Tagged “cve.org”
CVEs tagged cve.org, newest first.
46493 CVEsRSS
CVE-2026-99224High· 7.0keys: Protect the type name while describing a key
In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctl_describe_key() must keep the key type's name alive until kasprintf() has consumed it. The retained key refere…
CVE-2026-99223Nonekeys: make keyring indexes independent of kernel addresses
In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTL_READ returns the serial numbers in a keyring in associative-array traversal order. The first word of…
CVE-2026-99222Nonekeys: Protect the read method check against type removal
In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctl_read_key() checks key->type->read without holding key->sem. A reference keeps the key alive, but does n…
CVE-2026-99219Noneftrace: Initialize modname and offset in print_rec()
In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in print_rec() print_rec() leaves 'modname' and 'offset' uninitialized and kallsyms_lookup() only sets them on success. When the …
CVE-2026-99220Noneasymmetric_keys: reject trust keys without IDs
In the Linux kernel, the following vulnerability has been resolved: asymmetric_keys: reject trust keys without IDs The PKCS#8 parser deliberately leaves the asym_key_ids payload slot empty. key_or_keyring_common() unconditionally deref…
CVE-2026-99218High· 7.0coredump: hold RCU while releasing parked threads
In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredump_finish() releases the parked threads by clearing ->task in their core_thread entry and calling wake_up_proce…
CVE-2026-58926Low· 2.5A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it
A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFligh…
CVE-2026-55288High· 8.4In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception
In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no…
CVE-2026-119732Medium· 6.5PoCMunshi Broken Object Level Authorization via Invoice Deletion API
Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} an…
CVE-2026-111048High· 8.4FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support…
CVE-2026-119740Medium· 6.8PoCNexbox A95X Amlogic S905X UART Unauthenticated Console Access
Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any cre…
CVE-2026-102435Critical· 9.8Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible f…
CVE-2026-91896Low· 3.9Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Authentication Bypass by Spoofing vulnerability
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Informati…
CVE-2026-120597Medium· 4.3PoCWelcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument Response…
CVE-2026-73697High· 8.8Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-control…
CVE-2026-77881Medium· 5.5Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter
Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query a…
CVE-2026-104080High· 7.8PoCControl Web Panel (CWP) < 1.29 OS Command Injection via valid_token
Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell me…
CVE-2026-77880High· 7.8Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the…
CVE-2026-77879High· 7.1PoCControl Web Panel (CWP) < 1.16 SQL Injection via access_token() API
Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into…
CVE-2026-77877High· 7.8Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access
Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. At…
CVE-2026-77878High· 7.8Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API
Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file p…
CVE-2026-77876High· 8.8Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through th…
CVE-2026-73696High· 8.1Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a m…
CVE-2026-73695High· 8.8Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concate…
CVE-2026-119085High· 8.8Template injection in the publishing component of awslabs Virtual Engineering Workbench
Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of …
CVE-2026-120656High· 7.5CVE-2026-120656
OpenKruise kruise-manager exposes an unauthenticated pprof endpoint, enabled by default, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any pod on the cluster network.
CVE-2026-120091High· 8.7Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes…
CVE-2026-58978Medium· 6.8In multiple locations, there is a possible permission bypass due to a logic error in the code
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploit…
CVE-2026-91908Medium· 5.7Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leadin…
CVE-2026-91893High· 7.8Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of …