories/DEVO-2026-0008 CVE-2026-35632 - https://github.com/openclaw/openclaw/security/advisories/GHSA-7xr2-q9vf-x4r5 CVE-2026-35663 - https://github.com/openclaw/openclaw/commit/d3d8e316bd819d3c7e34253aeb7eccb2510f5f48 CVE-2026-35665 - https://github.com/openclaw/openclaw/security/advisories/GHSA-w6m8-cqvj-pg5v +CVE-2026-35667 - https://github.com/openclaw/openclaw/security/advisories/GHSA-3298-56p6-rpw2 +CVE-2026-35668 - https://github.com/openclaw/openclaw/security/advisories/GHSA-hr5v-j9h9-xjhg CVE-2026-35671 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-xvp4-phqj-cjr3 CVE-2026-35675 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w9xh-5f39-vq89 +CVE-2026-35676 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9qv9-8xv6-5p35 CVE-2026-35716 - https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-35716 CVE-2026-35717 - https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-35717 CVE-2026-35718 - https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2026-35718 @@ -153348,6 +154170,7 @@ CVE-2026-3580 - https://github.com/wolfSSL/wolfssl/pull/9855 CVE-2026-3585 - https://research.cleantalk.org/cve-2026-3585/ CVE-2026-35867 - https://github.com/Orcust-Automaton/Vulnerability/blob/main/LB-Link/AC1900_AZ2/bs_SetLimitCli_info.md CVE-2026-3590 - https://mattermost.com/security-updates +CVE-2026-35904 - https://github.com/PwnOnu/T3-Technology-CPE-Advisories/blob/main/CVE-2026-35904.md CVE-2026-3598 - https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub CVE-2026-36044 - https://gist.github.com/NucleiAv/47e87da08b90ef464fd9b35affe578fb CVE-2026-36045 - https://gist.github.com/NucleiAv/41899be6266a9813840301577792ed68 @@ -153391,6 +154214,7 @@ CVE-2026-36392 - https://github.com/moksh-nfsu/CVE-2026-36392 CVE-2026-36418 - https://github.com/Catherines77/code-au/blob/main/jimureport/aviator.md CVE-2026-36438 - https://www.intelbras.com/pt-br/camera-dome-wi-fi-vip-1230-d-w-g4 CVE-2026-36499 - https://github.com/majdlatah/OVS-Other-Config-Bug +CVE-2026-36537 - https://gist.github.com/KKC73/b9d4efda05693882f1e613c0e0fac78d CVE-2026-36539 - https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36539/readme.md CVE-2026-36540 - https://github.com/sir3ns/cve-disclosure/blob/main/CVE-2026-36540/readme.md CVE-2026-36574 - https://github.com/Wassimulator/CactusViewer/issues/65 @@ -154044,6 +154868,7 @@ CVE-2026-40353 - https://github.com/wger-project/wger/security/advisories/GHSA-6 CVE-2026-40355 - https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html CVE-2026-40355 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-40355 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-40355 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-40356 - https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-vulnerabilities.html CVE-2026-4046 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2026-40474 - https://github.com/wger-project/wger/security/advisories/GHSA-xppv-4jrx-qf8m @@ -154449,6 +155274,7 @@ CVE-2026-4198 - https://github.com/hypermodel-labs/mcp-server-auto-commit/issues CVE-2026-41988 - https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq CVE-2026-41989 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-41989 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-41989 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-41989 - https://dev.gnupg.org/T8211 CVE-2026-4199 - https://github.com/bazinga012/mcp_code_executor/issues/17 CVE-2026-42016 - https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201 @@ -154793,54 +155619,99 @@ CVE-2026-42996 - https://github.com/JS8Call-improved/JS8Call-improved/security/a CVE-2026-43002 - https://bugs.launchpad.net/horizon/+bug/2150331 CVE-2026-43011 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43011 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43011 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-43024 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43024 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43024 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-43025 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43025 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43025 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-43026 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43026 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43026 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-43027 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43027 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43027 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-43028 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43028 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43028 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-43030 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43030 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43030 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-43033 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43033 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43033 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-43035 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43035 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43035 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-43038 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43038 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43038 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-43040 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43040 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43040 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-43052 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-43057 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43057 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-43057 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-4307 - https://gist.github.com/YLChen-007/1819c843ad26aaaaecdc768a789df022 CVE-2026-43071 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-43071 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-43071 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43074 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4308 - https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989 CVE-2026-4308 - https://gist.github.com/YLChen-007/c99c44aa019266a72636757308d43989#poc +CVE-2026-43080 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-43085 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-43085 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-43085 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-43089 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-43089 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-43089 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43093 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43094 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43099 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43110 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43111 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43112 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43114 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-43116 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-43116 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-43116 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43117 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4318 - https://github.com/xiaoheshang404/cve/issues/1#issue-4026284809 CVE-2026-4319 - https://github.com/6Justdododo6/CVE/issues/14 CVE-2026-43216 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-43216 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-43284 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-43284 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2026-43284 - https://github.com/V4bel/dirtyfrag CVE-2026-43284 - https://www.vicarius.io/vsociety/posts/cve-2026-43284-detection-script-dirty-frag-linux-kernel-local-privilege-escalation CVE-2026-43284 - https://www.vicarius.io/vsociety/posts/cve-2026-43284-mitigation-script-dirty-frag-linux-kernel-local-privilege-escalation CVE-2026-43303 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-43303 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-43303 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43350 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4338 - https://wpscan.com/vulnerability/50f68395-72fc-4f99-8e6d-6aa90cc640b5/ CVE-2026-4339 - https://mattermost.com/security-updates +CVE-2026-43421 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-43492 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-43492 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-43492 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43493 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-43494 - http://www.openwall.com/lists/oss-security/2026/05/21/2 CVE-2026-43494 - https://github.com/v12-security/pocs/tree/main/pintheft +CVE-2026-43496 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-43499 - http://www.openwall.com/lists/oss-security/2026/07/08/12 CVE-2026-43499 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-43499 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-43499 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-43500 - https://github.com/V4bel/dirtyfrag CVE-2026-43501 - https://bugzilla.redhat.com/show_bug.cgi?id=2480457 CVE-2026-43501 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-43501 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-43502 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-43503 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-43504 - https://prosody.im/security/advisory_735dd9d3/ CVE-2026-43504 - https://www.openwall.com/lists/oss-security/2026/05/01/5 CVE-2026-43505 - https://prosody.im/security/advisory_735dd9d3/ @@ -155001,6 +155872,7 @@ CVE-2026-44244 - https://github.com/gitpython-developers/GitPython/security/advi CVE-2026-44245 - https://github.com/kyverno/kyverno/security/advisories/GHSA-q98m-7w8c-w388 CVE-2026-44246 - https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59 CVE-2026-44251 - https://github.com/wazuh/wazuh/security/advisories/GHSA-jv5r-5p7c-g9fq +CVE-2026-44252 - https://github.com/wazuh/wazuh/security/advisories/GHSA-34fx-c2xw-xcpg CVE-2026-44253 - https://github.com/wazuh/wazuh/security/advisories/GHSA-h5r8-gvhv-cmp2 CVE-2026-44254 - https://github.com/wazuh/wazuh/security/advisories/GHSA-9wm4-fp6c-hqgq CVE-2026-44255 - https://github.com/wazuh/wazuh/security/advisories/GHSA-3978-44q9-9px9 @@ -155015,6 +155887,7 @@ CVE-2026-44286 - https://github.com/labring/FastGPT/security/advisories/GHSA-xpx CVE-2026-44287 - https://github.com/labring/FastGPT/security/advisories/GHSA-f5mq-qxm4-5mvc CVE-2026-44296 - https://github.com/deskflow/deskflow/security/advisories/GHSA-3mxm-cgh2-6448 CVE-2026-4430 - https://www.libreoffice.org/about-us/security/advisories/cve-2026-4430 +CVE-2026-44300 - https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5 CVE-2026-44302 - https://github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx CVE-2026-44309 - https://github.com/sigstore/gitsign/security/advisories/GHSA-7rmh-48mx-2vwc CVE-2026-44310 - https://github.com/sigstore/gitsign/security/advisories/GHSA-7c37-gx6w-8vc5 @@ -155156,6 +156029,7 @@ CVE-2026-44638 - https://github.com/saitoha/libsixel/security/advisories/GHSA-wp CVE-2026-4464 - https://issues.chromium.org/issues/487208468 CVE-2026-44640 - https://github.com/nanomq/nanomq/security/advisories/GHSA-9fgw-v323-jmjj CVE-2026-44641 - https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr +CVE-2026-44642 - https://github.com/Piwigo/Piwigo/security/advisories/GHSA-6wj3-7fhw-gfpm CVE-2026-44644 - https://github.com/harttle/liquidjs/security/advisories/GHSA-2qv6-9wx5-cwv4 CVE-2026-44645 - https://github.com/harttle/liquidjs/security/advisories/GHSA-8xx9-69p8-7jp3 CVE-2026-44646 - https://github.com/harttle/liquidjs/commit/dbbf6288030591bf6da28d8c1cce5a17bca97bb6 @@ -155260,8 +156134,10 @@ CVE-2026-45010 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9 CVE-2026-45012 - https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-pr28-mf3q-qpg6 CVE-2026-45018 - https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9 CVE-2026-45018 - https://github.com/Chainlit/chainlit/releases/tag/2.12.0 +CVE-2026-45019 - https://github.com/Chainlit/chainlit/blob/2.12.0/docs/security-advisory-2026-mcp.md#spl-2026-002--ssrf-via-mcp-streamable-http--sse CVE-2026-45019 - https://github.com/Chainlit/chainlit/commit/0565fd0eccb915fce159929598b053ed79f6e0c9 CVE-2026-45019 - https://github.com/Chainlit/chainlit/releases/tag/2.12.0 +CVE-2026-45019 - https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j CVE-2026-45023 - https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-8pjg-mfqm-vrhr CVE-2026-45025 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g78v-g28w-rg73 CVE-2026-45026 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-r578-8vgj-vph7 @@ -155286,6 +156162,7 @@ CVE-2026-4509 - https://github.com/zzj-create/cvetest/blob/main/VULN-04_DANGEROU CVE-2026-45090 - https://github.com/hahwul/dalfox/security/advisories/GHSA-2g4x-fq3j-cgq4 CVE-2026-4510 - https://github.com/zzj-create/cvetest/blob/main/VULN-05_BACKURL_OPEN_REDIRECT_XSS_REPORT_EN.md CVE-2026-45102 - https://github.com/OneUptime/oneuptime/security/advisories/GHSA-g9cp-35m2-fjv6 +CVE-2026-45103 - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jv35-555v-54jh CVE-2026-45104 - https://github.com/MapServer/MapServer/security/advisories/GHSA-4h8g-378q-r75m CVE-2026-4512 - https://wpscan.com/vulnerability/6dfb4378-fe6a-4462-af10-8e7504e3d593/ CVE-2026-45130 - https://github.com/vim/vim/security/advisories/GHSA-q4jv-r9gj-6cwv @@ -155297,6 +156174,7 @@ CVE-2026-45147 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA- CVE-2026-45148 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fmh9-gpqh-g53g CVE-2026-45151 - https://github.com/nanomq/nanomq/security/advisories/GHSA-9qhf-wgp4-p7w5 CVE-2026-45152 - https://github.com/uniget-org/cli/security/advisories/GHSA-qqq4-5773-pmw5 +CVE-2026-45161 - https://github.com/wger-project/wger/security/advisories/GHSA-xf64-4pmc-h8qf CVE-2026-45162 - https://github.com/pimcore/pimcore/security/advisories/GHSA-36fc-7wjg-mfvj CVE-2026-45181 - https://blog.calif.io/p/using-ida-to-find-bugs-in-ida-with CVE-2026-45182 - https://lowlevel.fun/posts/tiny-udp-cannon-android-vpn-bypass/ @@ -155314,6 +156192,7 @@ CVE-2026-45294 - https://github.com/freescout-help-desk/freescout/security/advis CVE-2026-45295 - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-qjr9-6v9q-3r72 CVE-2026-45298 - https://github.com/amir20/dozzle/security/advisories/GHSA-3v9w-6365-9w54 CVE-2026-45300 - https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-fmxf-pm6p-7xgm +CVE-2026-45302 - https://github.com/milamer/parse-nested-form-data/commit/527ad58eb486e32438f7198fb88315c20449d792 CVE-2026-45303 - https://github.com/open-webui/open-webui/security/advisories/GHSA-4vrc-m9ch-6m3r CVE-2026-45306 - https://github.com/pyload/pyload/security/advisories/GHSA-w727-595x-pc3r CVE-2026-45310 - https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-96ff-gc8g-wpvg @@ -155330,6 +156209,7 @@ CVE-2026-45320 - https://github.com/dataease/dataease/security/advisories/GHSA-8 CVE-2026-45322 - https://github.com/microsoft/UFO/security/advisories/GHSA-wj72-7w8h-695f CVE-2026-45323 - https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc CVE-2026-4533 - https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20(Time-Based%20Blind)Simple%20Food%20Ordering%20System%20in%20PHP.md?plain=1 +CVE-2026-45331 - https://github.com/open-webui/open-webui/security/advisories/GHSA-4v7r-f4w8-8972 CVE-2026-45335 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x85f-76c9-qw3x CVE-2026-45338 - https://github.com/open-webui/open-webui/security/advisories/GHSA-24c9-2m8q-qhmh CVE-2026-45339 - https://github.com/open-webui/open-webui/security/advisories/GHSA-57q6-fvp4-pqmm @@ -155350,6 +156230,7 @@ CVE-2026-45357 - https://github.com/harttle/liquidjs/security/advisories/GHSA-hh CVE-2026-45365 - https://github.com/open-webui/open-webui/security/advisories/GHSA-v6qf-75pr-p96m CVE-2026-45369 - https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-33p6-5jxp-p3x4 CVE-2026-4537 - https://github.com/qazmn/my_cve/blob/main/cudy_cve/Cudy_TR1200_Command_Injection.md +CVE-2026-45370 - https://github.com/universal-tool-calling-protocol/python-utcp/security/advisories/GHSA-5v57-8rxj-3p2r CVE-2026-45371 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gmmv-4cc5-wr9r CVE-2026-45372 - https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m CVE-2026-45374 - https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-72w5-pf8h-xfp4 @@ -155391,6 +156272,7 @@ CVE-2026-4551 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_86/READ CVE-2026-4552 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_87/README.md CVE-2026-4553 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_88/README.md CVE-2026-45533 - https://github.com/dataease/dataease/security/advisories/GHSA-mwr5-hw6p-cqmg +CVE-2026-45537 - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v CVE-2026-45538 - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-37wc-5j8j-95x3 CVE-2026-45539 - https://github.com/microsoft/apm/security/advisories/GHSA-q5pp-gvjg-h7v4 CVE-2026-4554 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_95/README.md @@ -155445,6 +156327,7 @@ CVE-2026-45676 - https://github.com/open-telemetry/opentelemetry-ebpf-instrument CVE-2026-45678 - https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-pgvv-q3wf-mm9m CVE-2026-45679 - https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-8rrq-wcg8-cv5q CVE-2026-4568 - https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-UpdateSupplier-sid.md?plain=1 +CVE-2026-45680 - https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-89c6-vpcj-7vj4 CVE-2026-45681 - https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-r6c9-g6q5-qrf9 CVE-2026-45682 - https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-962q-hwm5-52x5 CVE-2026-45683 - https://github.com/open-telemetry/opentelemetry-ebpf-instrumentation/security/advisories/GHSA-fjq3-ffvr-vm46 @@ -155460,6 +156343,7 @@ CVE-2026-45705 - https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c CVE-2026-45708 - https://github.com/cubecart/v6/security/advisories/GHSA-747j-4mmc-cj63 CVE-2026-45709 - https://github.com/axllent/mailpit/security/advisories/GHSA-j3fj-qppj-fmmc CVE-2026-4571 - https://github.com/meifukun/Web-Security-PoCs/blob/main/Inventory-System/SQLi-ViewPayments-searchtxt.md +CVE-2026-45711 - https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j CVE-2026-45712 - https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722 CVE-2026-45713 - https://github.com/axllent/mailpit/security/advisories/GHSA-fpxj-m5q8-fphw CVE-2026-45714 - https://github.com/cubecart/v6/security/advisories/GHSA-pcfr-xgc9-xfv6 @@ -155474,6 +156358,7 @@ CVE-2026-45725 - https://github.com/oscal-compass/compliance-trestle/security/ad CVE-2026-45728 - https://github.com/xyproto/algernon/security/advisories/GHSA-fwqx-8365-9983 CVE-2026-45729 - https://github.com/thorvg/thorvg/security/advisories/GHSA-f863-8ghq-7h64 CVE-2026-4573 - https://github.com/meifukun/Web-Security-PoCs/blob/main/Simple-E-learning-System/SQLi-DeletePost-postId.md +CVE-2026-45730 - https://github.com/nuclio/nuclio/security/advisories/GHSA-m8xg-8xg9-mxhm CVE-2026-45731 - https://github.com/WWBN/AVideo/security/advisories/GHSA-3mjv-375j-6h92 CVE-2026-45733 - https://github.com/TriliumNext/Trilium/security/advisories/GHSA-h45q-4qc4-8hhg CVE-2026-45736 - https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx @@ -155508,12 +156393,25 @@ CVE-2026-45803 - https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-q CVE-2026-45804 - https://github.com/huggingface/diffusers/issues/13446 CVE-2026-45804 - https://github.com/huggingface/diffusers/security/advisories/GHSA-7wx4-6vff-v64p CVE-2026-45805 - https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm +CVE-2026-45806 - https://github.com/penpot/penpot/security/advisories/GHSA-35g2-w7f6-8v9h CVE-2026-45807 - https://github.com/kestra-io/kestra/security/advisories/GHSA-3529-p4wf-xp79 CVE-2026-4581 - https://github.com/anon387tdug/anon388/issues/1 CVE-2026-4582 - https://github.com/Davim09/m6plusexploit/blob/main/docs/CVE-1-Authentication.md CVE-2026-4583 - https://github.com/Davim09/m6plusexploit/blob/main/docs/CVE-2-Replay.md +CVE-2026-45834 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-45835 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-45836 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-45838 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-45839 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4584 - https://github.com/Davim09/m6plusexploit/blob/main/docs/CVE-3-DataExposure.md +CVE-2026-45840 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-45841 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-45841 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-45841 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-45842 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-45843 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-45844 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-45850 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4588 - https://vulnplus-note.wetolink.com/share/rM8GdIOvQZrw CVE-2026-4589 - https://vulnplus-note.wetolink.com/share/UTZQq38f9VyI CVE-2026-4590 - https://vulnplus-note.wetolink.com/share/IJW1LjsyomCQ @@ -155525,47 +156423,130 @@ CVE-2026-4598 - https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264 CVE-2026-4598 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812263 CVE-2026-4598 - https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938 CVE-2026-4599 - https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20 +CVE-2026-45991 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-45997 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4600 - https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7 CVE-2026-4600 - https://github.com/kjur/jsrsasign/pull/646 CVE-2026-4600 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812268 CVE-2026-4600 - https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940 +CVE-2026-46003 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4601 - https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586 CVE-2026-4601 - https://github.com/kjur/jsrsasign/pull/645 CVE-2026-4601 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812269 CVE-2026-4601 - https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941 CVE-2026-46015 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46015 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46015 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46018 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4602 - https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5 CVE-2026-4602 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812274 CVE-2026-4602 - https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175 CVE-2026-46021 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46021 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46021 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46022 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46023 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46026 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4603 - https://gist.github.com/Kr0emer/5366b7364c4fbf7e754bc377f321e9f3 CVE-2026-4603 - https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371176 CVE-2026-46033 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46033 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46033 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46037 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46037 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46037 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46038 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46040 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46040 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46040 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46044 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46046 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46046 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46046 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46047 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46050 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46051 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46056 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46064 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46065 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46069 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46070 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46083 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46086 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46086 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46086 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46088 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46092 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46099 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46101 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46101 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46101 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46102 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46107 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46110 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46113 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46116 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46116 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46116 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4612 - https://github.com/bybinyu/Vulnerability-Practice/issues/2 +CVE-2026-46120 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46122 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46124 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46125 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46128 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46132 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46132 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46136 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46137 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4614 - https://github.com/ltranquility/submit/issues/2 +CVE-2026-46146 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46149 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46150 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46151 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46159 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4616 - https://github.com/bolo-blog/bolo-solo/issues/330 CVE-2026-4616 - https://github.com/bolo-blog/bolo-solo/issues/330#issue-4045018183 +CVE-2026-46161 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46163 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46165 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46167 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46168 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4617 - https://gist.github.com/HxH404/0ab53ccba44456b5400a5908414f5ab1 CVE-2026-46172 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46172 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46172 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46173 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46173 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46173 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46174 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-46174 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-46174 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46177 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46180 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46185 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46187 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46190 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46191 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46193 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46193 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46193 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46195 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46196 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46209 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46214 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46215 - https://github.com/0xCyberstan/CVE-2026-46215-POC +CVE-2026-46227 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4623 - https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2 CVE-2026-4623 - https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2#issue-4045330588 CVE-2026-4623 - https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2#issuecomment-4023480586 +CVE-2026-46234 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46243 - http://www.openwall.com/lists/oss-security/2026/06/01/6 +CVE-2026-46243 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46243 - https://github.com/manizada/CIFSwitch CVE-2026-4625 - https://vuldb.com/?ctiid.352493 CVE-2026-4626 - https://github.com/eqiya17/collection-of-vulnerability/issues/2 +CVE-2026-46275 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46294 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46300 - http://www.openwall.com/lists/oss-security/2026/05/13/5 CVE-2026-46300 - http://www.openwall.com/lists/oss-security/2026/05/21/11 CVE-2026-46300 - http://www.openwall.com/lists/oss-security/2026/05/21/12 @@ -155573,12 +156554,25 @@ CVE-2026-46300 - http://www.openwall.com/lists/oss-security/2026/05/21/13 CVE-2026-46300 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html CVE-2026-46300 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2026-46303 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46303 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46303 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46304 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46306 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46306 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46306 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46307 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-4632 - https://github.com/chuxina7-aiguo/CVE1/issues/1 +CVE-2026-46320 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46321 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46322 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46323 - https://bugzilla.redhat.com/show_bug.cgi?id=2479832 CVE-2026-46323 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46323 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-46323 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-46331 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-46333 - http://www.openwall.com/lists/oss-security/2026/05/20/16 CVE-2026-46333 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-46333 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-46333 - https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/ CVE-2026-46336 - https://github.com/manyfold3d/manyfold/security/advisories/GHSA-j5f9-r7wf-hv37 CVE-2026-46337 - https://github.com/WWBN/AVideo/security/advisories/GHSA-w4qq-74h6-58wq @@ -156680,6 +157674,7 @@ CVE-2026-51843 - https://www.kdev.site/cve-request_008/ CVE-2026-51844 - https://www.kdev.site/cve-request_006/ CVE-2026-51845 - https://www.kdev.site/cve-request_007/ CVE-2026-51846 - https://www.kdev.site/cve-request_005/ +CVE-2026-51861 - https://github.com/dataelement/bisheng/issues/1995 CVE-2026-51866 - https://gist.github.com/Ro1ME/f8f5b730a4000684d3a92a67f82ee03c CVE-2026-5187 - https://github.com/wolfSSL/wolfssl CVE-2026-51870 - https://gist.github.com/Ro1ME/58b7e7523f517bc1241183ff988b6707 @@ -156835,71 +157830,159 @@ CVE-2026-52888 - https://github.com/nocobase/nocobase/security/advisories/GHSA-v CVE-2026-5289 - https://issues.chromium.org/issues/495931147 CVE-2026-52892 - https://github.com/wekan/wekan/security/advisories/GHSA-6733-4wgq-8xvr CVE-2026-52893 - https://github.com/wekan/wekan/security/advisories/GHSA-mp7g-hj5q-gxhq +CVE-2026-52909 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5291 - https://issues.chromium.org/issues/490118036 CVE-2026-52910 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-52910 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-52910 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-52912 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-52912 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-52917 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-52918 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5292 - https://issues.chromium.org/issues/492213293 +CVE-2026-52923 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-52924 - https://bugzilla.redhat.com/show_bug.cgi?id=2492095 +CVE-2026-52928 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-52929 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-52930 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-52930 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-52930 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-52933 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-52933 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-52942 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-52942 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-52942 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-52943 - https://bugzilla.redhat.com/show_bug.cgi?id=2492137 CVE-2026-52943 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-52943 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-52943 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-52946 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-52946 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-52946 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-52947 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-52948 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5295 - https://github.com/wolfSSL/wolfssl/pull/10116 CVE-2026-52970 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-52970 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-52986 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-52986 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-52993 - https://bugzilla.redhat.com/show_bug.cgi?id=2492437 CVE-2026-52998 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-52998 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-52999 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-52999 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-53001 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53001 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-53002 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53002 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-53006 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53006 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-53012 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53012 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-5305 - https://wpscan.com/vulnerability/bf59610b-98ba-4c05-b2fc-85c163e9a389/ CVE-2026-53050 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53050 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-5306 - https://wpscan.com/vulnerability/97908c15-6e7a-4242-8c6f-66c8b804364c/ CVE-2026-5308 - https://mattermost.com/security-updates +CVE-2026-53080 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5310 - https://github.com/VulnaraByte/iperius-backup-security-advisories CVE-2026-5310 - https://github.com/VulnaraByte/iperius-backup-security-advisories/blob/main/poc/decrypt_iperius.py CVE-2026-5311 - https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_171/171.md CVE-2026-5312 - https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_172/172.md CVE-2026-5312 - https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_173/173.md +CVE-2026-53131 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53134 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53134 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-5314 - https://gist.github.com/d0razi/cb31a92f3205a4373f19b7da25946848 +CVE-2026-53146 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53147 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53148 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53149 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5315 - https://gist.github.com/d0razi/c11dd07c75f3b795e4f8bbfd6e2f0d29 +CVE-2026-53150 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5316 - https://gist.github.com/d0razi/cc7f70bba08c1a455d9933e97b8b57c1 +CVE-2026-53167 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53168 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5317 - https://gist.github.com/d0razi/2ff8a0e812f74dd6fe7f2843931bb90c +CVE-2026-53177 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5318 - https://github.com/LibRaw/LibRaw/issues/794 CVE-2026-5318 - https://github.com/LibRaw/LibRaw/issues/794#issuecomment-4065342499 CVE-2026-5318 - https://github.com/biniamf/pocs/tree/main/libraw_lljpeg +CVE-2026-53181 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53183 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53184 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53192 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53198 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53208 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53212 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53218 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53218 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-53218 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53219 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53219 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-53219 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5322 - https://github.com/wing3e/public_exp/issues/19 +CVE-2026-53221 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53223 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53223 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-53225 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53227 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53228 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5323 - https://github.com/wing3e/public_exp/issues/17 CVE-2026-53236 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53236 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-53236 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53239 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53239 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-53239 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53242 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53245 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53249 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53249 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-53249 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53253 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53254 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53255 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53256 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53263 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53264 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53264 - https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/ +CVE-2026-53265 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53268 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53268 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-53268 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53269 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53269 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-53269 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5327 - https://github.com/efforthye/fast-filesystem-mcp/issues/15 CVE-2026-53275 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53275 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-53275 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53295 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53295 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-5330 - https://github.com/zy606/Vulnerability-Report/tree/main/Gaatitrack-Unauth-Delete +CVE-2026-53325 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5333 - https://github.com/DefaultFuction/Content-Management-System/issues/1 CVE-2026-5333 - https://github.com/DefaultFuction/Content-Management-System/issues/1#issue-4082558620 +CVE-2026-53337 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5334 - https://github.com/yuji0903/silver-guide/issues/15 +CVE-2026-53349 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5335 - https://wpscan.com/vulnerability/ed6f00de-bbae-4e89-9d0e-ded0d70e781c/ +CVE-2026-53350 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53352 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53352 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-53352 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53356 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html +CVE-2026-53358 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-53359 - http://www.openwall.com/lists/oss-security/2026/07/06/7 CVE-2026-53359 - https://github.com/V4bel/Januscape/blob/main/assets/write-up.md CVE-2026-5336 - https://wpscan.com/vulnerability/3b3ab347-a8bd-4baa-8eba-c45a8a79e33f/ +CVE-2026-53362 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-5337 - https://wpscan.com/vulnerability/3e28aa78-3227-474a-b1db-1f5ea2c42d14/ CVE-2026-5338 - https://github.com/ZZ2266/.github.io/tree/main/Tenda%20G103/action_set_system_settings CVE-2026-5339 - https://github.com/ZZ2266/.github.io/tree/main/Tenda%20G103/authLoid CVE-2026-53400 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-53400 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-5342 - https://github.com/LibRaw/LibRaw/issues/795 CVE-2026-5342 - https://github.com/LibRaw/LibRaw/issues/795#issuecomment-4073769886 CVE-2026-5342 - https://github.com/biniamf/pocs/tree/main/libraw_nikonpadded @@ -157184,6 +158267,8 @@ CVE-2026-55162 - https://github.com/Netflix/lemur/security/advisories/GHSA-54vg- CVE-2026-55165 - https://github.com/Netflix/lemur/security/advisories/GHSA-r9gp-7f88-9r54 CVE-2026-55166 - https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v CVE-2026-55168 - https://github.com/runtipi/runtipi/security/advisories/GHSA-wcrf-g9p9-2wg7 +CVE-2026-55174 - https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.0 +CVE-2026-55174 - https://github.com/shrec/UltrafastSecp256k1/releases/tag/v4.2.1 CVE-2026-55179 - https://github.com/laurent22/joplin/security/advisories/GHSA-r865-g55x-3mfc CVE-2026-55180 - https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r CVE-2026-55185 - https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r @@ -159259,6 +160344,7 @@ CVE-2026-61555 - https://github.com/AcademySoftwareFoundation/openexr/security/a CVE-2026-61556 - https://github.com/harttle/liquidjs/security/advisories/GHSA-m7fp-h3p4-hr49 CVE-2026-61559 - https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj CVE-2026-61560 - https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-cv3r-c5h8-f4g5 +CVE-2026-61568 - https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-vmp7-252j-cwp7 CVE-2026-6157 - https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A800R/01_Buffer_Overflow_setAppEasyWizardConfig.md CVE-2026-6157 - https://vuldb.com/submit/793114 CVE-2026-6158 - https://github.com/xyh4ck/iot_poc/tree/main/TOTOLINK/N300RHv4/02_setUpgradeUboot_RCE @@ -159268,8 +160354,11 @@ CVE-2026-61607 - https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8 CVE-2026-61609 - https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47 CVE-2026-6161 - https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20in%20Simple%20Chatbox%20PHP%20msg%20Parameter.md CVE-2026-61612 - https://github.com/advisories/GHSA-3xm7-qw7j-qc8v +CVE-2026-61612 - https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-798p-78g2-v556 CVE-2026-61617 - https://github.com/pterodactyl/wings/security/advisories/GHSA-8j54-xcwx-597p CVE-2026-6162 - https://github.com/f1rstb100d/CVE/issues/44 +CVE-2026-61628 - https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5 +CVE-2026-61629 - https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx CVE-2026-61630 - https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-hf33-q6cf-c66f CVE-2026-61632 - https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-9xwg-3r6f-jcx2 CVE-2026-61633 - https://github.com/nanomq/nanomq/security/advisories/GHSA-m7mp-rr3v-hmhr @@ -159281,10 +160370,12 @@ CVE-2026-6165 - https://github.com/realnotjoking/cve/issues/2 CVE-2026-6166 - https://github.com/wfcht-sy/src/issues/2 CVE-2026-61663 - https://github.com/django-cms/django-cms/security/advisories/GHSA-8qj2-c6q4-f399 CVE-2026-6167 - https://github.com/wfcht-sy/src/issues/1 +CVE-2026-61672 - https://github.com/projectcapsule/capsule/security/advisories/GHSA-gjw4-3v3v-rqxg CVE-2026-61674 - https://github.com/fluent/fluent-bit/security/advisories/GHSA-jrp8-r9hx-gf73 CVE-2026-6168 - https://github.com/zhuchan770/vulnerability/blob/main/A7000R/setWiFiEasyGuestCfg/ToToLink%20A7000R%20setWiFiEasyGuestCfg%20338996b67c9780b89829d0ea70058788.md CVE-2026-61684 - https://github.com/labring/FastGPT/security/advisories/GHSA-w732-rq8c-chc8 CVE-2026-61690 - https://github.com/getgrav/grav/security/advisories/GHSA-928x-9mpw-8h56 +CVE-2026-61699 - https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-cm26-5974-52h8 CVE-2026-61704 - https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-cpjf-6666-r8fx CVE-2026-61736 - https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w CVE-2026-61740 - https://github.com/HKUDS/LightRAG/security/advisories/GHSA-f4vv-55c2-5789 @@ -159293,16 +160384,21 @@ CVE-2026-61743 - https://github.com/chartbrew/chartbrew/security/advisories/GHSA CVE-2026-61745 - https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj CVE-2026-61746 - https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7 CVE-2026-61782 - https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3 +CVE-2026-61788 - https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf CVE-2026-61793 - https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv CVE-2026-61794 - https://github.com/projectcapsule/capsule/security/advisories/GHSA-gxjc-74v5-3vx3 +CVE-2026-61795 - https://github.com/projectcapsule/capsule/security/advisories/GHSA-f94q-w3w8-cj67 CVE-2026-61800 - https://github.com/wazuh/wazuh/security/advisories/GHSA-3jff-488g-335f CVE-2026-61808 - https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mmg5-8x8q-v934 CVE-2026-61816 - https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx CVE-2026-6182 - https://github.com/Xmyronn/simple-cms-sqli-login-bypass-CVE-HUNT- CVE-2026-6183 - https://github.com/Xmyronn/simple-cms-sqli-id-parameter +CVE-2026-61833 - https://github.com/project-zot/zot/security/advisories/GHSA-qg67-7m6v-qg25 CVE-2026-61834 - https://github.com/thomaspoignant/scim-patch/pull/1127 CVE-2026-61834 - https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-2mhw-wcx5-v3xj +CVE-2026-61837 - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w9hf-476r-443x CVE-2026-61842 - https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j +CVE-2026-61843 - https://github.com/error311/FileRise/security/advisories/GHSA-r787-5hp3-4874 CVE-2026-61852 - https://github.com/chartbrew/chartbrew/security/advisories/GHSA-4923-m569-jc42 CVE-2026-6187 - https://github.com/lingzezzz/lingze/issues/3 CVE-2026-61873 - https://github.com/getgrav/grav/security/advisories/GHSA-q532-mvx7-42qg @@ -159476,6 +160572,7 @@ CVE-2026-6277 - https://gitlab.com/gitlab-org/gitlab/-/work_items/596656 CVE-2026-62843 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww CVE-2026-62845 - https://github.com/clastix/kamaji/security/advisories/GHSA-r47v-ppwp-fh4r CVE-2026-62857 - https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5 +CVE-2026-62858 - https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx CVE-2026-62867 - https://github.com/lxc/incus/security/advisories/GHSA-q7xw-r4w2-2wcm CVE-2026-6291 - https://github.com/wolfSSL/wolfssl/pull/10203 CVE-2026-6291 - https://www.wolfssl.com/docs/security-vulnerabilities/ @@ -159500,6 +160597,7 @@ CVE-2026-63000 - https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22 CVE-2026-63001 - https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq CVE-2026-63002 - https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m CVE-2026-63003 - https://github.com/django-cms/django-cms/security/advisories/GHSA-6x92-6vx4-5fwr +CVE-2026-63004 - https://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fj CVE-2026-6301 - https://issues.chromium.org/issues/495273999 CVE-2026-6302 - https://issues.chromium.org/issues/495477995 CVE-2026-63033 - https://github.com/mz-automation/lib60870/security/advisories/GHSA-7v97-jmwv-w5j7 @@ -159522,12 +160620,14 @@ CVE-2026-63097 - https://github.com/geo-chen/oss/blob/main/dendrite.md#finding-3 CVE-2026-63098 - https://github.com/geo-chen/oss/blob/main/TheHive.md#finding-1-get-apistatus-exposes-attachment-protection-password-without-authentication CVE-2026-63099 - https://github.com/geo-chen/oss/blob/main/TheHive.md#finding-2-cross-organisation-attachment-disclosure-via-unauthorized-datastore-endpoint-missing-object-level-authorization CVE-2026-63101 - https://github.com/geo-chen/oss/blob/main/open-event-server.md +CVE-2026-63104 - https://github.com/usekaneo/kaneo/security/advisories/GHSA-gx46-mfgj-vm86 CVE-2026-63107 - https://github.com/geo-chen/oss/blob/main/limesurvey.md CVE-2026-63108 - https://github.com/geo-chen/oss/blob/main/Roo-Code.md CVE-2026-6311 - https://issues.chromium.org/issues/498201025 CVE-2026-63116 - https://github.com/deepstreamIO/deepstream.io/security/advisories/GHSA-89vx-jh4q-vg3w CVE-2026-63119 - https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42 CVE-2026-6312 - https://issues.chromium.org/issues/498269651 +CVE-2026-63123 - https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x CVE-2026-63125 - https://github.com/lxc/incus/security/advisories/GHSA-6rqx-22hc-qm36 CVE-2026-63126 - https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc CVE-2026-63127 - https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-33f5-2c5q-wgwj @@ -159557,6 +160657,7 @@ CVE-2026-6329 - https://github.com/wolfSSL/wolfssl/pull/10192 CVE-2026-6329 - https://www.wolfssl.com/docs/security-vulnerabilities/ CVE-2026-63293 - https://github.com/canonical/lxd/security/advisories/GHSA-j825-cg34-5fr5 CVE-2026-63294 - https://github.com/canonical/lxd/security/advisories/GHSA-fv82-v4fj-mm4m +CVE-2026-63295 - https://github.com/canonical/lxd/security/advisories/GHSA-7vp9-3vmp-c5jm CVE-2026-63298 - https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2 CVE-2026-63299 - https://github.com/canonical/lxd/security/advisories/GHSA-5h78-p252-989h CVE-2026-6330 - https://github.com/wolfSSL/wolfssl/pull/10192 @@ -159571,6 +160672,7 @@ CVE-2026-63312 - https://github.com/nltk/nltk/security/advisories/GHSA-x5ph-mj9p CVE-2026-63325 - https://github.com/Redocly/redocly-cli/pull/2881 CVE-2026-63329 - https://github.com/warp-tech/warpgate/security/advisories/GHSA-862h-v6cc-9757 CVE-2026-6333 - https://mattermost.com/security-updates +CVE-2026-63330 - https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr CVE-2026-63334 - https://github.com/jgraph/drawio/security/advisories/GHSA-3v4h-8r2c-m8c5 CVE-2026-63335 - https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-qx7j-jv8m-fppr CVE-2026-63336 - https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435 @@ -159591,6 +160693,7 @@ CVE-2026-63387 - https://github.com/libevent/libevent/security/advisories/GHSA-5 CVE-2026-63388 - https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338 CVE-2026-6339 - https://mattermost.com/security-updates CVE-2026-6340 - https://mattermost.com/security-updates +CVE-2026-63404 - https://github.com/contribsys/faktory/security/advisories/GHSA-j2vx-rpwf-w77v CVE-2026-63405 - https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327 CVE-2026-63406 - https://github.com/anycable/anycable/security/advisories/GHSA-w72w-9qmj-c9qm CVE-2026-63407 - https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2 @@ -159600,10 +160703,12 @@ CVE-2026-6341 - https://mattermost.com/security-updates CVE-2026-63416 - https://github.com/jgraph/drawio/security/advisories/GHSA-3pq9-9hg4-ggfw CVE-2026-63419 - https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-w6wc-gcf4-5pj2 CVE-2026-6342 - https://mattermost.com/security-updates +CVE-2026-63420 - https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-x877-h4xx-5m5j CVE-2026-63422 - https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh5r-whph-qmc5 CVE-2026-63428 - https://github.com/heyform/heyform/security/advisories/GHSA-r7vg-xh87-v4w3 CVE-2026-63429 - https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7 CVE-2026-6343 - https://mattermost.com/security-updates +CVE-2026-63431 - https://github.com/horilla/horilla-hr/security/advisories/GHSA-c38j-fg3w-7rph CVE-2026-63432 - https://github.com/horilla/horilla-hr/security/advisories/GHSA-9p83-4w63-7c24 CVE-2026-6345 - https://mattermost.com/security-updates CVE-2026-63459 - https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5 @@ -159611,6 +160716,7 @@ CVE-2026-6346 - https://mattermost.com/security-updates CVE-2026-63460 - https://github.com/vendurehq/vendure/security/advisories/GHSA-jgm3-qmp2-c4p7 CVE-2026-63464 - https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-7rx3-5wx3-5v76 CVE-2026-6347 - https://mattermost.com/security-updates +CVE-2026-63493 - https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx CVE-2026-63495 - https://github.com/libevent/libevent/security/advisories/GHSA-qx89-wf2v-vgmx CVE-2026-63498 - https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563 CVE-2026-63506 - https://github.com/tinacms/tinacms/security/advisories/GHSA-g74q-6g2f-874x @@ -159620,6 +160726,7 @@ CVE-2026-6359 - https://issues.chromium.org/issues/490251701 CVE-2026-6360 - https://issues.chromium.org/issues/497880137 CVE-2026-6361 - https://issues.chromium.org/issues/500036290 CVE-2026-6362 - https://issues.chromium.org/issues/500066234 +CVE-2026-63626 - https://github.com/cesanta/mongoose/security/advisories/GHSA-pc66-j6r6-49x9 CVE-2026-63628 - https://github.com/wevm/mppx/security/advisories/GHSA-vc9j-9wph-qghj CVE-2026-6363 - https://issues.chromium.org/issues/495751197 CVE-2026-63630 - https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8 @@ -159637,8 +160744,10 @@ CVE-2026-63645 - https://github.com/openobserve/openobserve/security/advisories/ CVE-2026-63646 - https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-46p5-m7pq-82hm CVE-2026-63647 - https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-9qg8-cm35-xqp4 CVE-2026-63652 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9g22-w2gr-vcmp +CVE-2026-63669 - https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-wr5r-wqp2-x4fh CVE-2026-63670 - https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw CVE-2026-63671 - https://github.com/nuxt-content/mdc/security/advisories/GHSA-mxm6-v9r6-r94c +CVE-2026-63720 - https://github.com/rahulreddykarne/CVE-2026-63720-datamodel-code-generator CVE-2026-63720 - https://rahulkarne.com/#/cve/CVE-2026-63720 CVE-2026-63722 - https://gist.github.com/axg11/fc2b86648d8f385b51f4576ff0f392d8 CVE-2026-63725 - https://gist.github.com/W40X/6747ba1b7da7bb69b0c0e162628df279 @@ -159649,6 +160758,7 @@ CVE-2026-63731 - https://github.com/hyperdxio/hyperdx/issues/2588 CVE-2026-63764 - https://github.com/InternLM/lmdeploy/issues/4761 CVE-2026-63765 - https://github.com/chatwoot/chatwoot/issues/15072 CVE-2026-63766 - https://github.com/RVC-Boss/GPT-SoVITS/issues/2793 +CVE-2026-63767 - https://github.com/kvcache-ai/ktransformers/issues/2087 CVE-2026-63768 - https://github.com/calcom/cal.diy/issues/29679 CVE-2026-63769 - https://github.com/huginn/huginn/issues/3679 CVE-2026-63770 - https://github.com/glanceapp/glance/issues/1031 @@ -159657,6 +160767,7 @@ CVE-2026-63771 - https://github.com/vrana/adminer/security/advisories/GHSA-c533- CVE-2026-6379 - https://wpscan.com/vulnerability/60b88fd2-4048-4773-b319-63caaf5bd8eb/ CVE-2026-6381 - https://wpscan.com/vulnerability/18b36672-58d7-44fa-b653-b728e9ef257a/ CVE-2026-63810 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-63810 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-6382 - https://wpscan.com/vulnerability/a27f70b7-a4cc-42fa-88c1-19adfe1593a8/ CVE-2026-6412 - https://github.com/wolfSSL/wolfssl/pull/10222 CVE-2026-6412 - https://www.wolfssl.com/docs/security-vulnerabilities/ @@ -159664,17 +160775,28 @@ CVE-2026-6414 - https://github.com/fastify/middie/security/advisories/GHSA-cxrg- CVE-2026-64193 - http://www.openwall.com/lists/oss-security/2026/07/20/12 CVE-2026-64194 - http://www.openwall.com/lists/oss-security/2026/07/20/13 CVE-2026-64279 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64279 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64317 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64317 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-6433 - https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/ CVE-2026-64370 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64370 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64371 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64371 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64375 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64375 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64411 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64411 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64412 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64412 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64413 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64413 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64422 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64422 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64423 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64423 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64425 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64425 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-6450 - https://github.com/wolfSSL/wolfssl/pull/10239 CVE-2026-6450 - https://www.wolfssl.com/docs/security-vulnerabilities/ CVE-2026-64531 - http://www.openwall.com/lists/oss-security/2026/07/28/8 @@ -159683,9 +160805,14 @@ CVE-2026-64531 - http://www.openwall.com/lists/oss-security/2026/08/01/1 CVE-2026-64531 - http://www.openwall.com/lists/oss-security/2026/08/01/3 CVE-2026-64531 - http://www.openwall.com/lists/oss-security/2026/08/22/1 CVE-2026-64538 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64538 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64545 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64545 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64552 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64552 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html CVE-2026-64560 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html +CVE-2026-64560 - https://cert-portal.siemens.com/productcert/html/ssa-457936.html +CVE-2026-64560 - https://cert-portal.siemens.com/productcert/html/ssa-784472.html CVE-2026-64561 - https://github.com/V4bel/Zapscape CVE-2026-6459 - https://research.cleantalk.org/cve-2026-6459 CVE-2026-64600 - http://www.openwall.com/lists/oss-security/2026/07/22/14 @@ -160189,9 +161316,11 @@ CVE-2026-6902 - https://portal.perforce.com/s/cve/a91Qi000002zJB3IAM/code-inject CVE-2026-69087 - https://github.com/getgrav/grav/security/advisories/GHSA-j2j9-gp72-wqvm CVE-2026-69088 - https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8 CVE-2026-69089 - https://github.com/getgrav/grav/security/advisories/GHSA-w3f4-8pj2-599w +CVE-2026-69090 - https://github.com/Admidio/admidio/security/advisories/GHSA-fcq9-w4hp-xchg CVE-2026-69093 - https://github.com/Admidio/admidio/security/advisories/GHSA-mvx3-m6p6-7r9w CVE-2026-69094 - https://github.com/Admidio/admidio/security/advisories/GHSA-rw2j-8c57-x6h2 CVE-2026-69098 - https://github.com/Cinnamon/kotaemon/issues/844 +CVE-2026-69110 - https://github.com/Microck/opencode-studio/issues/54 CVE-2026-69113 - https://github.com/CapSoftware/Cap/issues/1982 CVE-2026-69147 - https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j CVE-2026-69160 - https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4 @@ -160204,6 +161333,7 @@ CVE-2026-6921 - https://issues.chromium.org/issues/493315759 CVE-2026-69222 - https://github.com/harttle/liquidjs/pull/925 CVE-2026-69222 - https://github.com/harttle/liquidjs/security/advisories/GHSA-4r6h-5v86-94p3 CVE-2026-6925 - https://www.ibm.com/support/pages/node/7288830 +CVE-2026-69259 - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x3hf-7cj6-3r4m CVE-2026-6928 - https://www.ibm.com/support/pages/node/7288830 CVE-2026-6935 - https://www.ibm.com/support/pages/node/7288830 CVE-2026-69414 - https://github.com/MSNightmare/ShieldBreak @@ -160368,8 +161498,15 @@ CVE-2026-7127 - https://github.com/y1shiny1shin/vuldb-project/issues/1 CVE-2026-7128 - https://github.com/lonelyuan/vunls/issues/13 CVE-2026-7129 - https://github.com/lonelyuan/vunls/issues/12 CVE-2026-7130 - https://github.com/lonelyuan/vunls/issues/11 +CVE-2026-71303 - https://github.com/Netflix/lemur/security/advisories/GHSA-v5rc-cpwc-cfpr +CVE-2026-71307 - https://github.com/Netflix/lemur/security/advisories/GHSA-6c8m-q6g9-vrw3 +CVE-2026-71309 - https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh +CVE-2026-71310 - https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr CVE-2026-71313 - https://github.com/rclone/rclone/security/advisories/GHSA-7p4m-qxvv-g567 +CVE-2026-71317 - https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h CVE-2026-7132 - https://github.com/zzk6th/cve/issues/2 +CVE-2026-71325 - https://github.com/traefik/traefik/security/advisories/GHSA-62fc-8686-hfmq +CVE-2026-71326 - https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf CVE-2026-7133 - https://github.com/zzk6th/cve/issues/3 CVE-2026-7133 - https://vuldb.com/submit/800982 CVE-2026-7134 - https://github.com/zzk6th/cve/issues/4 @@ -160379,15 +161516,23 @@ CVE-2026-7137 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_ CVE-2026-7138 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_313/README.md CVE-2026-7139 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_314/README.md CVE-2026-7140 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_315/README.md +CVE-2026-71416 - https://github.com/headroomlabs-ai/headroom/security/advisories/GHSA-h46j-26q3-rggf +CVE-2026-71417 - https://github.com/Netflix/lemur/security/advisories/GHSA-pxmc-2ffp-8j67 CVE-2026-7142 - https://github.com/wooey/Wooey/issues/408 CVE-2026-71424 - https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-q62f-rv3h-f822 +CVE-2026-71426 - https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-559q-hqrv-m84x CVE-2026-7143 - https://github.com/9str0IL/CVE/issues/3 +CVE-2026-71430 - https://github.com/uhop/node-re2/security/advisories/GHSA-8hcv-x26h-mcgp CVE-2026-7144 - https://github.com/9str0IL/CVE/issues/4 CVE-2026-7146 - https://github.com/AlejandroArciniegas/mcp-data-vis/issues/1 CVE-2026-7147 - https://github.com/JoeCastrom/mcp-chat-studio/issues/4 CVE-2026-7147 - https://vuldb.com/vuln/359746/cti +CVE-2026-71477 - https://github.com/jdx/mise/security/advisories/GHSA-9mm4-fgvc-x7rp CVE-2026-7148 - https://github.com/wangchaoxing/CVE/issues/7 +CVE-2026-71483 - https://github.com/horilla/horilla-hr/security/advisories/GHSA-rw86-x8hq-xgwh CVE-2026-7149 - https://github.com/dexhunter/kaggle-mcp/issues/1 +CVE-2026-71493 - https://github.com/infracost/infracost/commit/4d39331afc0e27752d16d9d91c34583e5e8487fb +CVE-2026-71498 - https://github.com/uhop/node-re2/issues/272 CVE-2026-7150 - https://github.com/dh1011/auto-favicon-mcp/issues/2 CVE-2026-71503 - https://codeant.ai/security-research/cve-2026-71503-reflected-xss-via-the-type-parameter CVE-2026-71504 - https://codeant.ai/security-research/cve-2026-71504-mass-assignment-in-members-api-via-pass @@ -160401,12 +161546,17 @@ CVE-2026-71511 - https://codeant.ai/security-research/cve-2026-71511-dolibarr-me CVE-2026-7152 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_316/README.md CVE-2026-7153 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_317/README.md CVE-2026-7154 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_318/README.md +CVE-2026-71542 - https://github.com/GetSimpleCMS-CE/GetSimpleCMS-CE/security/advisories/GHSA-vqfh-838q-xfqh CVE-2026-7155 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_319/README.md +CVE-2026-71551 - https://github.com/super-productivity/super-productivity/security/advisories/GHSA-256q-p9ff-jv8q CVE-2026-7156 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_320/README.md CVE-2026-7156 - https://vuldb.com/vuln/359755 CVE-2026-7156 - https://vuldb.com/vuln/359755/cti CVE-2026-7157 - https://github.com/disler/aider-mcp-server/issues/16 CVE-2026-7158 - https://github.com/dmitryglhf/url-download-mcp/issues/2 +CVE-2026-71613 - https://github.com/gpac/gpac/issues/3613 +CVE-2026-71614 - https://github.com/gpac/gpac/issues/3614 +CVE-2026-71616 - https://github.com/gpac/gpac/issues/3621 CVE-2026-71675 - https://gist.github.com/centauruszzz/fa7e78c6657132dae95318bc4600194b CVE-2026-71676 - https://gist.github.com/centauruszzz/0d267967fc5d072f31c866603f7aaf7c CVE-2026-7177 - https://gist.github.com/YLChen-007/da6b00024f5b7e1d4fa0658c19b77fbf @@ -160414,7 +161564,15 @@ CVE-2026-7177 - https://github.com/ChatGPTNextWeb/NextChat/issues/6742 CVE-2026-7178 - https://gist.github.com/YLChen-007/43252d45d75e8bdd2d45136fd6ffe8a5 CVE-2026-7178 - https://github.com/ChatGPTNextWeb/NextChat/issues/6741 CVE-2026-7179 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/binwalk_path_traversal.md +CVE-2026-71802 - https://github.com/W000i/vuln/issues/6 +CVE-2026-71832 - https://github.com/aria2/aria2/issues/2371 CVE-2026-7184 - https://mattermost.com/security-updates +CVE-2026-71851 - https://github.com/brix/crypto-js/security/advisories/GHSA-rg76-677x-56q9 +CVE-2026-71858 - https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-f4rj-vqq4-wvg4 +CVE-2026-71865 - https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g +CVE-2026-71867 - https://github.com/orval-labs/orval/security/advisories/GHSA-2w86-xfrc-g85r +CVE-2026-71869 - https://github.com/orval-labs/orval/security/advisories/GHSA-2h9g-j24r-h63g +CVE-2026-71871 - https://github.com/orval-labs/orval/security/advisories/GHSA-8j6p-r8jg-mxqh CVE-2026-7194 - https://github.com/bfs045313-wq/cv3-protect/issues/2 CVE-2026-7196 - https://github.com/xue-p123/vuldb-research/issues/3 CVE-2026-71962 - https://gist.github.com/haidang-infosec/402db84bee7aca2f57bb109b31574649?utm_source=chatgpt.com @@ -160850,6 +162008,7 @@ CVE-2026-74903 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA- CVE-2026-74905 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qq8m-8p8v-x4xg CVE-2026-74907 - https://github.com/getgrav/grav/security/advisories/GHSA-4v9q-p283-qc2m CVE-2026-74916 - https://wpscan.com/vulnerability/b6f8be96-13d9-497a-8e57-5a65b519958b/ +CVE-2026-74920 - https://wpscan.com/vulnerability/aa80cef6-b2fd-47ef-bac9-53438aa27573/ CVE-2026-74925 - https://wpscan.com/vulnerability/04d64797-751a-4cdd-a37d-70afbad5d784/ CVE-2026-74926 - https://wpscan.com/vulnerability/35ff7d7e-b3fe-4ae2-92cd-a122b8cdd97c/ CVE-2026-74927 - https://wpscan.com/vulnerability/c81aa489-0663-40b7-b2ce-f4c8f2edd4b6/ @@ -160860,6 +162019,7 @@ CVE-2026-74932 - https://wpscan.com/vulnerability/f1eebb4a-cfd1-419e-852d-e5a949 CVE-2026-74933 - https://wpscan.com/vulnerability/23dc45bb-e7b6-4cae-81ce-2c6394afb454/ CVE-2026-74991 - https://wpscan.com/vulnerability/e539d37e-91bb-4d79-b812-ac3c6c1a0f70/ CVE-2026-74992 - https://wpscan.com/vulnerability/ba981818-f4a0-444a-bf6a-e4caacc9d1aa/ +CVE-2026-75011 - https://github.com/kylecui/NetForensicMCP/issues/1 CVE-2026-75012 - https://gist.github.com/wyxstarry/afdc067090575c216a9d2622c3338e5c CVE-2026-75013 - https://gist.github.com/wyxstarry/21e6c2853891a3beb140a7c879069f9f CVE-2026-75014 - https://github.com/niaoniaollll/cve/issues/1 @@ -160867,17 +162027,22 @@ CVE-2026-7502 - https://github.com/az10b/security-advisories/blob/main/idor_link CVE-2026-7503 - https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A800R/02_Buffer_Overflow_setWiFiMultipleConfig.md CVE-2026-7506 - https://github.com/wangzhongyang085/CVE/issues/2 CVE-2026-75077 - https://github.com/i-QvQ-i/first-OvO/issues/4 +CVE-2026-75078 - https://github.com/i-QvQ-i/first-OvO/issues/5 CVE-2026-75079 - https://github.com/i-QvQ-i/first-OvO/issues/6 CVE-2026-75080 - https://github.com/i-QvQ-i/first-OvO/issues/7 +CVE-2026-75086 - https://github.com/11snk/CVE/issues/3 CVE-2026-75087 - https://github.com/11snk/CVE/issues/4 CVE-2026-75088 - https://github.com/CSDVi/cve/issues/1 CVE-2026-75089 - https://github.com/niaoniaollll/cve/issues/3 CVE-2026-75090 - https://github.com/EricLBuehler/mistral.rs/issues/2225 CVE-2026-75093 - https://github.com/sonos/tract/issues/2390 +CVE-2026-75093 - https://github.com/sonos/tract/pull/2413 CVE-2026-75103 - https://github.com/crawlab-team/crawlab/issues/1623 CVE-2026-75104 - https://github.com/huggingface/transformers/issues/47176 CVE-2026-75105 - https://github.com/phpipam/phpipam/issues/4623 +CVE-2026-75106 - https://github.com/OpnForm/OpnForm/issues/1259 CVE-2026-75108 - https://github.com/next-terminal/next-terminal/issues/573 +CVE-2026-75109 - https://github.com/determined-ai/determined/issues/10270 CVE-2026-7511 - https://github.com/wolfSSL/wolfssl/pull/10203 CVE-2026-7511 - https://www.wolfssl.com/docs/security-vulnerabilities/ CVE-2026-75110 - https://github.com/MemTensor/MemOS/issues/2259 @@ -160885,6 +162050,7 @@ CVE-2026-75111 - https://github.com/evidentlyai/evidently/issues/1887 CVE-2026-7513 - https://github.com/kirlic123/IOTvulner/blob/main/4035/4/4.md CVE-2026-75130 - https://noma.security/blog/contextcrush-context7-the-mcp-server-vulnerability/ CVE-2026-75132 - https://www.wapt.fr/en/doc/wapt-changelog.html +CVE-2026-75148 - https://github.com/jkuhlmann/cgltf/issues/301 CVE-2026-75160 - https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75160 CVE-2026-75161 - https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75161 CVE-2026-75162 - https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75162 @@ -160894,7 +162060,9 @@ CVE-2026-75165 - https://github.com/SilviaMun/vulnerability-research/tree/main/C CVE-2026-75166 - https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75166 CVE-2026-75167 - https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75167 CVE-2026-75168 - https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75168 +CVE-2026-75169 - https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75169 CVE-2026-75170 - https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75170 +CVE-2026-75171 - https://github.com/SilviaMun/vulnerability-research/tree/main/CVE-2026-75171 CVE-2026-7521 - https://mattermost.com/security-updates CVE-2026-7526 - https://research.cleantalk.org/cve-2026-7526/ CVE-2026-7528 - https://www.ibm.com/support/pages/node/7273427 @@ -160903,9 +162071,18 @@ CVE-2026-7531 - https://www.wolfssl.com/docs/security-vulnerabilities/ CVE-2026-7532 - https://github.com/wolfSSL/wolfssl/pull/10354 CVE-2026-7532 - https://www.wolfssl.com/docs/security-vulnerabilities/ CVE-2026-75329 - https://github.com/fangtang7/CVE/blob/main/super-diamond/NETTY-NOAUTH.md +CVE-2026-75331 - https://github.com/fangtang7/CVE/blob/main/tamgou/xss.md +CVE-2026-75337 - https://github.com/fangtang7/CVE/blob/main/yu-ai/YU_AI_4.3_TRAVERSAL_POC.md CVE-2026-75339 - https://github.com/fangtang7/CVE/blob/main/admin3/file.md +CVE-2026-75345 - https://github.com/EIPStackGroup/OpENer/issues/569 +CVE-2026-75346 - https://github.com/EIPStackGroup/OpENer/issues/572 CVE-2026-75347 - https://github.com/EIPStackGroup/OpENer/issues/575 +CVE-2026-75348 - https://github.com/EIPStackGroup/OpENer/issues/573 +CVE-2026-75349 - https://github.com/EIPStackGroup/OpENer/issues/577 +CVE-2026-75350 - https://github.com/EIPStackGroup/OpENer/issues/576 +CVE-2026-75351 - https://github.com/EIPStackGroup/OpENer/issues/574 CVE-2026-75352 - https://github.com/EIPStackGroup/OpENer/issues/571 +CVE-2026-75353 - https://github.com/EIPStackGroup/OpENer/issues/570 CVE-2026-75357 - https://github.com/LeoWSY-hashblue/bilibili-desktop-ipc-origin-validation/blob/main/advisory.md CVE-2026-75363 - https://github.com/Flechao1/iot-vuln/tree/main/cve-pocs/CVE-2026-75363 CVE-2026-75364 - https://github.com/Flechao1/iot-vuln/tree/main/cve-pocs/CVE-2026-75364 @@ -160914,6 +162091,7 @@ CVE-2026-7537 - https://ryankozak.com/posts/cve-2026-7537/ CVE-2026-7538 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_329/README.md CVE-2026-75411 - https://github.com/jeecgboot/JeecgBoot/issues/9691 CVE-2026-75413 - https://github.com/RainyGao-GitHub/DocSys/issues/48 +CVE-2026-75414 - https://github.com/Y4y17/CVE/blob/main/AntFlow/Front%20desk%20command%20execution.md CVE-2026-75415 - https://github.com/Y4y17/CVE/blob/main/AntFlow/Identity%20verification%20mechanism.md CVE-2026-75417 - https://github.com/TKar0/TKar0-CvePoc/blob/main/2026-CVE-POC/CVE-2026-75417/CVE-2026-75417.md CVE-2026-75417 - https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75417 @@ -160933,31 +162111,44 @@ CVE-2026-75439 - https://github.com/hackeryounow/5GCVulDB/tree/main/CVE-2026-754 CVE-2026-7545 - https://github.com/eqwerwq/CVE/issues/2 CVE-2026-7546 - https://github.com/newym/cve/blob/main/totolinknr1800x.md CVE-2026-75464 - https://github.com/returnwrong/returnwrong-security-advisories/blob/main/CVE-2026-75464.md +CVE-2026-75465 - https://github.com/returnwrong/returnwrong-security-advisories/blob/main/CVE-2026-75465.md CVE-2026-75466 - https://github.com/libjpeg-turbo/libjpeg-turbo/issues/911 CVE-2026-75479 - https://github.com/jeecgboot/jimureport/issues/4695 CVE-2026-7548 - https://github.com/newym/cve/blob/main/totolink%20nr1800x%20command%20injection.md +CVE-2026-75480 - https://github.com/volcengine/OpenViking/issues/3724 CVE-2026-75481 - https://github.com/skypilot-org/skypilot/issues/9846 CVE-2026-75482 - https://github.com/SWE-agent/SWE-agent/issues/1472 CVE-2026-75484 - https://github.com/mtrudel/bandit/security/advisories/GHSA-x3gh-xhj4-3vq8 CVE-2026-75501 - https://drkq.github.io/security-research/calix-vu756733/ CVE-2026-75509 - https://github.com/authlib/joserfc/security/advisories/GHSA-r74j-q665-7rpj +CVE-2026-75510 - https://github.com/novuhq/novu/security/advisories/GHSA-8gr3-5j6f-25gp CVE-2026-75513 - https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed +CVE-2026-75513 - https://github.com/JasperFx/marten/pull/4911 CVE-2026-75513 - https://github.com/JasperFx/marten/releases/tag/9.13.0 CVE-2026-75513 - https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp +CVE-2026-75514 - https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q54j-5484-pvjm CVE-2026-75517 - https://github.com/novuhq/novu/security/advisories/GHSA-jh6r-hjhp-wh2h +CVE-2026-75542 - https://github.com/hexpm/hexpm/security/advisories/GHSA-rfx8-w654-8cpr CVE-2026-7555 - https://github.com/nidieaaa/test/issues/9 CVE-2026-75554 - https://github.com/hexpm/hexpm/security/advisories/GHSA-24ww-j3f4-p49c CVE-2026-75574 - https://github.com/getgrav/grav/security/advisories/GHSA-gh8j-q67c-j53f CVE-2026-75587 - https://mattermost.com/security-updates CVE-2026-75597 - https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx +CVE-2026-75601 - https://github.com/static-web-server/static-web-server/security/advisories/GHSA-97q6-jph8-rxgm CVE-2026-75602 - https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fv +CVE-2026-75608 - https://github.com/blakeblackshear/frigate/security/advisories/GHSA-mgh5-cr9h-g6hr CVE-2026-75625 - https://github.com/uber/kraken/issues/638 CVE-2026-75626 - https://github.com/smicallef/spiderfoot/issues/2012 CVE-2026-75757 - https://github.com/ash-project/ash_admin/security/advisories/GHSA-3259-55fp-w94j +CVE-2026-75758 - https://github.com/elixir-lang/elixir/security/advisories/GHSA-jf5q-v438-665c CVE-2026-75759 - https://github.com/erlef/oidcc/security/advisories/GHSA-533g-4vf3-xwrj CVE-2026-75760 - https://github.com/ash-project/ash_ai/security/advisories/GHSA-p5cr-mmmf-6w39 +CVE-2026-75773 - https://github.com/karakeep-app/karakeep/issues/2919 CVE-2026-75774 - https://github.com/karakeep-app/karakeep/issues/2920 CVE-2026-75778 - https://github.com/niaoniaollll/cve/issues/5 +CVE-2026-75783 - https://github.com/meishigana/CVE/blob/main/team15_20260702/01_wlc100p-netifd/poc/poc-netifd-overflow.py +CVE-2026-75783 - https://github.com/meishigana/CVE/tree/main/team15_20260702/01_wlc100p-netifd +CVE-2026-75784 - https://github.com/meishigana/CVE/tree/main/team15_20260702/02_wlc100-nginx CVE-2026-75793 - https://wpscan.com/vulnerability/d1c2ea43-2643-4cdf-8dfe-e11109266f51/ CVE-2026-75796 - https://wpscan.com/vulnerability/919da0c7-7643-4903-9454-2fb66353f5cb/ CVE-2026-75797 - https://wpscan.com/vulnerability/1048b130-9263-4780-b886-656a891de85a/ @@ -160967,12 +162158,16 @@ CVE-2026-75800 - https://wpscan.com/vulnerability/be658aa5-8f7f-4938-bf13-b2e6ed CVE-2026-7582 - https://github.com/biniamf/pocs/tree/main/oiio_ddsinput-readimg CVE-2026-75823 - https://wpscan.com/vulnerability/4a385690-3471-4604-aa2a-e120bb31ca53/ CVE-2026-75824 - https://wpscan.com/vulnerability/61b04ece-5050-465e-aa11-de2ff79c6e8c/ +CVE-2026-75830 - https://github.com/getgrav/grav/security/advisories/GHSA-g6j3-8jv9-ch5f CVE-2026-75831 - https://github.com/getgrav/grav/commit/aba291a59cab29ddce491175791888d8d0b65e20 CVE-2026-75831 - https://github.com/getgrav/grav/security/advisories/GHSA-6qw9-4vv5-jr97 CVE-2026-75837 - https://github.com/getgrav/grav/security/advisories/GHSA-xhfv-7758-r9hx CVE-2026-75838 - https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7 CVE-2026-75839 - https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-79wq-w74x-74ch +CVE-2026-75840 - https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-wx28-2265-f788 +CVE-2026-75841 - https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-xmjm-8q85-g778 CVE-2026-75842 - https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-hfp5-6gcp-8c75 +CVE-2026-75843 - https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p29f-345w-4qwf CVE-2026-75844 - https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-4w2m-77c8-83mw CVE-2026-75845 - https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-pff6-hp53-pj54 CVE-2026-75847 - https://github.com/ash-project/ash_paper_trail/security/advisories/GHSA-wqjr-xmxp-j554 @@ -160982,17 +162177,25 @@ CVE-2026-75853 - https://github.com/ArcadeData/arcadedb/security/advisories/GHSA CVE-2026-75854 - https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-m46c-jh3x-xwrp CVE-2026-75855 - https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-qwgr-2c45-63xx CVE-2026-75856 - https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh +CVE-2026-75857 - https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-g29h-pfmp-qp9r +CVE-2026-75858 - https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-wrj3-vj8c-784f +CVE-2026-75859 - https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-62f5-cp2p-vq95 CVE-2026-75860 - https://wpscan.com/vulnerability/6c9bbd44-cd10-40e2-af6f-440e7ccabf9a/ CVE-2026-75861 - https://wpscan.com/vulnerability/a08125a6-e528-49f1-82c4-191df80af26c/ CVE-2026-75872 - https://secur0.com/en/cna/cve-list/cve-2026-75872-html-injection-in-mailerup-double-optin-verification-email CVE-2026-75873 - https://wpscan.com/vulnerability/15b8a6cb-f89c-4d4d-9812-441e822c647f/ +CVE-2026-75877 - https://github.com/meishigana/CVE/blob/main/team15_20260702/09_751wic-apd-password-overflow/poc/poc-password-overflow.py +CVE-2026-75877 - https://github.com/meishigana/CVE/tree/main/team15_20260702/09_751wic-apd-password-overflow CVE-2026-7588 - https://github.com/ggerve/coding-standards-mcp/issues/3 CVE-2026-7589 - https://github.com/ghantakiran/splunk-mcp-integration/issues/49 +CVE-2026-75898 - https://github.com/infiniflow/ragflow/issues/15425 CVE-2026-7590 - https://github.com/eyal-gor/p_69_branch_monkey_mcp/issues/8 CVE-2026-75904 - https://github.com/Konstanty/libmodplug/issues/103 CVE-2026-7591 - https://github.com/TimBroddin/astro-mcp-server/issues/2 CVE-2026-75911 - https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-gx45-xrj5-g6c4 CVE-2026-75912 - https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6 +CVE-2026-75913 - https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-7j5w-7r7x-9v27 +CVE-2026-75914 - https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-w7wx-5q49-r59w CVE-2026-75915 - https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4 CVE-2026-7592 - https://github.com/ltranquility/submit/issues/11 CVE-2026-7593 - https://github.com/Sunwood-ai-labs/command-executor-mcp-server/issues/6 @@ -161002,8 +162205,10 @@ CVE-2026-7596 - https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/issues/2 CVE-2026-7596 - https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/pull/274 CVE-2026-75969 - https://psirt.havsys.com/ CVE-2026-7597 - https://github.com/mem0ai/mem0/issues/3778 +CVE-2026-75976 - https://github.com/meishigana/CVE/blob/main/team15_20260702/10_823dru-rc-bof/poc/poc-rc-overflow.py CVE-2026-75976 - https://github.com/meishigana/CVE/tree/main/team15_20260702/10_823dru-rc-bof CVE-2026-75978 - https://github.com/xianrendzw/EasyReport/issues/83 +CVE-2026-75984 - https://github.com/meishigana/CVE/tree/main/team15_20260702/11_823dru-rc-cmdi CVE-2026-75985 - https://github.com/meishigana/CVE/blob/main/team15_20260702/12_823dru-ssi-cmdi/poc/poc-ssi-injection.py CVE-2026-75986 - https://github.com/niaoniaollll/cve/issues/7 CVE-2026-75987 - https://github.com/SPLWare/esProc/issues/67 @@ -161042,6 +162247,7 @@ CVE-2026-76050 - https://github.com/jackkoz0512/cve/issues/1 CVE-2026-76060 - https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3 CVE-2026-76060 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-02.json CVE-2026-76060 - https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02 +CVE-2026-76066 - https://www.lasso.security/vulnerability-database/cve-2026-76066 CVE-2026-76070 - https://github.com/ozcanpng/CVE-2026-76070 CVE-2026-76071 - https://github.com/ozcanpng/CVE-2026-76071 CVE-2026-76072 - https://github.com/continuedev/continue/issues/13001 @@ -161401,6 +162607,7 @@ CVE-2026-77875 - https://fluidattacks.com/advisories/grin CVE-2026-7788 - https://github.com/Axle-Bucamp/MCP-Docusaurus/issues/2 CVE-2026-77884 - https://fluidattacks.com/advisories/suicide CVE-2026-7790 - https://cna.erlef.org/cves/CVE-2026-7790.html +CVE-2026-77931 - https://www.lasso.security/vulnerability-database/cve-2026-77931 CVE-2026-77939 - https://github.com/flextype/flextype/issues/595 CVE-2026-77945 - https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_Arbitrary_File_Command_Injection.md CVE-2026-77946 - https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_NTP_Timezone_Config_Stack_Overflow.md @@ -161979,6 +163186,7 @@ CVE-2026-7995 - https://chromereleases.googleblog.com/2026/05/stable-channel-upd CVE-2026-79950 - https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities CVE-2026-79952 - https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities CVE-2026-79954 - https://fluidattacks.com/advisories/linkin +CVE-2026-79957 - https://blog.blacklanternsecurity.com/p/cve-2026-79957-insecure-direct-object CVE-2026-7996 - https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html CVE-2026-7996 - https://issues.chromium.org/issues/484547631 CVE-2026-79961 - https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities @@ -162464,6 +163672,7 @@ CVE-2026-82595 - https://github.com/Robots10/IoT_vlu/blob/main/reports/Dlink/for CVE-2026-82596 - https://github.com/LatencyUtils/LatencyUtils/issues/22 CVE-2026-82598 - https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-009-search-cascade-template-rce.md CVE-2026-82599 - https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-002b-member-oldpic-file-deletion.md +CVE-2026-8260 - https://github.com/0xcc12138/DCS-935L-HNAP-Service-CVE CVE-2026-82600 - https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-004-zyapi-ids-sql-injection.md CVE-2026-82601 - https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-007-errtxt-reflected-xss.md CVE-2026-82603 - https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-008-member-del-pl-js-file-deletion.md @@ -162523,6 +163732,7 @@ CVE-2026-82688 - https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in CVE-2026-82691 - https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-005-vulndb.md CVE-2026-82692 - https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/DLINK-CMD-006-vulndb.md CVE-2026-82693 - https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TENDA-AC1206-TELNET-DEFAULT-UNAUTH-001-vulndb.md +CVE-2026-8270 - https://github.com/open5gs/open5gs/issues/4451 CVE-2026-82700 - https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Online%20Shopping%20System%20PHP%20email%20Parameter.md CVE-2026-82701 - https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Time-Based%20Blind%20SQL%20Injection%20in%20Online%20Shopping%20System%20%60keyword%60%20Parameter.md CVE-2026-8271 - https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/D-Link%20DNS-320%20network_mgr.cgi%20Multiple%20OS%20Command%20Injection%20Vulnerabilities.md @@ -162562,6 +163772,7 @@ CVE-2026-82820 - https://github.com/raind20001020/Poc/blob/main/flvmeta_heap_buf CVE-2026-82841 - https://wpscan.com/vulnerability/52f39a82-89ee-43f1-ba9c-3ea646fb0a0e/ CVE-2026-82842 - https://wpscan.com/vulnerability/4ae66b2c-a0de-405f-baca-127302257540/ CVE-2026-82843 - https://wpscan.com/vulnerability/45bc7096-5d04-4fe6-a332-31aed507a3a0/ +CVE-2026-82844 - https://wpscan.com/vulnerability/e959ddad-8588-4136-8518-6b1d772a62c4/ CVE-2026-82845 - https://wpscan.com/vulnerability/5ced30ea-8b78-495f-b10c-42b3f10adcb3/ CVE-2026-82846 - https://wpscan.com/vulnerability/0ee2052c-90a8-4b98-947a-adc55feb1de7/ CVE-2026-82847 - https://wpscan.com/vulnerability/9cc4f7a7-e5b9-48fe-962b-f5d0753e6158/ @@ -163144,12 +164355,14 @@ CVE-2026-84188 - https://github.com/librenms/librenms/security/advisories/GHSA-7 CVE-2026-84189 - https://github.com/librenms/librenms/security/advisories/GHSA-7gww-x7fh-jf9j CVE-2026-84190 - https://github.com/librenms/librenms/security/advisories/GHSA-jf24-8g2h-2wg7 CVE-2026-84191 - https://github.com/librenms/librenms/security/advisories/GHSA-g993-wffj-m3gv +CVE-2026-84192 - https://github.com/librenms/librenms/security/advisories/GHSA-7w8c-qgxg-m7jx CVE-2026-84193 - https://github.com/librenms/librenms/security/advisories/GHSA-v5jp-f342-234h CVE-2026-84194 - https://github.com/librenms/librenms/security/advisories/GHSA-wff2-9gjr-95f3 CVE-2026-84195 - https://github.com/kyverno/kyverno/security/advisories/GHSA-8wfp-579w-6r25 CVE-2026-84196 - https://github.com/kyverno/kyverno/security/advisories/GHSA-qr4g-8hrp-c4rw CVE-2026-84197 - https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/660 CVE-2026-84199 - https://github.com/kyverno/kyverno/security/advisories/GHSA-fmqp-4wfc-w3v7 +CVE-2026-84206 - https://github.com/grokability/snipe-it/security/advisories/GHSA-m863-2j99-jxwm CVE-2026-84207 - https://github.com/heymrun/heym/security/advisories/GHSA-mqw6-g845-w596 CVE-2026-84208 - https://github.com/WWBN/AVideo/security/advisories/GHSA-xj29-cg44-33q6 CVE-2026-84218 - https://github.com/jolokia/jolokia/issues/1049 @@ -163170,13 +164383,19 @@ CVE-2026-84259 - https://wpscan.com/vulnerability/ab1b9586-b950-4213-891e-b973bc CVE-2026-84260 - https://wpscan.com/vulnerability/ebfcc2da-5d8b-4f15-832f-02bd77844368/ CVE-2026-84261 - https://wpscan.com/vulnerability/91689a2c-a282-496b-b295-435647a0bf7d/ CVE-2026-84283 - https://fluidattacks.com/advisories/sanguisugabogg +CVE-2026-84287 - https://github.com/hackerguopeng/cve/tree/main/Hermes_API_Server_Session_Chat_DoS_Report CVE-2026-84288 - https://github.com/hackerguopeng/cve/tree/main/Hermes_ACP_Queued_Prompt_DoS_Report +CVE-2026-84289 - https://github.com/lche511/cve/blob/main/Hermes_MCP_Tool_Resource_Amplification_DoS_Report/REPORT.md CVE-2026-84301 - https://github.com/labring/FastGPT/security/advisories/GHSA-6jwp-qf29-hpj9 CVE-2026-84305 - https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm CVE-2026-84308 - https://github.com/phpseclib/phpseclib/security/advisories/GHSA-q97c-8qh3-fpc6 +CVE-2026-84312 - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-44xr-mrhh-qm78 CVE-2026-84313 - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gfrc-g87h-7h5w CVE-2026-84314 - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6 +CVE-2026-84315 - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5v7c-xpfp-p65m CVE-2026-84316 - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cf23-7qxj-xmhr +CVE-2026-84317 - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr +CVE-2026-84318 - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9jww-cxg5-rj9m CVE-2026-84319 - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5r62-gj48-897x CVE-2026-84324 - https://issues.chromium.org/issues/533534913 CVE-2026-84326 - https://issues.chromium.org/issues/547936520 @@ -163187,6 +164406,7 @@ CVE-2026-84348 - https://issues.chromium.org/issues/518100026 CVE-2026-84351 - https://issues.chromium.org/issues/551593376 CVE-2026-84354 - https://issues.chromium.org/issues/498839176 CVE-2026-84360 - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4gwf-77xp +CVE-2026-84366 - https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx CVE-2026-84371 - https://github.com/apostrophecms/apostrophe/commit/1135516a1a4a8f9638641c460488a43d8af20081 CVE-2026-84371 - https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-g8qq-57p8-ggw5 CVE-2026-84372 - https://github.com/predis/predis/security/advisories/GHSA-w6f5-v2h6-g786 @@ -163194,15 +164414,20 @@ CVE-2026-84375 - https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883 CVE-2026-84383 - https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497 CVE-2026-84384 - https://github.com/strukturag/libheif/security/advisories/GHSA-24wx-9w62-c96w CVE-2026-84423 - https://github.com/geo-chen/oss/blob/main/casdoor.md#finding-1-unauthenticated-arbitrary-file-upload-via-apiupload-resource +CVE-2026-84425 - https://github.com/hackerguopeng/cve/tree/main/CowAgent_Browser_Evaluate_Wait_DoS_Report +CVE-2026-84427 - https://github.com/outlookgp/CVE/tree/main/CowAgent_Bash_Output_Buffer_DoS_Report CVE-2026-84430 - https://github.com/Angoddess/CVE/blob/main/README.md CVE-2026-84431 - https://docs.google.com/document/d/19qRCn6NWF2UE4urLXMXKgW555PHhnQiw/edit?usp=sharing&ouid=100768766778062598194&rtpof=true&sd=true +CVE-2026-84437 - https://github.com/Leousum/VulnPoC/blob/main/OpenCart_4.1.0.3/customer-address-stored-xss.md CVE-2026-84438 - https://github.com/Leousum/VulnPoC/blob/main/OpenCart_4.1.0.3/customer-name-stored-xss.md CVE-2026-84441 - https://github.com/Leousum/VulnPoC/blob/main/Piwigo%2016.3.0/unauthenticated_derivative_path_traversal.md CVE-2026-84442 - https://docs.google.com/document/d/1NqFuHvwq66hpOfxTWPKlUB1_eMwLvujH/edit?usp=sharing&ouid=100768766778062598194&rtpof=true&sd=true CVE-2026-84444 - https://github.com/strukturag/libheif/security/advisories/GHSA-j264-xvrp-5v7q CVE-2026-84446 - https://github.com/strukturag/libheif/security/advisories/GHSA-xw34-mjcp-jqh8 +CVE-2026-84448 - https://github.com/strukturag/libheif/security/advisories/GHSA-p58j-h3vm-3fp5 CVE-2026-84449 - https://github.com/strukturag/libheif/security/advisories/GHSA-2c3g-p585-8rpq CVE-2026-84451 - https://github.com/strukturag/libheif/commit/8bfed9a9ed008e4ef28abc736284a90d3cba754f +CVE-2026-84451 - https://github.com/strukturag/libheif/security/advisories/GHSA-hh47-fhqr-cj2r CVE-2026-84452 - https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf CVE-2026-84476 - https://github.com/WWBN/AVideo/security/advisories/GHSA-gg65-574p-h4wc CVE-2026-84477 - https://github.com/WWBN/AVideo/security/advisories/GHSA-625v-vrhq-g274 @@ -163211,6 +164436,7 @@ CVE-2026-84479 - https://github.com/WWBN/AVideo/security/advisories/GHSA-m9m3-gw CVE-2026-84480 - https://github.com/WWBN/AVideo/security/advisories/GHSA-j9p7-hm85-9v77 CVE-2026-84482 - https://github.com/WWBN/AVideo/security/advisories/GHSA-jm6j-xqvq-r8p5 CVE-2026-84483 - https://github.com/WWBN/AVideo/security/advisories/GHSA-q92q-q2f7-v4fc +CVE-2026-84484 - https://github.com/nasa-jpl/ION-DTN/security/advisories/GHSA-85pw-28vw-2jf7 CVE-2026-8466 - https://cna.erlef.org/cves/CVE-2026-8466.html CVE-2026-8467 - https://cna.erlef.org/cves/CVE-2026-8467.html CVE-2026-8467 - https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-55hg-8qxv-qj4p @@ -163245,7 +164471,9 @@ CVE-2026-84833 - https://github.com/outlookgp/CVE/tree/main/OpenBrowser_Message_ CVE-2026-84838 - https://bugzilla.redhat.com/show_bug.cgi?id=2462222 CVE-2026-84839 - https://github.com/mano257200/TSI-DPDP-CMS-Missing-Authentication/blob/main/README.md CVE-2026-84839 - https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/docs/security-fixes/3.md +CVE-2026-84840 - https://github.com/mano257200/TSI-DPDP-CMS-Unauthenticated-Super-Admin-Bootstrap-Endpoint/blob/main/README.md CVE-2026-84840 - https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/docs/security-fixes/2.md +CVE-2026-84841 - https://github.com/mano257200/TSI-DPDP-CMS-Client-Side-Only-Authentication-Allows-Complete-Bypass-via-Direct-HTTP-Request/blob/main/README.md CVE-2026-84850 - https://devolutions.net/security/advisories/DEVO-2026-0030/ CVE-2026-84852 - https://docs.google.com/document/d/1g8q6UDV2EBm0UfEz2tc1eVBSxXqX5Zk8Ei30FuKAYa8/edit?usp=sharing CVE-2026-84856 - https://github.com/hackerguopeng/cve/tree/main/Rowboat_PreAuth_Body_Buffer_DoS_Report @@ -163275,6 +164503,7 @@ CVE-2026-84937 - https://wpscan.com/vulnerability/5f81c233-8544-4a7b-a1c6-e447dc CVE-2026-8497 - https://devolutions.net/security/advisories/DEVO-2026-0027/ CVE-2026-84989 - https://github.com/ntop/ntopng/security/advisories/GHSA-43p9-5758-wwq8 CVE-2026-84990 - https://github.com/ntop/ntopng/security/advisories/GHSA-7gqc-vjwr-6rh5 +CVE-2026-84992 - https://github.com/imzbf/md-editor-v3/security/advisories/GHSA-3rm2-h79c-8qw6 CVE-2026-84997 - https://github.com/reactphp/http/security/advisories/GHSA-x424-64qh-5j54 CVE-2026-85000 - https://wpscan.com/vulnerability/3c7f7d07-2c46-4839-b97f-27fe41e6292d/ CVE-2026-85001 - https://wpscan.com/vulnerability/889be882-342b-4331-89c5-9eebe90d3704/ @@ -163529,11 +164758,13 @@ CVE-2026-85724 - https://github.com/moquette-io/moquette/security/advisories/GHS CVE-2026-85725 - https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq CVE-2026-8573 - https://issues.chromium.org/issues/495417883 CVE-2026-85730 - https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2 +CVE-2026-85731 - https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7 CVE-2026-85732 - https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v CVE-2026-85734 - https://github.com/HKUDS/LightRAG/security/advisories/GHSA-frch-4w6v-q5xx CVE-2026-85738 - https://github.com/liketrek/TREK/security/advisories/GHSA-9hpq-mrpx-mcxg CVE-2026-85740 - https://github.com/HKUDS/LightRAG/security/advisories/GHSA-vv3m-f8x4-7377 CVE-2026-8575 - https://issues.chromium.org/issues/496217775 +CVE-2026-85750 - https://github.com/Piwigo/Piwigo/security/advisories/GHSA-j9q6-q52g-g8jw CVE-2026-8576 - https://issues.chromium.org/issues/496231853 CVE-2026-8581 - https://issues.chromium.org/issues/497292072 CVE-2026-8582 - https://issues.chromium.org/issues/497594413 @@ -163542,6 +164773,7 @@ CVE-2026-8585 - https://issues.chromium.org/issues/499052720 CVE-2026-8587 - https://issues.chromium.org/issues/507356235 CVE-2026-85978 - https://portal.perforce.com/s/cve/a91Qi000003CcxRIAS/unauthenticated-remote-code-execution-in-akana-policy-manager-console CVE-2026-85979 - https://portal.perforce.com/s/cve/a91Qi000003CybNIAS/command-injection-in-puppet-enterprise +CVE-2026-85990 - https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp CVE-2026-85995 - https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-cx87-7hhq-m2j3 CVE-2026-85999 - https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f CVE-2026-86000 - https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c @@ -163691,6 +164923,7 @@ CVE-2026-86464 - https://gitlab.eclipse.org/security/vulnerability-reports/-/wor CVE-2026-86464 - https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/809 CVE-2026-86464 - https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/829 CVE-2026-86475 - https://wpscan.com/vulnerability/b7b45dae-bc91-4142-ae9b-5c8b39791cda/ +CVE-2026-86476 - https://redhat.atlassian.net/browse/PSIRTSUPT-23320 CVE-2026-86511 - https://github.com/java-json-tools/jackson-coreutils/issues/65 CVE-2026-86512 - https://github.com/java-json-tools/json-patch/issues/170 CVE-2026-86513 - https://github.com/java-json-tools/jackson-coreutils/issues/66 @@ -164277,6 +165510,7 @@ CVE-2026-88993 - https://wpscan.com/vulnerability/fc1f2f62-62cd-4a70-b541-2278eb CVE-2026-88994 - https://wpscan.com/vulnerability/55b1f0b1-dc15-45d4-beb2-4d1d7a9fe3dd/ CVE-2026-88995 - https://wpscan.com/vulnerability/5a6f6d75-e7b8-44ad-a0f6-f6e4938ac3d5/ CVE-2026-88997 - https://wpscan.com/vulnerability/1699d3aa-29ca-4197-8e3b-0b03ecce751a/ +CVE-2026-88998 - https://wpscan.com/vulnerability/50fe4955-9193-4842-9ea6-1812d70d813e/ CVE-2026-89000 - https://wpscan.com/vulnerability/2622b685-d2a9-4bb5-aeef-3aa4ca7adcc4/ CVE-2026-89001 - https://wpscan.com/vulnerability/829bfdc3-7a15-4d6a-9782-72d34fd114b7/ CVE-2026-89002 - https://wpscan.com/vulnerability/6820fac6-3238-4470-a865-677c4442f658/ @@ -164302,6 +165536,7 @@ CVE-2026-89058 - https://github.com/resteasy/resteasy/security/advisories/GHSA-9 CVE-2026-89059 - https://bugzilla.redhat.com/show_bug.cgi?id=2519756 CVE-2026-89059 - https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2 CVE-2026-89080 - https://wpscan.com/vulnerability/49546064-5663-40f8-be7c-4f3faa31fa9a/ +CVE-2026-89116 - https://github.com/SAP/app-studio-toolkit/security/advisories/GHSA-vm9q-mf35-jwpx CVE-2026-89146 - https://gist.github.com/thesmartshadow/25ef03f7ebbd12118a9d27695c885989 CVE-2026-89147 - https://gist.github.com/thesmartshadow/001cea595e75fed6aaea7389666dc9eb CVE-2026-89148 - https://github.com/WWBN/AVideo/security/advisories/GHSA-jj4v-c999-cm2m @@ -164415,6 +165650,7 @@ CVE-2026-90495 - https://drive.google.com/file/d/1Pc3Xn0funYMa-N-1ihZjSWrpS-zhqb CVE-2026-90498 - https://github.com/ArrestX/vhr-advisories/blob/main/advisories/VHR-VULN-008-default-credentials.md CVE-2026-90499 - https://github.com/ArrestX/vhr-advisories/blob/main/advisories/VHR-VULN-009-password-change-idor.md CVE-2026-90500 - https://github.com/ArrestX/vhr-advisories/blob/main/advisories/VHR-VULN-005-unrestricted-upload.md +CVE-2026-90502 - https://github.com/BlkSword/POC/blob/main/ServerStatus%20Stored%20.pdf CVE-2026-90508 - https://gist.github.com/lzty/fc5f336dca4c287ab4c22168b6dc8ec2 CVE-2026-90509 - https://github.com/sumo166/CVE-apply/blob/main/dromara-orion-visor/ExposeApi%20Hardcoded%20Default%20Token%20Authentication%20Bypass%20(CWE-798)_en.md CVE-2026-90510 - https://github.com/sumo166/CVE-apply/blob/main/dromara-orion-visor/Hardcoded%20AES%20Encryption%20Key%20Enables%20Decryption%20of%20SSH%20Private%20Keys%20and%20Host%20Passwords%20(CWE-321)_en.md @@ -164660,8 +165896,11 @@ CVE-2026-9125 - https://research.cleantalk.org/cve-2026-9125/ CVE-2026-9126 - https://issues.chromium.org/issues/496280532 CVE-2026-9147 - https://github.com/SaiTeja-Erukude/CVE-2026-9147-uproot-rce CVE-2026-9162 - https://mattermost.com/security-updates +CVE-2026-91709 - https://issues.chromium.org/issues/547815507 +CVE-2026-91711 - https://issues.chromium.org/issues/558342353 CVE-2026-91712 - https://issues.chromium.org/issues/521486621 CVE-2026-91714 - https://issues.chromium.org/issues/517710554 +CVE-2026-91715 - https://issues.chromium.org/issues/558367547 CVE-2026-91717 - https://issues.chromium.org/issues/549225472 CVE-2026-91720 - https://issues.chromium.org/issues/523470135 CVE-2026-91721 - https://issues.chromium.org/issues/557320614 @@ -164679,6 +165918,8 @@ CVE-2026-91734 - https://issues.chromium.org/issues/516780835 CVE-2026-91735 - https://issues.chromium.org/issues/552416113 CVE-2026-91737 - https://issues.chromium.org/issues/558036280 CVE-2026-91738 - https://issues.chromium.org/issues/536450979 +CVE-2026-91739 - https://issues.chromium.org/issues/521951328 +CVE-2026-91741 - https://issues.chromium.org/issues/546413288 CVE-2026-91742 - https://issues.chromium.org/issues/513858387 CVE-2026-91745 - https://issues.chromium.org/issues/558734727 CVE-2026-91747 - https://issues.chromium.org/issues/540016074 @@ -164796,6 +166037,7 @@ CVE-2026-92103 - https://cna.erlef.org/cves/CVE-2026-92103.html CVE-2026-92103 - https://github.com/elixir-mint/mint/security/advisories/GHSA-q95c-ccq6-j5j6 CVE-2026-92103 - https://osv.dev/vulnerability/EEF-CVE-2026-92103 CVE-2026-92106 - https://github.com/dashbitco/lazy_html/security/advisories/GHSA-8rqp-v692-v82q +CVE-2026-92156 - https://github.com/nasa/fprime/security/advisories/GHSA-6fxx-mgfv-55g7 CVE-2026-92164 - https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v CVE-2026-9223 - https://devolutions.net/security/advisories/DEVO-2026-0013/ CVE-2026-92234 - https://hackmd.io/@leediay/r1aoFrMFGl @@ -164835,6 +166077,7 @@ CVE-2026-92423 - https://wpscan.com/vulnerability/03bd9795-8036-4ec9-ab11-8dc205 CVE-2026-92424 - https://wpscan.com/vulnerability/917b8042-b38c-4b6a-9237-1dd08ada157d/ CVE-2026-92425 - https://wpscan.com/vulnerability/b6d64e8f-e52a-4286-bd78-15f7a31d876f/ CVE-2026-92426 - https://wpscan.com/vulnerability/202f347c-962d-47a9-9dbd-70a20893db69/ +CVE-2026-92429 - https://wpscan.com/vulnerability/62c7edfc-2d18-4be6-ba36-215e90563d03/ CVE-2026-92430 - https://wpscan.com/vulnerability/1f1d7de5-cb7c-4440-b998-c6f15ecc6b4c/ CVE-2026-92435 - https://wpscan.com/vulnerability/4b3f9c83-8986-40d9-ab1a-848550ea7882/ CVE-2026-92436 - https://wpscan.com/vulnerability/f4d7b94a-7699-464c-a646-5946837b363a/ @@ -165078,6 +166321,7 @@ CVE-2026-9342 - https://github.com/july-skyload/exp/issues/1 CVE-2026-93421 - https://github.com/mesop-dev/mesop/security/advisories/GHSA-g7f6-rxc4-qhph CVE-2026-93425 - https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p CVE-2026-93426 - https://github.com/SigNoz/signoz/security/advisories/GHSA-q3h7-gpc9-2rxc +CVE-2026-9343 - https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_1/1.md CVE-2026-93435 - https://github.com/NodeRedis/node-redis-parser/issues/66 CVE-2026-9344 - https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_2/2.md CVE-2026-9345 - https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_3/3.md @@ -165136,6 +166380,8 @@ CVE-2026-93604 - https://github.com/patriksimek/vm2/security/advisories/GHSA-x3v CVE-2026-93605 - https://github.com/patriksimek/vm2/security/advisories/GHSA-pq68-rvw4-xp4r CVE-2026-93606 - https://github.com/patriksimek/vm2/security/advisories/GHSA-6454-5x88-m6jw CVE-2026-9361 - https://vuldb.com/submit/811552 +CVE-2026-93635 - https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1 +CVE-2026-93637 - https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1 CVE-2026-9364 - https://github.com/Quafather/cve/issues/1 CVE-2026-93650 - https://github.com/zast-ai/vulnerability-reports/blob/main/saleor/bruteforce.md CVE-2026-93658 - https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m @@ -165213,6 +166459,8 @@ CVE-2026-94031 - https://github.com/0-Gaurav-0/nexus-mcp/issues/1 CVE-2026-94031 - https://github.com/Xh1Xxhg/public_exp/issues/1 CVE-2026-94032 - https://github.com/ltranquility/submit_repository/issues/15 CVE-2026-94033 - https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/add_user/Readme.md +CVE-2026-94034 - https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/change_password/Readme.md +CVE-2026-94035 - https://github.com/KaranParelkar/Drug_recommendation_system/blob/main/xss/profile/Readme.md CVE-2026-94036 - https://pastebin.com/gzKNCCPV CVE-2026-94037 - https://github.com/00Kisumi00/mcp-file-analyzer/issues/1 CVE-2026-9404 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_336/README.md @@ -165313,6 +166561,8 @@ CVE-2026-94488 - https://expatch.com/writeups/telegram-html-export-xss.html CVE-2026-94488 - https://thehackernews.com/2026/09/telegram-desktop-flaw-lets-hidden.html CVE-2026-9449 - https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul21.md CVE-2026-94492 - https://github.com/mjh134/--POC/blob/master/exploits/yonyou_u8cloud_so_saleorder_sendaudit_sqli.go +CVE-2026-94493 - https://github.com/CSDVi/cve/issues/2 +CVE-2026-94494 - https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-09-tenant-cross-tenant-read.py CVE-2026-94494 - https://www.vulncheck.com/advisories/jsherp-through-3.6-tenant-information-disclosure-via-get-tenant-info CVE-2026-94495 - https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-10-systemconfig-tamper.py CVE-2026-94495 - https://www.vulncheck.com/advisories/jsherp-through-3.6-missing-authorization-via-systemconfig @@ -165377,6 +166627,7 @@ CVE-2026-9496 - https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084 CVE-2026-9500 - https://github.com/LibreDWG/libredwg/issues/1241 CVE-2026-9502 - https://github.com/LibreDWG/libredwg/issues/1243 CVE-2026-9503 - https://github.com/LibreDWG/libredwg/issues/1245 +CVE-2026-9504 - https://github.com/LibreDWG/libredwg/issues/1246 CVE-2026-95105 - https://cna.erlef.org/cves/CVE-2026-95105.html CVE-2026-95105 - https://osv.dev/vulnerability/EEF-CVE-2026-95105 CVE-2026-9511 - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_49/49.md @@ -165417,11 +166668,13 @@ CVE-2026-95290 - https://issues.chromium.org/issues/536161355 CVE-2026-95291 - https://issues.chromium.org/issues/543471693 CVE-2026-95293 - https://issues.chromium.org/issues/550953039 CVE-2026-95295 - https://issues.chromium.org/issues/517596255 +CVE-2026-95297 - https://issues.chromium.org/issues/501648493 CVE-2026-95298 - https://issues.chromium.org/issues/520516206 CVE-2026-9530 - https://github.com/LibreDWG/libredwg/issues/1248 CVE-2026-9531 - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_54/54.md CVE-2026-95315 - https://issues.chromium.org/issues/517661385 CVE-2026-95318 - https://issues.chromium.org/issues/556576976 +CVE-2026-9532 - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_55/55.md CVE-2026-95325 - https://issues.chromium.org/issues/536648933 CVE-2026-9533 - https://github.com/wudipjq/my_vuln/blob/main/totolink4/vuln_56/56.md CVE-2026-95330 - https://issues.chromium.org/issues/517163294 @@ -165472,12 +166725,15 @@ CVE-2026-9571 - https://mattermost.com/security-updates CVE-2026-9572 - https://github.com/gpac/gpac/issues/3557 CVE-2026-9572 - https://github.com/user-attachments/files/27270415/poc.zip CVE-2026-9574 - https://github.com/nidieaaa/test/issues/13 +CVE-2026-9575 - https://github.com/nidieaaa/test/issues/14 CVE-2026-9576 - https://wpscan.com/vulnerability/f28759e0-f15e-4014-b0d1-8b58bf412b49/ CVE-2026-9577 - https://wpscan.com/vulnerability/b316e14a-4260-43c4-996c-345c7f9f7d74/ CVE-2026-9579 - https://github.com/jeecgboot/JeecgBoot/issues/9596 CVE-2026-9579 - https://github.com/jeecgboot/JeecgBoot/issues/9596#issuecomment-4385414813 CVE-2026-9580 - https://github.com/jeecgboot/JeecgBoot/issues/9597 CVE-2026-9580 - https://github.com/jeecgboot/JeecgBoot/issues/9597#issuecomment-4385501959 +CVE-2026-9581 - https://github.com/jeecgboot/JeecgBoot/issues/9598 +CVE-2026-9581 - https://github.com/jeecgboot/JeecgBoot/issues/9598#issuecomment-4385719753 CVE-2026-95812 - https://hackmd.io/@leediay/reflected-xss-in-search-function-clipbucket-v5 CVE-2026-95819 - https://github.com/yingxiujie/cve/issues/9 CVE-2026-9582 - https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-9582-Cross-Site-Request-Forgery/Advisory.md @@ -165528,6 +166784,7 @@ CVE-2026-9627 - https://github.com/zhouguobing-maker/cve/blob/main/9.md CVE-2026-96271 - https://github.com/photoview/photoview/issues/1494 CVE-2026-96272 - https://hackmd.io/@leediay/sqli-photo-seach-clipbucketv5 CVE-2026-9628 - https://github.com/luozhibo-sec/cve/blob/main/10.md +CVE-2026-9631 - https://github.com/zhouguobing-maker/cve/blob/main/11.md CVE-2026-9632 - https://github.com/luozhibo-sec/cve/blob/main/12.md CVE-2026-9639 - https://github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8 CVE-2026-9640 - https://github.com/canonical/lxd/security/advisories/GHSA-ppq7-4492-5552 @@ -165547,8 +166804,11 @@ CVE-2026-96530 - https://wpscan.com/vulnerability/2153d029-a16d-4b8c-b232-6629a6 CVE-2026-96531 - https://wpscan.com/vulnerability/15ad5748-8c2b-4c60-9818-57790f7033c7/ CVE-2026-96532 - https://wpscan.com/vulnerability/d1372d8a-6654-4da7-a07e-87b18a0b0db9/ CVE-2026-96533 - https://wpscan.com/vulnerability/062284b2-b55d-42e2-8dda-ced7845d7df0/ +CVE-2026-96537 - https://wpscan.com/vulnerability/e25ac9a8-a29d-4573-9d04-402a14515fb7/ CVE-2026-96556 - https://github.com/yashkeral/cve-writeups/blob/main/cafemanagement/03-missing-auth-account-creation.md CVE-2026-96560 - https://github.com/ModelTC/LightLLM/issues/1590 +CVE-2026-96596 - https://cna.erlef.org/cves/CVE-2026-96596.html +CVE-2026-96596 - https://osv.dev/vulnerability/EEF-CVE-2026-96596 CVE-2026-96599 - https://github.com/isotope/core/issues/2585 CVE-2026-96600 - https://github.com/isotope/core/issues/2585 CVE-2026-96601 - https://github.com/yashkeral/cve-writeups/blob/main/online-makeup-store/01-admin-login-sqli.md @@ -165623,6 +166883,7 @@ CVE-2026-97231 - https://note-hxlab.wetolink.com/share/y74Vzt1jfkAi CVE-2026-97232 - https://note-hxlab.wetolink.com/share/O7wlVHed7mQd CVE-2026-97233 - https://note-hxlab.wetolink.com/share/qA4ZLotZKWmj CVE-2026-9728 - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-47q2-w832-7w67 +CVE-2026-97315 - https://wpscan.com/vulnerability/83713678-7efc-4cfc-ba24-c624a1ef8622/ CVE-2026-97316 - https://wpscan.com/vulnerability/d9497ddd-c39c-4928-8660-f1c94ef2c3a0/ CVE-2026-97317 - https://wpscan.com/vulnerability/f8779fd4-f362-40c4-8df1-145620c69103/ CVE-2026-97318 - https://wpscan.com/vulnerability/a171b0f1-b2d2-4482-b44f-bd4a1f3b223b/