Tagged “vex”
CVEs tagged vex, newest first.
7401 CVEsRSS
CVE-2026-64536Low· 8.1kernel: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (CVE-2026-64536)
A flaw was found in the Linux kernel rtl8723bs staging Wi-Fi driver. is_ap_in_tkip() reads an information-element header and its vendor or RSN payload without checking that those bytes remain in the buffer, so a truncated element causes an…
CVE-2026-64718Medium· 5.5⚖ disputedA use-after-free issue was addressed with improved memory management
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, Safari 27, iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.6, tvOS 2…
CVE-2026-17527High· 7.7In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource
In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone a…
CVE-2026-66053Medium· 5.9thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation (CVE-2026-66053)
A flaw was found in Apache Thrift Python bindings. This vulnerability, stemming from improper validation of certificates with host mismatch, could allow a remote attacker to intercept and access sensitive information. The issue occurs when…
CVE-2026-43871High· 7.5thrift: Apache Thrift: Denial of Service via infinite loop (CVE-2026-43871)
A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can…
CVE-2026-54272High· 7.2ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifie…
CVE-2026-64531High· 7.8PoCIn the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: op…
CVE-2026-15928High· 7.4XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.
XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component.
CVE-2026-55685Medium· 6.5react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests (CVE-2026-55685)
A flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service (DoS). This can put a heavy load on the server, significantly slowing down response times and…
CVE-2026-53669Medium· 5.4react-router: React Router: Open Redirect vulnerability via backslashes in navigation components (CVE-2026-53669)
A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the <Link> or useNavigate components. This could lead …
CVE-2026-45623High· 7.5postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)
A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can l…
CVE-2026-64648High· 7.5next: Next.js: Information disclosure via server-side fetch cache (CVE-2026-64648)
A flaw was found in Next.js. A remote attacker could exploit a vulnerability in the server-side fetch mechanism, where a request with a body might receive a cached response intended for a different request to the same URL but different bod…
CVE-2026-64649High· 8.2next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions (CVE-2026-64649)
A flaw was found in Next.js, a framework for building web applications. A remote attacker can exploit this vulnerability by manipulating Host-associated headers when a Server Action forwards or redirects a request. This can lead to Server-…
CVE-2026-64641High· 7.5next: Next.js: Denial of Service via crafted requests to App Router with Server Actions (CVE-2026-64641)
A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usa…
CVE-2026-64642High· 8.2next: Next.js: Authentication bypass leading to unauthorized access (CVE-2026-64642)
A flaw was found in Next.js, a React framework. A remote attacker can bypass authentication in Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales by sending crafted requests. This vulnerabi…
CVE-2026-64645High· 8.2next: Next.js: Server-Side Request Forgery vulnerability (CVE-2026-64645)
A flaw was found in Next.js, a React framework for building web applications. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) or Open Redirect attacks. When a `rewrites()` or `redirects()` rule con…
CVE-2026-64646High· 7.5next: Next.js: Denial of Service via excessive memory consumption in Server Actions (CVE-2026-64646)
A flaw was found in Next.js. An attacker sending specially crafted requests to a Next.js application utilizing the App Router with Server Actions configured to use the Edge runtime can cause excessive memory consumption. This can lead to a…
CVE-2026-64530High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act…
CVE-2026-64524Medium· 5.5⚖ disputedkernel: drm/hyperv: validate resolution_count and fix WIN8 fallback (CVE-2026-64524)
A flaw was found in the Linux kernel's `drm/hyperv` component. A malicious Hyper-V guest could exploit an out-of-bounds memory access vulnerability by sending a crafted resolution response. This could potentially lead to information disclo…
CVE-2026-64441Low· 8.8kernel: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (CVE-2026-64441)
A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. This vulnerability involves out-of-bounds reads in several functions responsible for parsing information elements (IE) and attributes. Due to missing checks on the size of in…
CVE-2026-64490High· 8.4ALSA: virtio: Validate control metadata from the device
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from the device virtio-snd control handling trusts the device-provided control type and value count returned by the device. Th…
CVE-2026-64481High· 7.8ALSA: hda/cs35l41: Fix firmware load work teardown
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can…
CVE-2026-64475High· 7.0kernel: vfio/pci: Release the VGA arbiter client on register_device() failure (CVE-2026-64475)
A flaw was found in the Linux kernel's vfio/pci subsystem. A missing cleanup operation during device registration could lead to a stale registration and a callback using freed memory. This vulnerability could result in system instability o…
CVE-2026-64448High· 7.0kernel: smb: client: restrict implied bcc[0] exemption to responses without data area (CVE-2026-64448)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. An attacker, by operating a malicious SMB server, could send specially crafted responses during the session negotiation phase. This could cause the client to read be…
CVE-2026-64444High· 8.1staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each iteration but only guards on i < pkt_le…
CVE-2026-64442Low· 8.1kernel: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (CVE-2026-64442)
A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. Insufficient boundary checks in the information element (IE) parsing loops within the `issue_assocreq()` and `join_cmd_hdl()` functions allow a remote attacker to cause an ou…
CVE-2026-64443Low· 8.1kernel: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (CVE-2026-64443)
A flaw was found in the Linux kernel. A remote attacker could exploit an out-of-bounds read vulnerability in the `update_beacon_info()` function by sending a specially crafted wireless Beacon frame containing a malformed Information Elemen…
CVE-2026-64440Low· 8.1kernel: staging: rtl8723bs: fix OOB write in HT_caps_handler() (CVE-2026-64440)
A flaw was found in the Linux kernel's `rtl8723bs` Wi-Fi driver. A remote attacker, by operating a malicious Access Point (AP), can send a specially crafted 802.11 AssocResponse frame. This can trigger an out-of-bounds write vulnerability …
CVE-2026-64420Low· 7.0kernel: mfd: cros_ec: Delay dev_set_drvdata() until probe success (CVE-2026-64420)
A flaw was found in the Linux kernel's `cros_ec` driver. This vulnerability, a use-after-free, occurs when the device's data pointer is set too early during initialization. If the initialization process fails, the memory for the `cros_ec_d…
CVE-2026-66373High· 7.5Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting…
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting…