Team IT Security - 🕵️ Sicherheitslücken

Die wahren Kosten von staatlicher Überwachung

Sun, 26 Jul 2026 12:51:06 +0200

YouTube Video

CVE-2026-64375 | Linux Kernel up to 7.1.3 proc filesystem call_proc_get_link race condition (Nessus ID 329978)

Sun, 26 Jul 2026 12:50:51 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been declared as very critical. This impacts the function call_proc_get_link of the component proc filesystem. The manipulation results in race condition. This vulnerability is reported as CVE-2026-64375. The attack requires a local approach. No exploit exists. It is recommended to upgrade the affected component.

CVE-2026-64406 | Linux Kernel up to 7.2-rc2 Bluetooth bt_accept_dequeue use after free (Nessus ID 329977)

Sun, 26 Jul 2026 12:50:51 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been classified as very critical. The affected element is the function bt_accept_dequeue of the component Bluetooth. The manipulation leads to use after free. This vulnerability is listed as CVE-2026-64406. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

CVE-2026-64384 | Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3 SMB Client SMB2_notify_init double free (Nessus ID 329976)

Sun, 26 Jul 2026 12:50:50 +0200

A vulnerability classified as very critical has been found in Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3. Impacted is the function SMB2_notify_init of the component SMB Client. This manipulation causes double free. The identification of this vulnerability is CVE-2026-64384. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

CVE-2026-64372 | Linux Kernel up to 7.1.3 pcc pcc_cpufreq_do_osc use after free (Nessus ID 329975)

Sun, 26 Jul 2026 12:50:50 +0200

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.1.3. Impacted is the function pcc_cpufreq_do_osc of the component pcc. Such manipulation leads to use after free. This vulnerability is listed as CVE-2026-64372. The attack must be carried out locally. There is no available exploit. You should upgrade the affected component.

CVE-2026-64463 | Linux Kernel up to 7.2-rc2 Typec Tcpci Driver rt1711h_probe denial of service (Nessus ID 329974)

Sun, 26 Jul 2026 12:50:49 +0200

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3/7.2-rc2. This issue affects the function rt1711h_probe of the component Typec Tcpci Driver. Executing a manipulation can lead to denial of service. This vulnerability is handled as CVE-2026-64463. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

CVE-2026-64431 | Linux Kernel NTFS post_write_mst_fixup memory corruption (Nessus ID 329973)

Sun, 26 Jul 2026 12:50:49 +0200

A vulnerability was found in Linux Kernel. It has been rated as critical. Affected by this vulnerability is the function post_write_mst_fixup of the component NTFS. Performing a manipulation results in memory corruption. This vulnerability is cataloged as CVE-2026-64431. It is possible to initiate the attack remotely. There is no exploit available. Applying a patch is the recommended action to fix this issue.

CVE-2026-64309 | Linux Kernel up to 6.12.95/6.18.38/7.1.3 ccp initialization (Nessus ID 329972)

Sun, 26 Jul 2026 12:50:48 +0200

A vulnerability was found in Linux Kernel up to 6.12.95/6.18.38/7.1.3 and classified as critical. This vulnerability affects unknown code of the component ccp. The manipulation results in improper initialization. This vulnerability is known as CVE-2026-64309. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

CVE-2026-64306 | Linux Kernel up to 7.1.3 DRBG drbg_ctr_generate uninitialized variable (Nessus ID 329971)

Sun, 26 Jul 2026 12:50:48 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been rated as very critical. The affected element is the function drbg_ctr_generate of the component DRBG. Performing a manipulation results in use of uninitialized variable. This vulnerability was named CVE-2026-64306. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

CVE-2026-5349 | Trendnet TEW-657BRM 1.00.1 /setup.cgi add_apcdb mac_pc_dba stack-based overflow

Sun, 26 Jul 2026 11:51:00 +0200

A vulnerability marked as critical has been reported in Trendnet TEW-657BRM 1.00.1. The affected element is the function add_apcdb of the file /setup.cgi. The manipulation of the argument mac_pc_dba leads to stack-based buffer overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is documented as CVE-2026-5349. The attack can be initiated remotely. Additionally, an exploit exists. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us."

CVE-2026-30603 | Qianniao QN-L23PA0904 20250721.1640 Firmware Update iu.sh backdoor

Sun, 26 Jul 2026 11:51:00 +0200

A vulnerability was found in Qianniao QN-L23PA0904 20250721.1640. It has been declared as critical. This affects an unknown function of the file iu.sh of the component Firmware Update Handler. Executing a manipulation can lead to backdoor. The identification of this vulnerability is CVE-2026-30603. The physical device can be targeted for the attack. There is no exploit available.

CVE-2026-26895 | osTicket 1.18.2 /pwreset.php information disclosure

Sun, 26 Jul 2026 11:50:59 +0200

A vulnerability has been found in osTicket 1.18.2 and classified as problematic. Impacted is an unknown function of the file /pwreset.php. This manipulation causes information disclosure. This vulnerability is handled as CVE-2026-26895. The attack can be initiated remotely. There is not any exploit available.

CVE-2026-25212 | Percona up to 3.6 Add data source os command injection

Sun, 26 Jul 2026 11:50:58 +0200

A vulnerability, which was classified as critical, was found in Percona up to 3.6. This issue affects some unknown processing of the component Add data source. The manipulation results in os command injection. This vulnerability is known as CVE-2026-25212. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

CVE-2026-5350 | Trendnet TEW-657BRM 1.00.1 /setup.cgi update_pcdb mac_pc_dba stack-based overflow

Sun, 26 Jul 2026 11:50:58 +0200

A vulnerability described as critical has been identified in Trendnet TEW-657BRM 1.00.1. The impacted element is the function update_pcdb of the file /setup.cgi. The manipulation of the argument mac_pc_dba results in stack-based buffer overflow. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is reported as CVE-2026-5350. The attack can be launched remotely. Moreover, an exploit is present. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us."

CVE-2026-64469 | Linux Kernel up to 7.2-rc2 binder binder_thread_release to_proc use after free (Nessus ID 329983)

Sun, 26 Jul 2026 11:20:32 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been declared as very critical. This affects the function binder_thread_release of the component binder. Such manipulation of the argument to_proc leads to use after free. This vulnerability is referenced as CVE-2026-64469. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

CVE-2026-64371 | Linux Kernel up to 7.1.3 procfs ptrace_may_access race condition (Nessus ID 329982)

Sun, 26 Jul 2026 11:20:31 +0200

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.1.3. This issue affects the function ptrace_may_access of the component procfs. This manipulation causes race condition. This vulnerability is tracked as CVE-2026-64371. The attack is restricted to local execution. No exploit exists. It is advisable to upgrade the affected component.

CVE-2026-64318 | Linux Kernel up to 7.1.3 partitions aix_partition pp_count out-of-bounds (Nessus ID 329981)

Sun, 26 Jul 2026 11:20:30 +0200

A vulnerability classified as problematic was found in Linux Kernel up to 7.1.3. This affects the function aix_partition of the component partitions. Executing a manipulation of the argument pp_count can lead to out-of-bounds read. This vulnerability is registered as CVE-2026-64318. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

CVE-2026-64395 | Linux Kernel up to 7.1.3 ksmbd vfs_clone_file_range/vfs_copy_file_range information disclosure (Nessus ID 329980)

Sun, 26 Jul 2026 11:20:30 +0200

A vulnerability was found in Linux Kernel up to 6.1.177/6.6.144/6.12.95/6.18.38/7.1.3. It has been declared as problematic. Affected by this issue is the function vfs_clone_file_range/vfs_copy_file_range of the component ksmbd. Such manipulation leads to information disclosure. This vulnerability is documented as CVE-2026-64395. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

CVE-2026-33746 | ConvoyPanel panel up to 4.5.0 JWTService::decode improper authentication (GHSA-92pg-3w49-4w5x)

Sun, 26 Jul 2026 10:22:34 +0200

A vulnerability was found in ConvoyPanel panel up to 4.5.0. It has been rated as critical. This impacts the function JWTService::decode. The manipulation leads to improper authentication. This vulnerability is referenced as CVE-2026-33746. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

CVE-2026-34974 | thorsten phpMyFAQ up to 4.1.0 SVG SvgSanitizer.php edit_faq cross site scripting (GHSA-5crx-pfhq-4hgg)

Sun, 26 Jul 2026 10:22:33 +0200

A vulnerability categorized as problematic has been discovered in thorsten phpMyFAQ up to 4.1.0. Affected by this issue is the function edit_faq of the file SvgSanitizer.php of the component SVG Handler. The manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2026-34974. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

CVE-2026-17434 | nanocoai NanoClaw up to 2.0.64 add_mcp_server request.ts handleAddMcpServer improper authorization (Issue 2762 / EUVD-2026-49049)

Sun, 26 Jul 2026 09:19:22 +0200

A vulnerability was found in nanocoai NanoClaw up to 2.0.64. It has been declared as critical. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The identification of this vulnerability is CVE-2026-17434. The attack may be launched remotely. Furthermore, there is an exploit available. A patch should be applied to remediate this issue.

CVE-2026-17433 | nanocoai NanoClaw up to 2.0.64 MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization (Issue 2761 / EUVD-2026-49048)

Sun, 26 Jul 2026 09:19:21 +0200

A vulnerability was found in nanocoai NanoClaw up to 2.0.64. It has been classified as critical. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. This vulnerability was named CVE-2026-17433. The attack needs to be approached locally. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-63720 | koxudaxi datamodel-code-generator up to 0.69.x customBasePath code injection (545a96c5 / EUVD-2026-49050)

Sun, 26 Jul 2026 09:19:21 +0200

A vulnerability, which was classified as critical, was found in koxudaxi datamodel-code-generator up to 0.69.x. Impacted is an unknown function. The manipulation of the argument customBasePath results in code injection. This vulnerability is reported as CVE-2026-63720. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

CVE-2026-64485 | Linux Kernel up to 6.18.38/7.1.3 ALSA: compress snd_compr_task_new allocation of resources (EUVD-2026-48829)

Sun, 26 Jul 2026 09:19:20 +0200

A vulnerability has been found in Linux Kernel up to 6.18.38/7.1.3 and classified as very critical. This affects the function snd_compr_task_new of the component ALSA: compress. This manipulation causes allocation of resources. This vulnerability is handled as CVE-2026-64485. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

CVE-2026-64484 | Linux Kernel up to 7.1.3 ALSA snd_ctl_new1 null pointer dereference (EUVD-2026-48828)

Sun, 26 Jul 2026 09:19:20 +0200

A vulnerability described as very critical has been identified in Linux Kernel up to 7.1.3. This vulnerability affects the function snd_ctl_new1 of the component ALSA. Such manipulation leads to null pointer dereference. This vulnerability is documented as CVE-2026-64484. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is recommended.

CVE-2026-64482 | Linux Kernel up to 7.1.3 ALSA: gus snd_gf1_pcm_volume_control null pointer dereference (EUVD-2026-48826)

Sun, 26 Jul 2026 09:19:19 +0200

A vulnerability labeled as critical has been found in Linux Kernel up to 6.1.177/6.6.144/6.12.95/6.18.38/7.1.3. Affected by this issue is the function snd_gf1_pcm_volume_control of the component ALSA: gus. The manipulation results in null pointer dereference. This vulnerability is cataloged as CVE-2026-64482. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

CVE-2026-64483 | Linux Kernel up to 7.1.3 ALSA FireWire iSight isight_packet sample_count buffer overflow (EUVD-2026-48827)

Sun, 26 Jul 2026 09:19:19 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been classified as very critical. Affected by this issue is the function isight_packet of the component ALSA FireWire iSight. Performing a manipulation of the argument sample_count results in buffer overflow. This vulnerability is identified as CVE-2026-64483. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is recommended.

CVE-2026-64481 | Linux Kernel up to 6.12.96/6.18.38/7.1.3 Alsa Hda Cs35l41 cs35l41_remove_dsp privilege escalation (EUVD-2026-48825)

Sun, 26 Jul 2026 09:19:18 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 6.12.96/6.18.38/7.1.3. This affects the function cs35l41_remove_dsp of the component Alsa Hda Cs35l41. This manipulation causes privilege escalation. This vulnerability is registered as CVE-2026-64481. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

CVE-2026-64479 | Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3 ALSA snd_seq_event_dup heap-based overflow (EUVD-2026-48823)

Sun, 26 Jul 2026 09:19:18 +0200

A vulnerability categorized as problematic has been discovered in Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3. Affected is the function snd_seq_event_dup of the component ALSA. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability is tracked as CVE-2026-64479. The attack is restricted to local execution. No exploit exists. It is advisable to upgrade the affected component.

CVE-2026-34818 | Endian Firewall 3.3.25 Parameter localdomains remark cross site scripting

Sun, 26 Jul 2026 08:20:12 +0200

A vulnerability described as problematic has been identified in Endian Firewall 3.3.25. Affected by this vulnerability is an unknown functionality of the file /manage/dnsmasq/localdomains/ of the component Parameter Handler. Such manipulation of the argument remark leads to cross site scripting. This vulnerability is documented as CVE-2026-34818. The attack can be executed remotely. There is not any exploit available.

CVE-2026-34823 | Endian Firewall 3.3.25 Parameter /manage/password/web/ remark cross site scripting

Sun, 26 Jul 2026 08:20:12 +0200

A vulnerability marked as problematic has been reported in Endian Firewall 3.3.25. Affected is an unknown function of the file /manage/password/web/ of the component Parameter Handler. This manipulation of the argument remark causes cross site scripting. This vulnerability is registered as CVE-2026-34823. Remote exploitation of the attack is possible. No exploit is available.

CVE-2026-34822 | Endian Firewall 3.3.25 Certificate /manage/ca/certificate/ new_cert_name cross site scripting

Sun, 26 Jul 2026 08:20:11 +0200

A vulnerability labeled as problematic has been found in Endian Firewall 3.3.25. This impacts an unknown function of the file /manage/ca/certificate/ of the component Certificate Handler. The manipulation of the argument new_cert_name results in cross site scripting. This vulnerability is cataloged as CVE-2026-34822. The attack may be launched remotely. There is no exploit available.

CVE-2026-34821 | Endian Firewall 3.3.25 Parameter user remark cross site scripting

Sun, 26 Jul 2026 08:20:11 +0200

A vulnerability identified as problematic has been detected in Endian Firewall 3.3.25. This affects an unknown function of the file /manage/vpnauthentication/user/ of the component Parameter Handler. The manipulation of the argument remark leads to cross site scripting. This vulnerability is listed as CVE-2026-34821. The attack may be initiated remotely. There is no available exploit.

CVE-2026-34820 | Endian Firewall 3.3.25 Parameter /manage/ipsec/ remark cross site scripting

Sun, 26 Jul 2026 08:20:10 +0200

A vulnerability categorized as problematic has been discovered in Endian Firewall 3.3.25. The impacted element is an unknown function of the file /manage/ipsec/ of the component Parameter Handler. Executing a manipulation of the argument remark can lead to cross site scripting. This vulnerability is tracked as CVE-2026-34820. The attack can be launched remotely. No exploit exists.

CVE-2026-34819 | Endian Firewall 3.3.25 Parameter openvpnclient.cgi REMARK cross site scripting

Sun, 26 Jul 2026 08:20:10 +0200

A vulnerability was found in Endian Firewall 3.3.25. It has been declared as problematic. Impacted is an unknown function of the file /cgi-bin/openvpnclient.cgi of the component Parameter Handler. Such manipulation of the argument REMARK leads to cross site scripting. This vulnerability is referenced as CVE-2026-34819. It is possible to launch the attack remotely. No exploit is available.

CVE-2026-34817 | Endian Firewall 3.3.25 Parameter /cgi-bin/smtprouting.cgi BCC cross site scripting

Sun, 26 Jul 2026 08:20:09 +0200

A vulnerability was found in Endian Firewall 3.3.25. It has been rated as problematic. The affected element is an unknown function of the file /cgi-bin/smtprouting.cgi of the component Parameter Handler. Performing a manipulation of the argument BCC results in cross site scripting. This vulnerability is identified as CVE-2026-34817. The attack can be initiated remotely. There is not any exploit available.

CVE-2026-34815 | Endian Firewall 3.3.25 Parameter /cgi-bin/smtpdomains.cgi DOMAIN cross site scripting

Sun, 26 Jul 2026 08:20:09 +0200

A vulnerability, which was classified as problematic, has been found in Endian Firewall 3.3.25. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/smtpdomains.cgi of the component Parameter Handler. Performing a manipulation of the argument DOMAIN results in cross site scripting. This vulnerability is known as CVE-2026-34815. Remote exploitation of the attack is possible. No exploit is available.

CVE-2026-34816 | Endian Firewall 3.3.25 Parameter domainrouting domain cross site scripting

Sun, 26 Jul 2026 08:20:08 +0200

A vulnerability was found in Endian Firewall 3.3.25. It has been classified as problematic. This issue affects some unknown processing of the file /manage/smtpscan/domainrouting/ of the component Parameter Handler. This manipulation of the argument domain causes cross site scripting. The identification of this vulnerability is CVE-2026-34816. It is possible to initiate the attack remotely. There is no exploit available.

CVE-2026-34973 | thorsten phpMyFAQ up to 4.1.0 Search.php searchCustomPages data query logic injection (GHSA-gcp9-5jc8-976x)

Sun, 26 Jul 2026 08:20:08 +0200

A vulnerability labeled as problematic has been found in thorsten phpMyFAQ up to 4.1.0. This vulnerability affects the function searchCustomPages of the file phpmyfaq/src/phpMyFAQ/Search.php. Such manipulation leads to improper neutralization of special elements in data query logic. This vulnerability is documented as CVE-2026-34973. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

CVE-2026-64460 | Linux Kernel up to 6.18.38/7.1.3 Pci Iov drivers/pci/iov.c sriov_restore_vf_rebar_state out-of-bounds (Nessus ID 329992)

Sun, 26 Jul 2026 07:48:50 +0200

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.18.38/7.1.3. The impacted element is the function sriov_restore_vf_rebar_state of the file drivers/pci/iov.c of the component Pci Iov. Such manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2026-64460. The attack must be carried out locally. There is no available exploit. It is advisable to upgrade the affected component.

CVE-2026-64416 | Linux Kernel up to 6.12.96/6.18.38/7.1.3 swap_cgroup lookup_swap_cgroup_id null pointer dereference (Nessus ID 329991)

Sun, 26 Jul 2026 07:48:49 +0200

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.12.96/6.18.38/7.1.3. This vulnerability affects the function lookup_swap_cgroup_id of the component swap_cgroup. Executing a manipulation can lead to null pointer dereference. This vulnerability appears as CVE-2026-64416. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

CVE-2026-64480 | Linux Kernel up to 7.1.3 ALSA ice1712 driver aureon.c snd_ctl_new1 null pointer dereference (Nessus ID 329990)

Sun, 26 Jul 2026 07:48:49 +0200

A vulnerability identified as very critical has been detected in Linux Kernel up to 6.1.177/6.6.144/6.12.95/6.18.38/7.1.3. Affected by this vulnerability is the function snd_ctl_new1 of the file ice1712.c/ice1724.c/aureon.c of the component ALSA ice1712 driver. The manipulation leads to null pointer dereference. This vulnerability is listed as CVE-2026-64480. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

CVE-2026-64287 | Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.3 KVM arm64 pKVM hyp vCPU flush_hyp_vcpu used_lrs out-of-bounds (Nessus ID 329989)

Sun, 26 Jul 2026 07:48:49 +0200

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 6.6.144/6.12.96/6.18.39/7.1.3. This affects the function flush_hyp_vcpu of the component KVM arm64 pKVM hyp vCPU. This manipulation of the argument used_lrs causes out-of-bounds read. This vulnerability appears as CVE-2026-64287. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

CVE-2026-64418 | Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc2 shrinker alloc_shrinker_info/expand_shrinker_info use after free (Nessus ID 329987)

Sun, 26 Jul 2026 07:48:48 +0200

A vulnerability classified as very critical was found in Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc2. This issue affects the function alloc_shrinker_info/expand_shrinker_info of the component shrinker. Such manipulation leads to use after free. This vulnerability is uniquely identified as CVE-2026-64418. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

CVE-2026-64410 | Linux Kernel up to 7.1.3/7.2-rc2 Netfilter Flowtable nf_flow_offload_add Remote Code Execution (Nessus ID 329988)

Sun, 26 Jul 2026 07:48:48 +0200

A vulnerability identified as critical has been detected in Linux Kernel up to 7.1.3/7.2-rc2. Affected is the function nf_flow_offload_add of the component Netfilter Flowtable. Performing a manipulation results in Remote Code Execution. This vulnerability is reported as CVE-2026-64410. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

CVE-2026-64362 | Linux Kernel up to 7.2-rc2 HID lg-g15 lg_g15_event use after free (Nessus ID 329984)

Sun, 26 Jul 2026 07:48:47 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been classified as critical. Impacted is the function lg_g15_event of the component HID lg-g15. Performing a manipulation results in use after free. This vulnerability is reported as CVE-2026-64362. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended.

CVE-2026-64338 | Linux Kernel up to 7.2-rc2 uss720 uss720_probe allocation of resources (Nessus ID 329986)

Sun, 26 Jul 2026 07:48:46 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been rated as problematic. Affected by this issue is the function uss720_probe of the component uss720. This manipulation causes allocation of resources. This vulnerability is handled as CVE-2026-64338. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is advised.

CVE-2026-64348 | Linux Kernel up to 7.2-rc2 USB iso_stream_schedule hcpriv memory leak (Nessus ID 329985)

Sun, 26 Jul 2026 07:48:46 +0200

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.2-rc2. Affected is the function iso_stream_schedule of the component USB. Executing a manipulation of the argument hcpriv can lead to memory leak. This vulnerability is registered as CVE-2026-64348. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

CVE-2026-64412 | Linux Kernel up to 7.2-rc2 ebtables request_module buffer over-read (Nessus ID 329997)

Sun, 26 Jul 2026 06:50:22 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 7.2-rc2. Affected by this issue is the function request_module of the component ebtables. The manipulation leads to buffer over-read. This vulnerability is traded as CVE-2026-64412. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

CVE-2026-64323 | Linux Kernel up to 7.1.3 UDF udf_load_vat/udf_get_pblock_virt15 lengthHeader/i_size out-of-bounds (Nessus ID 329996)

Sun, 26 Jul 2026 06:50:21 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been rated as problematic. This impacts the function udf_load_vat/udf_get_pblock_virt15 of the component UDF. The manipulation of the argument lengthHeader/i_size leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2026-64323. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

CVE-2026-64471 | Linux Kernel up to 7.1.3 Btusb use after free (Nessus ID 329993)

Sun, 26 Jul 2026 06:50:21 +0200

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.1.3. Affected by this vulnerability is an unknown functionality of the component Btusb. This manipulation causes use after free. This vulnerability is handled as CVE-2026-64471. It is possible to launch the attack on the local host. There is not any exploit available. It is advisable to upgrade the affected component.

CVE-2026-64470 | Linux Kernel up to 7.1.3 btusb btusb.c btusb_probe use after free (Nessus ID 329995)

Sun, 26 Jul 2026 06:50:20 +0200

A vulnerability classified as very critical was found in Linux Kernel up to 7.1.3. Affected is the function btusb_probe of the file btusb.c of the component btusb. The manipulation results in use after free. This vulnerability is known as CVE-2026-64470. Attacking locally is a requirement. No exploit is available. Upgrading the affected component is advised.

CVE-2026-64522 | Linux Kernel up to 6.18.33/7.0.10 eswitch mode net/mlx5e mlx5e_xfrm_add_state off-by-one (EUVD-2026-48866)

Sun, 26 Jul 2026 06:36:24 +0200

A vulnerability labeled as very critical has been found in Linux Kernel up to 6.18.33/7.0.10. Affected is the function mlx5e_xfrm_add_state of the file net/mlx5e of the component eswitch mode. The manipulation results in off-by-one. This vulnerability is identified as CVE-2026-64522. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

CVE-2026-64521 | Linux Kernel up to 6.18.33/7.0.10 pinctrl pinconf_pins_show deadlock (EUVD-2026-48865)

Sun, 26 Jul 2026 06:36:23 +0200

A vulnerability identified as problematic has been detected in Linux Kernel up to 6.18.33/7.0.10. This impacts the function pinconf_pins_show of the component pinctrl. The manipulation leads to deadlock. This vulnerability is referenced as CVE-2026-64521. The attack can only be performed from a local environment. No exploit is available. You should upgrade the affected component.

CVE-2026-64520 | Linux Kernel up to 6.18.33/7.0.10 arm_ffa buffer overflow (EUVD-2026-48864)

Sun, 26 Jul 2026 06:36:23 +0200

A vulnerability was found in Linux Kernel up to 6.18.33/7.0.10. It has been rated as very critical. The impacted element is an unknown function of the component arm_ffa. Performing a manipulation results in buffer overflow. This vulnerability was named CVE-2026-64520. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

CVE-2026-64519 | Linux Kernel up to 6.12.91/6.18.33/7.0.10 NFSD nfsd4_revoke_states infinite loop (EUVD-2026-48863)

Sun, 26 Jul 2026 06:36:23 +0200

A vulnerability categorized as critical has been discovered in Linux Kernel up to 6.12.91/6.18.33/7.0.10. This affects the function nfsd4_revoke_states of the component NFSD. Executing a manipulation can lead to infinite loop. The identification of this vulnerability is CVE-2026-64519. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

CVE-2026-64518 | Linux Kernel up to 6.12.91/6.18.33/7.0.10 Tcp Ao Established Key tcp_ao_established_key out-of-bounds (EUVD-2026-48862)

Sun, 26 Jul 2026 06:36:23 +0200

A vulnerability classified as very critical has been found in Linux Kernel up to 6.12.91/6.18.33/7.0.10. Affected is the function tcp_ao_established_key of the component Tcp Ao Established Key. This manipulation causes out-of-bounds read. This vulnerability is registered as CVE-2026-64518. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

CVE-2026-64517 | Linux Kernel up to 6.12.91/6.18.33/7.0.10 GSC xe_gsc_init_post_hwconfig double free (EUVD-2026-48861)

Sun, 26 Jul 2026 06:36:23 +0200

A vulnerability described as very critical has been identified in Linux Kernel up to 6.12.91/6.18.33/7.0.10. This impacts the function xe_gsc_init_post_hwconfig of the component GSC. The manipulation results in double free. This vulnerability is cataloged as CVE-2026-64517. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

CVE-2026-64514 | Linux Kernel up to 7.1.3 userfaultfd userfaultfd_must_wait/userfaultfd_huge_must_wait encoding error (EUVD-2026-48858)

Sun, 26 Jul 2026 06:36:22 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been declared as very critical. The affected element is the function userfaultfd_must_wait/userfaultfd_huge_must_wait of the component userfaultfd. Such manipulation leads to encoding error. This vulnerability is uniquely identified as CVE-2026-64514. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

CVE-2026-64516 | Linux Kernel up to 7.0.10 Drm Amgpu Vce1 drm/amdgpu/vce1 out-of-bounds (EUVD-2026-48860)

Sun, 26 Jul 2026 06:36:22 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 7.0.10. This affects an unknown function of the file drm/amdgpu/vce1 of the component Drm Amgpu Vce1. The manipulation leads to out-of-bounds read. This vulnerability is listed as CVE-2026-64516. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

CVE-2026-64515 | Linux Kernel up to 6.12.91/6.18.33/7.0.10 mac80211 defragmentation routine heap-based overflow (EUVD-2026-48859)

Sun, 26 Jul 2026 06:36:22 +0200

A vulnerability labeled as very critical has been found in Linux Kernel up to 6.12.91/6.18.33/7.0.10. The impacted element is the function defragmentation routine of the component mac80211. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability is tracked as CVE-2026-64515. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

CVE-2026-64513 | Linux Kernel up to 6.18.38/7.1.3 KVM handle_tpr_below_threshold denial of service (EUVD-2026-48857)

Sun, 26 Jul 2026 06:36:22 +0200

A vulnerability has been found in Linux Kernel up to 6.18.38/7.1.3 and classified as critical. Affected by this vulnerability is the function handle_tpr_below_threshold of the component KVM. Performing a manipulation results in denial of service. This vulnerability is known as CVE-2026-64513. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

CVE-2026-64512 | Linux Kernel up to 7.1.3 Cppc drivers/acpi/cppc_acpi.c cpc_write access_width out-of-bounds (EUVD-2026-48856)

Sun, 26 Jul 2026 06:36:21 +0200

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.1.3. This impacts the function cpc_write of the file drivers/acpi/cppc_acpi.c of the component Cppc. This manipulation of the argument access_width causes out-of-bounds read. This vulnerability appears as CVE-2026-64512. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

CVE-2026-64510 | Linux Kernel up to 7.1.3 Nfit Core acpi_nfit_init use after free (EUVD-2026-48854)

Sun, 26 Jul 2026 06:36:21 +0200

A vulnerability was found in Linux Kernel up to 7.1.3. It has been classified as very critical. Impacted is the function acpi_nfit_init of the component Nfit Core. This manipulation causes use after free. This vulnerability is handled as CVE-2026-64510. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is recommended.

CVE-2026-64511 | Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3 ACPI NFIT Core drivers/acpi/nfit/core.c acpi_nfit_uc_error_notify null pointer dereference (EUVD-2026-48855)

Sun, 26 Jul 2026 06:36:21 +0200

A vulnerability identified as problematic has been detected in Linux Kernel up to 6.6.144/6.12.95/6.18.38/7.1.3. The affected element is the function acpi_nfit_uc_error_notify of the file drivers/acpi/nfit/core.c of the component ACPI NFIT Core. Performing a manipulation results in null pointer dereference. This vulnerability is identified as CVE-2026-64511. The attack is only possible with local access. There is not any exploit available. You should upgrade the affected component.

CVE-2026-66041 | FFmpeg up to 8.1.2 vf_quirc filter av_image_copy_plane out-of-bounds write (Nessus ID 329731)

Sun, 26 Jul 2026 06:36:21 +0200

A vulnerability was found in FFmpeg up to 8.1.2. It has been rated as critical. Affected is the function av_image_copy_plane of the component vf_quirc filter. Performing a manipulation results in out-of-bounds write. This vulnerability is cataloged as CVE-2026-66041. It is possible to initiate the attack remotely. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

CVE-2026-66038 | FFmpeg up to 8.1.2 LCL/ZLIB Video Decoder lcldec.c zlib_decomp information disclosure (Nessus ID 329734)

Sun, 26 Jul 2026 06:36:21 +0200

A vulnerability was found in FFmpeg up to 8.1.2. It has been classified as problematic. This affects the function zlib_decomp of the file lcldec.c of the component LCL/ZLIB Video Decoder. This manipulation causes information disclosure. This vulnerability is tracked as CVE-2026-66038. The attack is possible to be carried out remotely. No exploit exists. It is suggested to install a patch to address this issue.

CVE-2026-15037 | Qt XML up to 6.11.x QDom xml injection (Nessus ID 329733)

Sun, 26 Jul 2026 06:36:20 +0200

A vulnerability categorized as critical has been discovered in Qt XML up to 6.11.x. This vulnerability affects unknown code of the component QDom. The manipulation results in xml injection. This vulnerability is reported as CVE-2026-15037. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

CVE-2026-66374 | nic Knot Resolver up to 6.4.0 DNS-over-QUIC buffer overflow (Nessus ID 329728)

Sun, 26 Jul 2026 06:36:20 +0200

A vulnerability was found in nic Knot Resolver up to 6.4.0. It has been declared as critical. Affected by this issue is some unknown functionality of the component DNS-over-QUIC. Executing a manipulation can lead to buffer overflow. This vulnerability is tracked as CVE-2026-66374. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

CVE-2026-66039 | FFmpeg up to 8.1.2 MACE6 Audio Decoder mace_decode_frame bytes_per_packet integer overflow (Nessus ID 329729)

Sun, 26 Jul 2026 06:36:20 +0200

A vulnerability was found in FFmpeg up to 8.1.2. It has been declared as critical. This impacts the function mace_decode_frame of the component MACE6 Audio Decoder. Such manipulation of the argument bytes_per_packet leads to integer overflow. This vulnerability is listed as CVE-2026-66039. The attack may be performed from remote. There is no available exploit. A patch should be applied to remediate this issue.

CVE-2026-66037 | FFmpeg up to 8.1.1 IAMF demuxer libavformat/iamf_parse.c mix_presentation_obu count_label resource consumption (5d7112c / Nessus ID 329730)

Sun, 26 Jul 2026 06:36:19 +0200

A vulnerability classified as problematic has been found in FFmpeg up to 8.1.1. This affects the function mix_presentation_obu of the file libavformat/iamf_parse.c of the component IAMF demuxer. This manipulation of the argument count_label causes resource consumption. This vulnerability is handled as CVE-2026-66037. The attack can be initiated remotely. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

CVE-2026-66040 | FFmpeg up to 8.1.2 PNG/APNG encoders png_write_chunk out-of-bounds write (b506faf / Nessus ID 329727)

Sun, 26 Jul 2026 06:36:19 +0200

A vulnerability was found in FFmpeg up to 8.1.2 and classified as critical. The impacted element is the function png_write_chunk of the component PNG/APNG encoders. The manipulation results in out-of-bounds write. This vulnerability is identified as CVE-2026-66040. The attack can be executed remotely. There is not any exploit available. Applying a patch is advised to resolve this issue.

CVE-2026-66036 | FFmpeg up to 8.1.2 vf_hqdn3d filter vf_hqdn3d.config_input/denoise_spatial heap-based overflow (Nessus ID 329726)

Sun, 26 Jul 2026 06:36:19 +0200

A vulnerability classified as critical was found in FFmpeg up to 8.1.2. This vulnerability affects the function vf_hqdn3d.config_input/denoise_spatial of the component vf_hqdn3d filter. Such manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-66036. The attack can be launched remotely. No exploit exists. It is advisable to implement a patch to correct this issue.

CVE-2026-5213 | D-Link DNS-1550-04 up to 20260205 /cgi-bin/account_mgr.cgi cgi_adduser_to_session read_list stack-based overflow

Sun, 26 Jul 2026 06:36:19 +0200

A vulnerability identified as critical has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_adduser_to_session of the file /cgi-bin/account_mgr.cgi. This manipulation of the argument read_list causes stack-based buffer overflow. The identification of this vulnerability is CVE-2026-5213. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

CVE-2026-5212 | D-Link DNS-1550-04 up to 20260205 /cgi-bin/webdav_mgr.cgi Webdav_Upload_File f_file stack-based overflow

Sun, 26 Jul 2026 06:36:19 +0200

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. It has been rated as critical. This issue affects the function Webdav_Upload_File of the file /cgi-bin/webdav_mgr.cgi. The manipulation of the argument f_file leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-5212. The attack is possible to be carried out remotely. Moreover, an exploit is present.

CVE-2026-34401 | Microsoft XmlNotepad prior 2.9.0.21 HTTP/SMB xml external entity reference (GHSA-5j32-486h-42ch)

Sun, 26 Jul 2026 06:36:18 +0200

A vulnerability was found in Microsoft XmlNotepad. It has been declared as problematic. Affected is an unknown function of the component HTTP/SMB. Such manipulation leads to xml external entity reference. This vulnerability is traded as CVE-2026-34401. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

CVE-2026-34400 | Alerta up to 9.0.x Query String Search API sql injection (GHSA-8prr-286p-4w7j)

Sun, 26 Jul 2026 06:36:18 +0200

A vulnerability labeled as critical has been found in Alerta up to 9.0.x. Affected by this vulnerability is an unknown functionality of the component Query String Search API. Executing a manipulation can lead to sql injection. The identification of this vulnerability is CVE-2026-34400. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

CVE-2026-34738 | WWBN AVideo up to 26.0 setStatus improper authorization (GHSA-m577-w9j8-ch7j)

Sun, 26 Jul 2026 06:36:18 +0200

A vulnerability identified as critical has been detected in WWBN AVideo up to 26.0. The impacted element is the function setStatus. This manipulation causes improper authorization. The identification of this vulnerability is CVE-2026-34738. It is possible to initiate the attack remotely. There is no exploit available.

CVE-2026-34740 | WWBN AVideo up to 26.0 EPG Page isSSRFSafeURL server-side request forgery (GHSA-x5vx-vrpf-r45f)

Sun, 26 Jul 2026 06:36:17 +0200

A vulnerability, which was classified as critical, has been found in WWBN AVideo up to 26.0. Affected is the function isSSRFSafeURL of the component EPG Page. The manipulation leads to server-side request forgery. This vulnerability is documented as CVE-2026-34740. The attack can be initiated remotely. There is not any exploit available.

CVE-2026-34737 | WWBN AVideo up to 26.0 Endpoint test.php retrieveSubscriptions authorization (GHSA-38rh-4v39-vfxv)

Sun, 26 Jul 2026 06:36:17 +0200

A vulnerability was found in WWBN AVideo up to 26.0. It has been declared as problematic. Affected by this issue is the function retrieveSubscriptions of the file test.php of the component Endpoint. Such manipulation leads to missing authorization. This vulnerability is uniquely identified as CVE-2026-34737. The attack can be launched remotely. No exploit exists.

CVE-2026-34739 | WWBN AVideo up to 26.0 testIP.php htmlspecialchars cross site scripting (GHSA-jqrj-chh6-8h78)

Sun, 26 Jul 2026 06:36:17 +0200

A vulnerability classified as problematic was found in WWBN AVideo up to 26.0. This impacts the function htmlspecialchars of the file testIP.php. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2026-34739. It is possible to launch the attack remotely. No exploit is available.

CVE-2026-3470 | SonicWall Email Security improper authentication (SNWLID-2026-0002)

Sun, 26 Jul 2026 06:36:17 +0200

A vulnerability identified as critical has been detected in SonicWall Email Security. The affected element is an unknown function. The manipulation leads to improper authentication. This vulnerability is listed as CVE-2026-3470. The attack may be initiated remotely. There is no available exploit.

CVE-2026-3468 | SonicWall Email Security cross site scripting (WLID-2026-0002)

Sun, 26 Jul 2026 06:36:17 +0200

A vulnerability classified as problematic was found in SonicWall Email Security. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross site scripting. This vulnerability appears as CVE-2026-3468. The attack may be performed from remote. There is no available exploit.

CVE-2026-3469 | SonicWall Email Security denial of service (SNWLID-2026-0002)

Sun, 26 Jul 2026 06:36:16 +0200

A vulnerability categorized as problematic has been discovered in SonicWall Email Security. Impacted is an unknown function. Executing a manipulation can lead to denial of service. This vulnerability is tracked as CVE-2026-3469. The attack can be launched remotely. No exploit exists.

CVE-2026-64509 | Linux Kernel up to 6.12.96/6.18.38/7.1.3 block GenDiskBuilder::build memory leak (EUVD-2026-48853)

Sun, 26 Jul 2026 06:36:16 +0200

A vulnerability was found in Linux Kernel up to 6.12.96/6.18.38/7.1.3 and classified as very critical. This issue affects the function GenDiskBuilder::build of the component block. The manipulation results in memory leak. This vulnerability is known as CVE-2026-64509. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

CVE-2026-64506 | Linux Kernel up to 7.1.3 rtw89 state issue (EUVD-2026-48850)

Sun, 26 Jul 2026 06:36:16 +0200

A vulnerability, which was classified as critical, was found in Linux Kernel up to 7.1.3. Affected is an unknown function of the component rtw89. Such manipulation leads to state issue. This vulnerability is traded as CVE-2026-64506. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

CVE-2026-64508 | Linux Kernel up to 7.2-rc1 BPF bpf_arch_pred_flush allocation of resources (EUVD-2026-48852)

Sun, 26 Jul 2026 06:36:16 +0200

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.6.144/6.12.96/6.18.38/7.1.3/7.2-rc1. Impacted is the function bpf_arch_pred_flush of the component BPF. Such manipulation leads to allocation of resources. This vulnerability is referenced as CVE-2026-64508. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

CVE-2026-64507 | Linux Kernel up to 7.2-rc1 BPF JIT bugs.c allocation of resources (EUVD-2026-48851)

Sun, 26 Jul 2026 06:36:16 +0200

A vulnerability was found in Linux Kernel up to 6.6.144/6.12.96/6.18.38/7.1.3/7.2-rc1. It has been rated as problematic. This issue affects some unknown processing of the file bugs.c of the component BPF JIT. This manipulation causes allocation of resources. The identification of this vulnerability is CVE-2026-64507. The attack can only be executed locally. There is no exploit available. Upgrading the affected component is advised.

CVE-2026-64505 | Linux Kernel up to 7.2-rc2 Rndis rndis_rm_hdr out-of-bounds (EUVD-2026-48849)

Sun, 26 Jul 2026 06:36:15 +0200

A vulnerability has been found in Linux Kernel up to 7.2-rc2 and classified as very critical. This vulnerability affects the function rndis_rm_hdr of the component Rndis. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-64505. An attack has to be approached locally. There is no exploit available. The affected component should be upgraded.

CVE-2026-64503 | Linux Kernel up to 7.2-rc2 kxsd9 kxsd9_write_raw release of resource (EUVD-2026-48847)

Sun, 26 Jul 2026 06:36:15 +0200

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 7.2-rc2. This affects the function kxsd9_write_raw of the component kxsd9. Executing a manipulation can lead to missing release of resource. This vulnerability appears as CVE-2026-64503. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

CVE-2026-64504 | Linux Kernel up to 7.2-rc2 BMC150 Accelerometer Driver __bmc150_accel_fifo_flush stack-based overflow (EUVD-2026-48848)

Sun, 26 Jul 2026 06:36:15 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been declared as very critical. This vulnerability affects the function __bmc150_accel_fifo_flush of the component BMC150 Accelerometer Driver. The manipulation results in stack-based buffer overflow. This vulnerability was named CVE-2026-64504. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

CVE-2026-64501 | Linux Kernel up to 6.18.38/7.1.3 iio adc ad_sigma_delta state issue (EUVD-2026-48845)

Sun, 26 Jul 2026 06:36:15 +0200

A vulnerability marked as very critical has been reported in Linux Kernel up to 6.18.38/7.1.3. Affected by this vulnerability is the function ad_sigma_delta_single_conversion/ad_sd_buffer_postenable of the component iio adc ad_sigma_delta. This manipulation causes state issue. This vulnerability is tracked as CVE-2026-64501. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

CVE-2026-64502 | Linux Kernel up to 6.18.38/7.1.3 Iio Adc Ad Sigma Delta ad_sigma_delta_clear_pending_event heap-based overflow (EUVD-2026-48846)

Sun, 26 Jul 2026 06:36:15 +0200

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 6.18.38/7.1.3. Affected by this issue is the function ad_sigma_delta_clear_pending_event of the component Iio Adc Ad Sigma Delta. Performing a manipulation results in heap-based buffer overflow. This vulnerability is reported as CVE-2026-64502. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

CVE-2026-64499 | Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc2 ADC ads1119_triggered_buffer_preenable release of resource (EUVD-2026-48843)

Sun, 26 Jul 2026 06:36:14 +0200

A vulnerability classified as problematic was found in Linux Kernel up to 6.12.95/6.18.38/7.1.3/7.2-rc2. Affected by this vulnerability is the function ads1119_triggered_buffer_preenable of the component ADC. Such manipulation leads to missing release of resource. This vulnerability is documented as CVE-2026-64499. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

CVE-2026-64500 | Linux Kernel up to 7.2-rc2 Lpc32xx Adc lpc32xx_adc.c lpc32xx_adc_probe uninitialized pointer (EUVD-2026-48844)

Sun, 26 Jul 2026 06:36:14 +0200

A vulnerability was found in Linux Kernel up to 7.2-rc2. It has been classified as critical. This affects the function lpc32xx_adc_probe of the file drivers/iio/adc/lpc32xx_adc.c of the component Lpc32xx Adc. The manipulation leads to uninitialized pointer. This vulnerability is uniquely identified as CVE-2026-64500. Local access is required to approach this attack. No exploit exists. Upgrading the affected component is recommended.

CVE-2026-64498 | Linux Kernel up to 7.1.3 hw-consumer iio_hw_buf_release use after free (EUVD-2026-48842)

Sun, 26 Jul 2026 06:36:14 +0200

A vulnerability was found in Linux Kernel up to 7.1.3 and classified as very critical. Affected by this issue is the function iio_hw_buf_release of the component hw-consumer. Executing a manipulation can lead to use after free. This vulnerability is handled as CVE-2026-64498. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

CVE-2026-64497 | Linux Kernel up to 7.1.3 scd30 linux/bitfield.h FIELD_GET integer overflow (EUVD-2026-48841)

Sun, 26 Jul 2026 06:36:14 +0200

A vulnerability classified as very critical was found in Linux Kernel up to 7.1.3. This affects the function FIELD_GET of the file linux/bitfield.h of the component scd30. The manipulation results in integer overflow. This vulnerability is reported as CVE-2026-64497. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

CVE-2026-64496 | Linux Kernel up to 7.2-rc2 IIO Event iio_event_getfd out-of-bounds (EUVD-2026-48840)

Sun, 26 Jul 2026 06:36:14 +0200

A vulnerability classified as critical has been found in Linux Kernel up to 7.2-rc2. The impacted element is the function iio_event_getfd of the component IIO Event. The manipulation leads to out-of-bounds read. This vulnerability is documented as CVE-2026-64496. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

CVE-2026-34442 | freescout-help-desk freescout up to 1.8.210 Host Header redirect (GHSA-822g-7rw5-53xj)

Sun, 26 Jul 2026 06:36:13 +0200

A vulnerability labeled as problematic has been found in freescout-help-desk freescout up to 1.8.210. Impacted is an unknown function of the component Host Header Handler. The manipulation results in open redirect. This vulnerability is identified as CVE-2026-34442. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

CVE-2026-34448 | SiYuan up to 3.6.1 mAsse cross site scripting (ID 17246)

Sun, 26 Jul 2026 06:36:13 +0200

A vulnerability was found in SiYuan up to 3.6.1 and classified as problematic. This affects an unknown function. The manipulation of the argument mAsse results in cross site scripting. This vulnerability is reported as CVE-2026-34448. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

CVE-2026-34451 | Anthropic anthropic-sdk-typescript up to 0.80.x Claude API path traversal (GHSA-5474-4w2j-mq4c)

Sun, 26 Jul 2026 06:36:13 +0200

A vulnerability has been found in Anthropic anthropic-sdk-typescript up to 0.80.x and classified as critical. The impacted element is an unknown function of the component Claude API. The manipulation leads to path traversal. This vulnerability is documented as CVE-2026-34451. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

CVE-2026-34404 | nuxt-modules og-image up to 6.2.4 /_og/d/ width/height resource consumption (GHSA-c7xp-q6q8-hg76)

Sun, 26 Jul 2026 06:36:13 +0200

A vulnerability, which was classified as problematic, has been found in nuxt-modules og-image up to 6.2.4. Impacted is an unknown function of the file /_og/d/. Performing a manipulation of the argument width/height results in resource consumption. This vulnerability is cataloged as CVE-2026-34404. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

CVE-2026-34405 | nuxt-modules og-image up to 6.2.4 /_og/d/ cross site scripting (GHSA-mg36-wvcr-m75h)

Sun, 26 Jul 2026 06:36:12 +0200

A vulnerability marked as problematic has been reported in nuxt-modules og-image up to 6.2.4. Affected by this issue is some unknown functionality of the file /_og/d/. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-34405. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

CVE-2026-34450 | Anthropic anthropic-sdk-python up to 0.86.x Claude API default permission (GHSA-q5f5-3gjm-7mfm)

Sun, 26 Jul 2026 06:36:12 +0200

A vulnerability was found in Anthropic anthropic-sdk-python up to 0.86.x. It has been declared as critical. This issue affects some unknown processing of the component Claude API. Executing a manipulation can lead to incorrect default permissions. This vulnerability is handled as CVE-2026-34450. It is possible to launch the attack on the local host. There is not any exploit available. It is recommended to upgrade the affected component.

CVE-2026-34453 | SiYuan up to 3.6.1 Publish Service authorization (ID 17246)

Sun, 26 Jul 2026 06:36:12 +0200

A vulnerability was found in SiYuan up to 3.6.1. It has been rated as problematic. This affects an unknown function of the component Publish Service. This manipulation causes incorrect authorization. This vulnerability is handled as CVE-2026-34453. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

CVE-2026-34452 | Anthropic anthropic-sdk-python up to 0.86.x Claude API link following (GHSA-w828-4qhx-vxx3)

Sun, 26 Jul 2026 06:36:12 +0200

A vulnerability, which was classified as critical, was found in Anthropic anthropic-sdk-python up to 0.86.x. Affected by this vulnerability is an unknown functionality of the component Claude API. The manipulation results in link following. This vulnerability is reported as CVE-2026-34452. The attack requires a local approach. No exploit exists. You should upgrade the affected component.

CVE-2026-34449 | SiYuan up to 3.6.1 cross-domain policy (ID 17246)

Sun, 26 Jul 2026 06:36:11 +0200

A vulnerability has been found in SiYuan up to 3.6.1 and classified as critical. Affected by this issue is some unknown functionality. This manipulation causes permissive cross-domain policy with untrusted domains. This vulnerability appears as CVE-2026-34449. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

CVE-2026-34406 | APTRS up to 2.0.0 /api/auth/edituser/ edit_user dynamically-determined object attributes (GHSA-gv25-wp4h-9c35)

Sun, 26 Jul 2026 06:36:11 +0200

A vulnerability identified as critical has been detected in APTRS up to 2.0.0. This issue affects the function edit_user of the file /api/auth/edituser/. The manipulation leads to dynamically-determined object attributes. This vulnerability is referenced as CVE-2026-34406. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

CVE-2026-34443 | freescout-help-desk freescout up to 1.8.210 app/Misc/Helper.php checkIpByMask server-side request forgery (GHSA-c9v3-4c59-x5q2)

Sun, 26 Jul 2026 06:36:11 +0200

A vulnerability categorized as critical has been discovered in freescout-help-desk freescout up to 1.8.210. This vulnerability affects the function checkIpByMask of the file app/Misc/Helper.php. Executing a manipulation can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-34443. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

CVE-2026-34792 | Endian Firewall 3.3.25 Regular Expression /cgi-bin/logs_clamav.cgi open Date os command injection

Sun, 26 Jul 2026 06:36:11 +0200

A vulnerability was found in Endian Firewall 3.3.25. It has been classified as critical. This impacts the function Open of the file /cgi-bin/logs_clamav.cgi of the component Regular Expression Handler. Performing a manipulation of the argument Date results in os command injection. This vulnerability is identified as CVE-2026-34792. The attack can be initiated remotely. There is not any exploit available.

CVE-2026-34801 | Endian Firewall 3.3.25 Parameter fixed_leases remark cross site scripting

Sun, 26 Jul 2026 06:36:11 +0200

A vulnerability was found in Endian Firewall 3.3.25 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /manage/dhcp/fixed_leases/ of the component Parameter Handler. Executing a manipulation of the argument remark can lead to cross site scripting. The identification of this vulnerability is CVE-2026-34801. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

CVE-2026-34797 | Endian Firewall 3.3.25 Regular Expression /cgi-bin/logs_smtp.cgi open Date os command injection

Sun, 26 Jul 2026 06:36:10 +0200

A vulnerability has been found in Endian Firewall 3.3.25 and classified as critical. Affected is the function Open of the file /cgi-bin/logs_smtp.cgi of the component Regular Expression Handler. Performing a manipulation of the argument Date results in os command injection. This vulnerability was named CVE-2026-34797. The attack may be initiated remotely. There is no available exploit.

CVE-2026-34797 | Endian Firewall 3.3.25 Regular Expression /cgi-bin/logs_smtp.cgi open Date os command injection

Sun, 26 Jul 2026 06:36:10 +0200

CVE-2026-34793 | Endian Firewall 3.3.25 Regular Expression logs_firewall.cgi open Date os command injection

Sun, 26 Jul 2026 06:36:10 +0200

A vulnerability, which was classified as critical, was found in Endian Firewall 3.3.25. This impacts the function Open of the file /cgi-bin/logs_firewall.cgi of the component Regular Expression Handler. Such manipulation of the argument Date leads to os command injection. This vulnerability is uniquely identified as CVE-2026-34793. The attack can be launched remotely. No exploit exists.

CVE-2026-34795 | Endian Firewall 3.3.25 Regular Expression /cgi-bin/logs_log.cgi open Date os command injection

Sun, 26 Jul 2026 06:36:10 +0200

A vulnerability, which was classified as critical, has been found in Endian Firewall 3.3.25. This affects the function Open of the file /cgi-bin/logs_log.cgi of the component Regular Expression Handler. This manipulation of the argument Date causes os command injection. This vulnerability is handled as CVE-2026-34795. The attack can be initiated remotely. There is not any exploit available.

CVE-2026-34794 | Endian Firewall 3.3.25 Regular Expression /cgi-bin/logs_ids.cgi open Date os command injection