Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-09-27 20:43Z
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64319 — Linux: A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a small transfer length

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64319

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-controlled hl (hash length) and dhvlen (DH value length) fields without verifying they fit within the allocated buffer of tl bytes. A malicious NVMe-oF initiator can craft a DHCHAP_REPLY message with a small transfer length but large hl/dhvlen values, causing CVSSv3.1 9.1 (CRITICAL) · EPSS 17th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64313 — Linux: In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64313

In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when r01.m_high is saturated (0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows. The condition (r01.m_high < product.m_high) doesn't handle the case where r01.m_high == product.m_high and an additional carry exists from lower-bit overflow. When commit 3c4b23901a0c ("crypto: ecdh - Add ECDH software support") int CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64303 — Linux: Since the RX channel was already submitted and issued prior to preparing the TX

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64303

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengine_prep_slave_sg() fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was already submitted and issued prior to preparing the TX descriptor, returning -EINVAL causes the SPI core to unmap the DMA buffers while the RX DMA engine continues writing to them, CVSSv3.1 9.8 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64287 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64287

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loop bound and expect it to stay within the number of implemented list registers. While this is generally the case, flush_hyp_vcpu() copies vgic_v3 verbatim and does not enforce this, so a value provided CVSSv3.1 8.2 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64286 — Linux: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear __hyp_running_vcpu

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64286

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vCPU context into the hyp's private vCPU on every run. ctxt_to_vcpu() expects a guest context to have a NULL __hyp_running_vcpu, which is only ever set on the host context, so that it resolves the vCPU via container_of(). While this is generally the case, flush_hyp_vcpu() copies the context verbatim and doe CVSSv3.1 8.2 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2026-07-25
2026-07-25 10:17Z
HIGH

CVE-2026-64280 — Linux: In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64280

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large. Validate map.le CVSSv3.1 8.8 (HIGH) · EPSS 11th percentile

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64269 — Linux: In either case the transfer exceeds what the protocol permits and is driven by

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64269

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg When the server answers an RTRS READ, rdma_write_sg() builds the source scatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the peer. Its length is taken directly from the wire descriptor: plist->length = le32_to_cpu(id->rd_msg->desc[0].len); rd_msg points into the chunk buffer that the remote peer filled via RDMA-WRITE CVSSv3.1 9.1 (CRITICAL) · EPSS 12th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
728 × 90 / responsive · programmatic ad slot
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64268 — Linux: A connected siw peer that answers an outstanding RREAD with Read Response segments that

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64268

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks the running total against the sink buffer length on continuation segments. siw_check_sge() resolves and validates the sink memory only on the first fragment CVSSv3.1 9.8 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 10:17Z
CRIT

CVE-2026-64257 — Linux: In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-64257

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make an invalid response appear to have no data area and so qualify for the exceptio CVSSv3.1 9.1 (CRITICAL) · EPSS 12th percentile

TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-07-25
2026-07-25 09:16Z
CRIT

CVE-2026-16766 — Catalyst: Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-16766

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being develope CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile

CWECWE 78VNDCatalystTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-25
2026-07-25 07:17Z
HIGH

CVE-2026-10818 — WPForms: The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-10818

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execu CVSSv3.1 8.1 (HIGH)

CWECWE 434VNDWpformsTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-07-25
2026-07-25 01:16Z
HIGH

CVE-2026-66374 — Knot: Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66374

Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path. CVSSv3.1 8.1 (HIGH)

CWECWE 1284VNDKnotTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-07-24
2026-07-24 23:16Z
HIGH

CVE-2026-61892 — Weintek: cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-61892

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges. CVSSv3.1 8.8 (HIGH)

CWECWE 732VNDWeintekTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-24
2026-07-24 23:16Z
HIGH

CVE-2026-60134 — Weintek: cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-60134

Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges. CVSSv3.1 8.8 (HIGH)

CWECWE 784VNDWeintekTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-24
2026-07-24 23:16Z
CRIT

CVE-2026-16280 — An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-16280

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in memory corruption or information disclosure. CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile

CWECWE 190TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-24
2026-07-24 22:16Z
CRIT

CVE-2026-61884 — Tycon: By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-61884

The web management interface of Tycon Systems TPDIN-Monitor-WEB2  does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, device reboot, remote access service configuration, and network settings, which cou CVSSv3.1 9.8 (CRITICAL)

CWECWE 288VNDTyconTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2026-07-24
2026-07-24 20:18Z
HIGH

CVE-2026-66041 — FFmpeg: 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66041

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image bu CVSSv3.1 8.8 (HIGH)

CWECWE 787VNDFfmpegTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-24
2026-07-24 20:18Z
HIGH

CVE-2026-66040 — FFmpeg: through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66040

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resu CVSSv3.1 8.8 (HIGH)

CWECWE 122VNDFfmpegTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-24
2026-07-24 20:18Z
HIGH

CVE-2026-66039 — FFmpeg: through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66039

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer a CVSSv3.1 8.8 (HIGH)

CWECWE 122CWECWE 190VNDFfmpegTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-24
2026-07-24 20:18Z
HIGH

CVE-2026-66036 — FFmpeg: through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66036

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame wi CVSSv3.1 8.8 (HIGH)

CWECWE 122VNDFfmpegTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2026-07-24
2026-07-24 20:18Z
CRIT

CVE-2026-62835 — Azure: Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-62835

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network. CVSSv3.1 9.3 (CRITICAL)

CWECWE 285VNDAzureTYPVulnerability
9.3
CVSS v3.1
97
Edit Score
2026-07-24
2026-07-24 19:16Z
HIGH

CVE-2026-54342 — For non-VAU connections (Konnektor, IDP), this allows direct read and modification of the inner

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-54342

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, TSS) can present a self-signed TLS certificate and intercept the connection. For non-VAU connections (Konnektor, IDP), this allows direct read and modification of the inner traffic, including smartcard operations and OIDC authentication exchanges. For the ePA backend, the disabled TLS verification is the transport-level enabler for the VAU CVSSv3.1 8.1 (HIGH)

CWECWE 295TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2026-07-24
2026-07-24 19:16Z
CRIT

CVE-2026-48021 — In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48021

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic (patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries) becomes readable and modifiable. The attacker can also inject arbitrary requests through the hijacked channel. This i CVSSv3.1 9.1 (CRITICAL)

CWECWE 347CWECWE 295TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2026-07-24
2026-07-24 19:16Z
HIGH

CVE-2026-17107 — A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-17107

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster. CVSSv3.1 8.5 (HIGH)

CWECWE 441TYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2026-07-24
2026-07-24 17:17Z
HIGH

CVE-2026-66032 — libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-66032

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same poin CVSSv3.1 8.8 (HIGH)

CWECWE 415TYPVulnerability
8.8
CVSS v3.1
94
Edit Score