Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-26 00:32Z
2026-08-10
2026-08-10 13:19Z
HIGH

CVE-2026-68140 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68140

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucv_path af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to me CVSSv3.1 8.8 (HIGH) · EPSS 19th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:19Z
CRIT

CVE-2026-68137 — Linux: In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68137

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25_kill_by_neigh() x25_kill_by_neigh() walks the global X.25 socket list looking for sockets attached to a terminating neighbour. x25_list_lock protects list membership while the lookup is in progress, but it does not pin a socket's lifetime after the lock is dropped. The function currently drops x25_list_lock before calling lock_sock(s). A concurrent close can run x25_relea CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:19Z
CRIT

CVE-2026-68136 — Linux: This allows already-GRO'd packets with existing frag_list to be re-aggregated into a new GRO

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68136

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but skb_gro_receive_list() lacks the same validation. As a result, packets marked with NAPI_GRO_CB(skb)->flush may still be re-aggregated. This allows already-GRO'd packets with existing frag_list to be re-aggregated into a new GRO sess CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:19Z
HIGH

CVE-2026-68128 — Linux: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0002 [#1] SMP NOPTI CPU

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68128

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF from providing ptype >= 1024 through VIRTCHNL, resulting in a write past the end of the bitmap and a kernel page fault. Reproduced with a custom kernel module injecting a crafted VIRTCHNL_OP_ADD_RSS_CFG on E810-C QSFP (8 CVSSv3.1 8.8 (HIGH) · EPSS 4th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:19Z
CRIT

CVE-2026-68127 — Linux: Impact: a remote IPv6 packet routed through a configured ILA csum-adjust-transport route or receive-side

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68127

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling pskb_may_pull(). On a non-linear skb whose transport header sits in a page fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head() and free the old skb head, leaving ip6h dangling; the following get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:19Z
HIGH

CVE-2026-68125 — Linux: In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68125

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsec_do_decrypt_auth() computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC header and authlen (4, 8 or 16) is the length of the authentication tag. Nothing verifies that the frame actually carries at least authlen payload bytes. A secured frame who CVSSv3.1 8.8 (HIGH) · EPSS 24th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:19Z
CRIT

CVE-2026-68124 — Linux: In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68124

In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctp_serial_push_header() case 2 and validates it upper-bound-only: if (c > MCTP_SERIAL_FRAME_MTU) { dev->rxstate = STATE_ERR; } else { dev->rxlen = c; dev->rxpos = 0; dev->rxstate = STATE_DATA; ... } A length of zero passes this check, so rxlen is set to 0 CVSSv3.1 9.6 (CRITICAL) · EPSS 27th percentile

TYPVulnerability
9.6
CVSS v3.1
98
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-08-10
2026-08-10 13:19Z
CRIT

CVE-2026-68123 — Linux: In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68123

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments a GSO skb, queue_gso_packets() reuses that delta for each smaller segment. A segment can then reach queue_userspace_packet() with cutlen greater than skb->len, underflowing the length passed to skb_zerocopy(). Store th CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:19Z
HIGH

CVE-2026-68118 — Linux: In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68118

In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RECEIVED The SYN-RECEIVED request-socket path in tcp_check_req() accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request instead of eliciting a challenge ACK. RFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in SYN-RECEIVED: an exact RST resets the connection, while a non-exact in-windo CVSSv3.1 8.2 (HIGH) · EPSS 32th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-08-10
2026-08-10 13:19Z
CRIT

CVE-2026-68117 — Linux: tipc_accept() creates the pre-allocated child socket with tipc_sk_create(net, new_sock, 0, kern); on failure it

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68117

In the Linux kernel, the following vulnerability has been resolved: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() When tipc_sk_create() fails to insert the new socket (tipc_sk_insert() returns non-zero), its error path frees the sk with sk_free() but leaves sock->sk pointing at the freed object: if (tipc_sk_insert(tsk)) { sk_free(sk); pr_warn("Socket create failed; port number exhausted\n"); return -EINVAL; } This is harmless for plain socket( CVSSv3.1 9.8 (CRITICAL) · EPSS 39th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:19Z
HIGH

CVE-2026-68108 — Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68108

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions (e.g. 65536×65536) cause 32-bit integer overflow, wrapping the calculated buffer size to 0. This bypasses validation and allows GPU firmware to perform out-of-bound memory access. The fix uses 64-bit arithmetic to detect overflow and rejects invalid dimensions before CVSSv3.1 8.8 (HIGH) · EPSS 3th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:19Z
HIGH

CVE-2026-68107 — Linux: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68107

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcn_v4_0_enc_find_ib_param() instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. (cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a) CVSSv3.1 8.8 (HIGH) · EPSS 3th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:19Z
HIGH

CVE-2026-68100 — Linux: 255) drives an out-of-bounds heap read of ~1 KB with an offset fully controlled

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68100

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl set_ntacl_dacl() copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.num_subauth. The ACE bytes (including an unchecked num_subauth) originate from an authenticated SMB2_SET_INFO(SecInfo=DACL) that is stored raw via ksmbd_vfs_set_sd_xattr(); parse_dacl() rejects a bad ACE w CVSSv3.1 8.1 (HIGH) · EPSS 34th percentile

TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-08-10
2026-08-10 13:19Z
HIGH

CVE-2026-68098 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68098

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs set_ntacl_dacl() can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, num_aces reflects only the ACEs that were actually copied into the output DACL, but set_posix_acl_entries_dacl() still receives nt_num_aces and uses it to walk the existing ACE array during dedup. That makes the dedup walk scan past the CVSSv3.1 8.8 (HIGH) · EPSS 35th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:19Z
HIGH

CVE-2026-68097 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68097

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities set_ntacl_dacl() validates sid.num_subauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized ACE can therefore be copied and later make the POSIX ACL deduplication walk inspect data beyond the copied ACE boundary. The existing initial bound check is also too small. It CVSSv3.1 8.8 (HIGH) · EPSS 35th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:19Z
HIGH

CVE-2026-59090 — The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-59090

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system. CVSSv3.1 8.4 (HIGH)

CWECWE 191TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2026-08-10
2026-08-10 13:17Z
HIGH

CVE-2026-19429 — Jenkins: Symlinks to secrets/master.key, hudson.util.Secret, credentials.xml, and users/*/config.xml read via GET /job/{name}/lastBuild/consoleText enable offline AES

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-19429

Jenkins FilePath.untarFrom() (all versions) validates symlink destinations but not targets, bypassing CVE-2026-33001. Any user with Item/Build access triggers tar extraction via POST /job/{name}/build, writing persistent symlinks into the tool cache. Symlinks to secrets/master.key, hudson.util.Secret, credentials.xml, and users/*/config.xml read via GET /job/{name}/lastBuild/consoleText enable offline AES decryption of all credentials and admin API tokens without bcrypt crack CVSSv3.1 8.8 (HIGH)

CWECWE 59VNDJenkinsTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 13:17Z
CRIT

CVE-2026-13206 — Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-13206

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026. CVSSv3.1 9.8 (CRITICAL)

CWECWE 78TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 13:17Z
HIGH

CVE-2026-12984 — Insufficiently: Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-12984

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026. CVSSv3.1 8.2 (HIGH)

CWECWE 522VNDInsufficientlyTYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-08-10
2026-08-10 12:17Z
HIGH

CVE-2026-68091 — Linux: In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68091

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacom_parse_and_register() starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release Wacom resources without stopping the HID hardware. Route post-hid_hw_start() failures through hid_hw_stop() before releasing driver resources. This issue was identified durin CVSSv3.1 8.8 (HIGH) · EPSS 19th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-08-10
2026-08-10 12:17Z
HIGH

CVE-2026-68085 — Linux: Re-enable and possibly requeue the work after queue flush.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68085

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled HCI_UART_SENDING bit in tx_state means write_work is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hci_uart_close(), which blocks future writes when device is reopened later if write_work was pending. Fix by clearing HCI_UART_SENDING when canceling the work. Also make clearing of t CVSSv3.1 8.0 (HIGH) · EPSS 17th percentile

TYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2026-08-10
2026-08-10 12:17Z
CRIT

CVE-2026-68083 — Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-68083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbd_vfs_kern_path_create The SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the create/mkdir/hardlink sink is not: ksmbd_vfs_kern_path_create() builds an absolute path with convert_to_unix_name() and resolves it from AT_FDCWD via start_creating_path(), so a ".." component is walked from the real filesystem root and escapes the export. An authenticated clien CVSSv3.1 9.1 (CRITICAL) · EPSS 37th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72593 — A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72593

A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem. The authentication check in index.php at line 637 evaluates 'if ($auth_pass == '' || $loggedon==$auth_pass)', and since auth_pass is an empty string in the default configuration, the condition always evaluates to true and grants CVSSv3.1 9.8 (CRITICAL)

CWECWE 306TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72592 — An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72592

An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ($upload_ext_filter = array()) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path. CVSSv3.1 9.8 (CRITICAL)

CWECWE 434TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-08-10
2026-08-10 11:17Z
CRIT

CVE-2026-72590 — An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter. The handler appends the env_vars value directly to the crontab file string as '${envVars}\n' without stripping newline characters, enabling an attacker to insert arbitrary cron expressions that execute attacker-controlled co CVSSv3.1 9.8 (CRITICAL)

CWECWE 93TYPVulnerability
9.8
CVSS v3.1
99
Edit Score