2026

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 leak the exact system v

Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via t

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reacha

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory al

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculate_datafr

Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashes) an

Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as J

Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration for AES

Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scri

Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible endpoints that allow unauthenticated

Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These key

Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Corte

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Corte

An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a Customer record and

An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScript in the item_name,

Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configura

Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file

In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MSS So

In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etr: Fix race condition between sysf

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: do WoW offloads only on primary link

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in power_

In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: Fix NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: PCI/P2PDMA: Fix p2pmem_alloc_mmap() warning conditi

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers and work before freein

In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incom

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQ_MEM_RECLAIM warning When sunrpc i

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Fix sysfs initialization In case of dev

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds stream encoder i

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr

In the Linux kernel, the following vulnerability has been resolved: spi: wpcm-fiu: Fix potential NULL pointer dereferen

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access in fib6_add_rt2node()

In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading rea

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: Avoid NULL dereference in linehandle_cr

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sp804: Fix an Oops when r

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: prevent direct reclaim recursion into

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: don't explicitly disable clock

In the Linux kernel, the following vulnerability has been resolved: AppArmor: Allow apparmor to handle unaligned dfa ta

In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow in persistent_ram_s

In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix locking in regulator_resolve_s

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree dirty_list corruption

In the Linux kernel, the following vulnerability has been resolved: MIPS: Work around LLVM bug when gp is used as globa

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Fix PF driver crash with kexec kernel

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: clear stale link mapping of ahvif->li

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gfx3d: add parent to parent request map

In the Linux kernel, the following vulnerability has been resolved: power: supply: pm8916_lbc: Fix use-after-free for e

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NULL handling in HPD i

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync