MailEnable Enterprise Premium versions 10.55 and earlier have an improper authorization vulnerability in the WebAdmin mobile portal. This flaw allows attackers to bypass authentication by reusing AuthenticationToken cookies originally issued to low-privileged users. By obtaining a token from the WebMail login endpoint using the PersistentLogin parameter, attackers can replay it against the WebAdmin portal to perform administrative actions with high privileges.
A vulnerability in fohrloop dash-uploader versions 0.1.0 through 0.7.0a2 allows remote attackers to cause a denial of service by triggering an issue in the Upload function related to the max_file_size parameter. This affects components dash_uploader/httprequesthandler.py, dash_uploader/upload.py, and dash_uploader/configure_upload.py.
lwjson version 1.8.1 has an improper input validation vulnerability in its streaming JSON parser. The flaw lies in the end-of-string detection logic, which incorrectly handles escaped quote characters by only checking the immediately preceding character instead of counting consecutive backslashes. This causes valid JSON strings ending with an escaped backslash to never terminate parsing. A remote attacker can exploit this by sending crafted JSON to cause the parser to hang indefinitely, resulting in a denial of service condition.
Beauty Parlour Management System version 1.1 contains a critical SQL injection vulnerability in the aptnumber parameter of the /appointment-detail.php endpoint. This flaw allows unauthenticated attackers to execute crafted SQL queries, potentially exposing sensitive database information and impacting confidentiality, integrity, and availability.
Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.
A stack buffer overflow vulnerability exists in kosma minmea version 0.3.0 due to the minmea_scan functions copying NMEA field data into a caller-provided buffer without size checks. This flaw allows an attacker to cause a denial of service by crashing the application using minmea_scan with crafted untrusted input.
LINQPad Pro editions before version 5.52.01 contain an unsafe deserialization vulnerability in the LINQPad.AutoRefManager::PopulateFromCache() method. This flaw allows an attacker with local access and limited privileges to execute arbitrary code. The vulnerability has a CVSS score of 7.3, indicating high severity. Public exploit code is available via Metasploit, but there are no confirmed reports of exploitation in the wild. No official patch links are provided in the data.
NAVER MYBOX Explorer for Windows versions before 3.0.11.160 contain a local privilege escalation vulnerability. This flaw allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by manipulating the Windows registry due to improper privilege checks. The vulnerability has a high severity rating with a CVSS score of 7.8. No patch or fixed version is explicitly stated in the provided data.
In the Linux kernel, the following vulnerability has been resolved:
RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port
The function ionic_query_port() calls ib_device_get_netdev() without
checking the return value which could lead to NULL pointer dereference,
Fix it by checking the return value and return -ENODEV if the 'ndev' is
NULL.
In the Linux kernel, the following vulnerability has been resolved:
phy: fsl-imx8mq-usb: set platform driver data
Add missing platform_set_drvdata() as the data will be used in remove().
CVE-2026-43260 is a vulnerability in the Linux kernel's bnxt_en driver related to improper handling of RSS context deletion. The issue arises from a condition that prevents freeing the corresponding RSS context VNIC in firmware when the network interface is down, causing resource leaks and potential failures in restoring RSS contexts on interface reopen. This can lead to loss of active RSS contexts and impact system network functionality.
In the Linux kernel, the following vulnerability has been resolved:
EFI/CPER: don't go past the ARM processor CPER record buffer
There's a logic inside GHES/CPER to detect if the section_length
is too small, but it doesn't detect if it is too big.
Currently, if the firmware receives an ARM processor CPER record
stating that a section length is big, kernel will blindly trust
section_length, producing a very long dump. For instance, a 67
bytes record with ERR_INFO_NUM set 46198 and section length
set to 854918320 would dump a lot of data going a way past the
firmware memory-mapped area.
Fix it by adding a logic to prevent it to go past the buffer
if ERR_INFO_NUM is too big, making it report instead:
[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
[Hardware Error]: event severity: recoverable
[Hardware Error]: Error 0, type: recoverable
[Hardware Error]: section_type: ARM processor error
[Hardware Error]: MIDR: 0xff304b2f8476870a
[Hardware Error]: section length: 854918320, CPER size: 67
[Hardware Error]: section length is too big
[Hardware Error]: firmware-generated error record is incorrect
[Hardware Error]: ERR_INFO_NUM is 46198
[ rjw: Subject and changelog tweaks ]
In the Linux kernel, the following vulnerability has been resolved:
arm64: Add support for TSV110 Spectre-BHB mitigation
The TSV110 processor is vulnerable to the Spectre-BHB (Branch History
Buffer) attack, which can be exploited to leak information through
branch prediction side channels. This commit adds the MIDR of TSV110
to the list for software mitigation.
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
Ignore -EBUSY when checking nested events after exiting a blocking state
while L2 is active, as exiting to userspace will generate a spurious
userspace exit, usually with KVM_EXIT_UNKNOWN, and likely lead to the VM's
demise. Continuing with the wakeup isn't perfect either, as *something*
has gone sideways if a vCPU is awakened in L2 with an injected event (or
worse, a nested run pending), but continuing on gives the VM a decent
chance of surviving without any major side effects.
As explained in the Fixes commits, it _should_ be impossible for a vCPU to
be put into a blocking state with an already-injected event (exception,
IRQ, or NMI). Unfortunately, userspace can stuff MP_STATE and/or injected
events, and thus put the vCPU into what should be an impossible state.
Don't bother trying to preserve the WARN, e.g. with an anti-syzkaller
Kconfig, as WARNs can (hopefully) be added in paths where _KVM_ would be
violating x86 architecture, e.g. by WARNing if KVM attempts to inject an
exception or interrupt while the vCPU isn't running.
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: fix potential zero beacon interval in beacon tracking
During fuzz testing, it was discovered that bss_conf->beacon_int
might be zero, which could result in a division by zero error in
subsequent calculations. Set a default value of 100 TU if the
interval is zero to ensure stability.
CVE-2026-43276 is a use-after-free vulnerability in the Linux kernel's mana network driver related to double destruction of a workqueue during PCI service rescan. The flaw occurs when mana_gd_cleanup() destroys an already freed workqueue due to improper NULL checks, leading to potential system crashes or denial of service.
In the Linux kernel, the following vulnerability has been resolved:
gfs2: fiemap page fault fix
In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode
glock. This can lead to recursive glock taking if the fiemap buffer is
memory mapped to the same inode and accessing it triggers a page fault.
Fix by disabling page faults for iomap_fiemap() and faulting in the
buffer by hand if necessary.
Fixes xfstest generic/742.
In the Linux kernel, the following vulnerability has been resolved:
media: radio-keene: fix memory leak in error path
Fix a memory leak in usb_keene_probe(). The v4l2 control handler is
initialized and controls are added, but if v4l2_device_register() or
video_register_device() fails afterward, the handler was never freed,
leaking memory.
Add v4l2_ctrl_handler_free() call in the err_v4l2 error path to ensure
the control handler is properly freed for all error paths after it is
initialized.
In the Linux kernel, the following vulnerability has been resolved:
media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
In mtk_mdp_probe(), vpu_get_plat_device() increases the reference
count of the returned platform device. Add platform_device_put()
to prevent reference leak.