Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-23 05:18Z
2026-08-15
2026-08-15 17:16Z
HIGH

CVE-2026-19900 — The manipulation leads to hard-coded credentials.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19900

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 8.1 (HIGH)

CWECWE 798CWECWE 259TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-15
2026-08-15 14:17Z
HIGH

CVE-2026-18500 — JSON: @fastify/jwt is a JSON Web Token plugin for Fastify.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-18500

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accept a token signed with the global key on a route that explicitly requires another CVSSv3.1 8.1 (HIGH)

CWECWE 347TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-15
2026-08-15 14:17Z
CRIT

CVE-2026-15689 — Dancer2: Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in _default_email_password_reset and _default_welcome_send. Both default emails emit a link of the form `$base/login/$code`, whose authority comes from the request Host header, or from X-Forwarded-Host under behind_proxy (obtained from Dancer2's request->base function). A POST to /login carrying submit_reset and a username needs no authentication: CVSSv3.1 9.8 (CRITICAL)

CWECWE 640VNDDancer2TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 13:18Z
HIGH

CVE-2026-74575 — Linux: In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74575

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tb_xdp_handle_request() runs on system_wq and queues xd->state_work via queue_delayed_work() in three request handlers: PROPERTIES_CHANGED_REQUEST, UUID_REQUEST (via start_handshake), and LINK_STATE_CHANGE_REQUEST. Similarly, update_xdomain() queues xd->properties_changed_work when local properties change. Concurrently, tb_xdomain_remo CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:18Z
CRIT

CVE-2026-74573 — Linux: A device with several streams gets only its first one mapped, so a guest

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74573

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE arm_vsmmu_vsid_to_sid() maps a guest's vSID to a single physical Stream ID taken from master->streams[0], assuming a device has exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-08-15
2026-08-15 13:18Z
CRIT

CVE-2026-74570 — Linux: In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfs_rl_realloc() and ntfs_rl_realloc_nofail(). CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 13:18Z
CRIT

CVE-2026-74569 — Linux: BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74569

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobyt CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-15
2026-08-15 13:18Z
CRIT

CVE-2026-74568 — Linux: During direct release, the issue can result in deleting a newly registered LPI from

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74568

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI xarray (dist->lpi_xa). When the reference count of an LPI structure drops to zero, vgic_release_lpi_locked() removes the structure from the xarray and frees it under the xarray loc CVSSv3.1 9.3 (CRITICAL)

TYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-08-15
2026-08-15 13:18Z
HIGH

CVE-2026-74562 — Linux: IPv6 RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74562

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh->lock for f6i_list walks in replace check and notify fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock. IPv6 RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a concurrent route delete that unlinks and frees a fib6_i CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:18Z
HIGH

CVE-2026-74561 — Linux: In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6i_list

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74561

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list under nh->lock and free fib6_info entries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()): BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243) CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:18Z
CRIT

CVE-2026-74556 — Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74556

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Com CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 13:18Z
HIGH

CVE-2026-74554 — Linux: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74554

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup() ath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the free_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is wrong: dp_peer->peer_id for an MLO peer always carries the ATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with index >= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEER CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:17Z
CRIT

CVE-2026-74545 — Linux: In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74545

In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtase_start_xmit(), when the head buffer DMA mapping fails after rtase_xmit_frags() has mapped all fragments, the error path clears the fragment descriptors with rtase_tx_clear_range(), which frees the skb through the last-frag slot and accounts tx_dropped. Control then falls through to the common error label, which frees the same skb a second t CVSSv3.1 9.8 (CRITICAL)

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74541 — Linux: Fix clearing of iso_data in iso_sock_disconn() Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on iso_sock_release() followed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74541

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear iso_data always when detaching conn from hcon When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is necessary, otherwise later iso_conn_free() will UAF. Fix clearing of iso_data in iso_sock_disconn() Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on iso_sock_release() followed by hci_abort_conn_sync(). CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74540 — Linux: A concurrent l2cap_chan_del() triggered by a remote disconnect can free the channel between the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74540

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp l2cap_le_connect_rsp() obtains a channel via __l2cap_get_chan_by_ident() but neither holds a reference nor uses l2cap_chan_hold_unless_zero() before locking and operating on it. A concurrent l2cap_chan_del() triggered by a remote disconnect can free the channel between the lookup and l2cap_chan_lock(), causing a use-after-free. The BR/EDR counterpart l2cap_ CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74539 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74539

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_sock_getname Accessing iso_pi(sk)->conn requires lock_sock, which is not held here. Fix by adding the lock/release. CVSSv3.1 8.0 (HIGH)

TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74538 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74538

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_connect_ind Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the "ev3" part of iso_connect_ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking. Fix by adding lock/release. Recheck hcon is valid after lock acquire where needed. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74537 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74537

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso_conn_ready sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either: [Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74535 — Linux: iso_sock_timeout() may also run concurrently with iso_conn_del(), which leads to UAF [Task 1] [Task

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74535

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout iso_sock_timeout() takes lock_sock, so sync disabling the timer while holding that lock may deadlock. iso_sock_timeout() may also run concurrently with iso_conn_del(), which leads to UAF [Task 1] [Task hdev->workqueue] iso_sock_timeout iso_conn_del iso_conn_hold_unless_zero iso_chan_del CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74534 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74534

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso_conn iso_conn_del() and iso_chan_del() have a race that results to double-put of iso_conn: [Task hdev->workqueue] [Task 2] iso_conn_del iso_chan_del iso_conn_hold_unless_zero iso_conn_lock iso_conn_lock conn->sk = NULL iso_conn_unlock sk = iso_sock_hold(conn) CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74533 — Linux: This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74533

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74531 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: hold conn

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74531

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: hold conn reference in abort_conn_sync() There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74530 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74530

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback There is theoretical UAF if the conn is freed while the hci_sync task is running. Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to match the previous behavior. CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74528 — Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74528

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_past_sync() callback Avoids giving freed pointers to hci_conn_valid(), which kmalloc may have reused. Hold refcount to avoid that. CVSSv3.1 8.0 (HIGH)

TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-08-15
2026-08-15 13:17Z
HIGH

CVE-2026-74527 — Linux: In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-74527

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from clobbering special CGX PKIND state PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC RX PKIND or default TX parse config over the PF setup. Add cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip cgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_ CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score