Tagged “vex”
CVEs tagged vex, newest first.
7401 CVEsRSS
CVE-2026-57845High· 8.8PoCHugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder
Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Atta…
CVE-2026-115754Medium· 4.7serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization (CVE-2026-115754)
A flaw was found in serialize-javascript. This vulnerability allows an attacker to conduct cross-site scripting (XSS) attacks by supplying crafted function source text containing unescaped script closing tags. When serialized into a web pa…
CVE-2026-98870Medium· 6.5⚖ disputedkernel: ksmbd: remove stale channels from all sessions on teardown (CVE-2026-98870)
A flaw was found in the Linux kernel's ksmbd Server Message Block (SMB) server. A remote attacker could trigger this vulnerability by establishing and terminating bound SMB channels, leaving stale connection references attached to active s…
CVE-2026-98873Low· 3.3kernel: netfilter: nf_conntrack_expect: zero at allocation time (CVE-2026-98873)
A flaw was found in the Linux kernel's Netfilter connection tracking subsystem. Memory allocated for tracking expected network connections was not properly cleared upon allocation. A local user could exploit this vulnerability by querying …
CVE-2026-98871Medium· 4.1kernel: crypto: ccp - Fix possible deadlock in SEV init failure path (CVE-2026-98871)
A flaw was found in the Linux kernel's AMD Cryptographic Coprocessor (CCP) driver. This vulnerability can lead to a Denial of Service (DoS) due to a deadlock during AMD Secure Encrypted Virtualization (SEV) platform initialization. When an…
CVE-2026-98876Medium· 4.1kernel: host1x: bus: Fix missing ops null check in error teardown (CVE-2026-98876)
A flaw was found in the Linux kernel's Host1x bus driver. This vulnerability can lead to a Denial of Service (DoS) by causing a system crash. During device initialization error handling, the driver attempts to access client operations with…
CVE-2026-98874Low· 2.3kernel: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect (CVE-2026-98874)
A flaw was found in the Linux kernel's iwlwifi driver. A local user can trigger an unintended kernel warning by configuring Wake on Wireless LAN (WoWLAN) and suspending the system while disconnected from a network. On systems configured to…
CVE-2026-98872Medium· 4.4kernel: freevxfs: don't BUG() on unknown typed-extent type (CVE-2026-98872)
A flaw was found in the Linux kernel's FreeVxFS filesystem driver. When encountering an unrecognized extent type in an on-disk structure, the driver triggers a fatal kernel panic instead of handling the error cleanly. A local user can expl…
CVE-2026-98877Medium· 4.7kernel: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed (CVE-2026-98877)
A flaw was found in the Linux kernel's ARM Generic Interrupt Controller (GIC) driver. When virtual interrupt support is enabled on a system lacking an Interrupt Translation Service (ITS) controller, the kernel fails to disable virtual inte…
CVE-2026-98875Medium· 4.4kernel: drm/nouveau/gsp: add SEC2 to GA100 chip table (CVE-2026-98875)
A flaw was found in the Linux kernel's Nouveau GPU driver. During graphics hardware initialization on systems with GA100 chipsets, the driver fails to properly configure an internal security processor entry, leaving a required pointer unin…
CVE-2026-55889Medium· 5.3⚖ disputedxdg-desktop-portal: xdg-desktop-portal: unauthorized data disclosure via predictable token generation (CVE-2026-55889)
A flaw was found in xdg-desktop-portal. The service uses a predictable pseudorandom number generator (PRNG) to generate authorization tokens that manage access to shared system resources. By requesting enough tokens to determine the intern…
CVE-2026-55888High· 8.2xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames (CVE-2026-55888)
A flaw was found in xdg-desktop-portal. An attacker operating a sandboxed application can bypass isolation boundaries to gain unauthorized access to host files. This issue occurs because the FileChooser interface fails to properly validate…
CVE-2026-115730Low· 3.1PoCi18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protoco…
CVE-2026-115485Medium· 6.3Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a…
CVE-2026-115484High· 7.6Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same n…
CVE-2026-115486High· 7.1Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated uncond…
CVE-2026-113872High· 7.5PoCmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-111181High· 7.5body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
CVE-2026-114050Medium· 6.5vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
CVE-2026-112940High· 7.1PoCfilelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process over…
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
CVE-2026-110725Low· 3.7fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
CVE-2026-110180Medium· 4.8fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
CVE-2026-110095Low· 3.7fast-uri vulnerable to improper path equivalence in relative reference normalization
fast-uri vulnerable to improper path equivalence in relative reference normalization
CVE-2026-110306Medium· 6.1fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
CVE-2026-115449Low· 3.5Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch …
CVE-2026-115221Medium· 5.4Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership
A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by mat…
CVE-2026-114645Medium· 5.2Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection con…
CVE-2026-115417High· 7.5Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service of the client application. To remediate this issue, users shou…
CVE-2026-115504High· 7.8CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overf…
CVE-2026-115378Medium· 5.8github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive file pull (CVE-2026-115378)
A flaw was found in Incus. A privileged attacker within a virtual machine can write arbitrary files to the host system during a recursive file pull operation. By manipulating the guest agent to return duplicate file entries alternating bet…