OpenPanel analytics platform contains a server-side request forgery (SSRF) vulnerability in its data importer component. The importer fetches a caller-supplied URL using a plain fetch method without applying the existing SSRF guard. Authenticated organization members can cause the server to connect to arbitrary internal or external addresses. The HTTP response status and text are stored and returned to the user, enabling internal network scanning. Additionally, if the internal response is in a specific CSV format, it can be ingested as analytics events visible to the attacker. No patched version is available at the time of publication.
A vulnerability in rpm allows a local attacker to supply a specially crafted .gem filename containing RPM macro syntax. When the rpmuncompress -x command is run on this file, macro expansion occurs during command construction, enabling arbitrary command execution with the invoking user's privileges. This can compromise confidentiality, integrity, and availability. A security update from Red Hat addresses this issue in Red Hat Hardened Images RPMs.
CVE-2026-32791 is an untrusted search path vulnerability in Intel(R) Performance Counter Monitor (Intel(R) PCM) versions before tag 202604. This vulnerability allows a local unprivileged user with authenticated access to potentially escalate privileges by exploiting the way the software searches for resources. The attack requires high complexity and passive user interaction, with no special internal knowledge needed. The vulnerability impacts confidentiality, integrity, and availability at a high level according to CVSS, but the description notes no subsequent system-level impacts. No patch information is currently available.
CVE-2026-34175 is a vulnerability in Hardware-Aware-Automated-MachineLearning NA before version 45cd723 involving an uncontrolled search path within Ring 3 user applications. This flaw may allow an escalation of privilege by an unprivileged software adversary with a privileged user, requiring only local access and passive user interaction. The vulnerability impacts confidentiality, integrity, and availability at a high level. No specific affected versions are stated, and no patch information is provided.
CVE-2026-32788 describes an uncontrolled search path vulnerability in an Approximate Bayesian Inference Framework before a specific commit (#484c949) within Ring 3: User Applications. This vulnerability may allow an unprivileged adversary, with some privileged user access and low attack complexity, to escalate privileges locally without requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability at a high level according to the CVSS assessment. No specific affected versions or patch information is provided.
A protection mechanism failure exists in some Intel(R) Workload Services Framework software running in Ring 3 (user applications), which may allow an escalation of privilege. The vulnerability requires local access with a privileged user context and low complexity attack without special internal knowledge or user interaction. It impacts confidentiality, integrity, and availability at a high level, but does not lead to further system-wide impacts. The CVSS score is 6.7, indicating a medium severity.
Hono versions before 4.10.3 have a vulnerability in their CORS middleware where the Vary header from incoming requests is copied into responses. This can allow attackers to inject arbitrary Vary header values, potentially causing cache key pollution and inconsistent CORS enforcement in shared cache or proxy environments. The issue is fixed in version 4.10.3.
A critical stack-based buffer overflow vulnerability exists in the formDOMAINBLK function of the /boaform/formDOMAINBLK file in Tenda HG7HG9 and HG10 300001138_en_xpon devices. This vulnerability can be exploited remotely by manipulating the blkDomain argument, potentially leading to complete compromise of confidentiality, integrity, and availability.
A vulnerability in the Hono CORS middleware allowed attacker-controlled Vary headers from requests to be reflected in responses, potentially affecting cache behavior and causing inconsistent CORS enforcement. This issue impacts versions prior to 4.10.3. The vulnerability does not directly compromise confidentiality, integrity, or availability under default configurations but may lead to cache key pollution in environments using shared caches or proxies. A patch is available that corrects the middleware to manage the Vary header exclusively as a response header.
A missing authorization vulnerability in Maidul Team Manager allows attackers to exploit incorrectly configured access control security levels. This vulnerability affects versions up to 2.3.14 and can lead to unauthorized modification of data without requiring user interaction or privileges. The issue has a medium severity rating with a CVSS score of 5.3.
A missing authorization vulnerability exists in the Dimitri Grassi Salon booking system, allowing exploitation of incorrectly configured access control security levels. This affects versions up to 10.10.7. The vulnerability has a medium severity with a CVSS score of 5.4, indicating limited impact on confidentiality but potential impact on integrity and availability.
A security update for the SUSE Linux Enterprise 15 SP5 RT kernel addresses multiple security vulnerabilities across various kernel components including DRM, ALSA, networking, SCSI, and others. These fixes resolve issues such as use-after-free, race conditions, memory leaks, and out-of-bound accesses. The update also includes non-security bug fixes improving system stability and performance.
A vulnerability in the Linux kernel's USB Type-C UCSI driver related to read size limits on UCSI version 1.2 has been resolved. The MESSAGE_IN region size increased from 16 to 256 bytes between UCSI 1.2 and 2.0, and this fix adds a mechanism to truncate read sizes appropriately on UCSI v1.2 to prevent overflow. This issue affects multiple Linux kernel versions used in the linux-hwe-edge product line. The vulnerability has a CVSS score of 7.1 and is rated medium severity. A patch is available and should be applied to mitigate the risk.
A vulnerability in the Linux kernel's crypto: iaa component caused a descriptor leak in the async_disable paths of iaa_compress/decompress() when req->dst is null. This issue has been fixed in updated kernel versions. The flaw could lead to resource leakage but does not impact confidentiality or integrity. The vulnerability has a medium severity score and requires a system reboot after patching.
A vulnerability in the Linux kernel's drm/amdgpu driver was resolved that caused system hangs due to repeated PCI error slot resets during RAS recovery. The issue occurred when a PCI error slot reset was triggered multiple times after injecting uncorrectable errors (UE) in the UMC, leading to GPU resets and system instability. The flaw was fixed by skipping redundant PCI error slot resets during RAS fatal error handling. This vulnerability affects specific linux-aws kernel versions and has a CVSS score of 7.8.
A use-after-free vulnerability in the Linux kernel's drm/vc4 driver was resolved. The issue arises from improper reference count handling due to inconsistent checks of plane state framebuffer pointers during non-blocking commits, leading to potential kernel warnings and memory corruption. This flaw was fixed by correcting the logic to avoid direct access to drm_plane state and ensuring proper reference count management.
A vulnerability in the Linux kernel's wifi cfg80211 subsystem was fixed by improving checks on the A-MSDU frame format to prevent out-of-bounds reads. This flaw could cause the kernel to read beyond buffer boundaries if a subframe header was incomplete. The issue has been addressed in updated Linux kernel versions.
A vulnerability in the Linux kernel's dma-direct subsystem could cause leaked pages on dma_set_decrypted() failure, particularly on TDX platforms where untrusted hosts may cause set_memory_encrypted() or set_memory_decrypted() to fail. This failure can result in decrypted shared memory being incorrectly returned to the page allocator, potentially leading to security issues. The issue has been resolved in updated Linux kernel versions.
A vulnerability in the Linux kernel for Azure CoCo systems involves the RNG seeding process relying solely on the CPU's RDRAND instruction. Because the CoCo threat model assumes an untrusted VM host that can manipulate inputs, RDRAND is the only entropy source at boot. If RDRAND is broken or unavailable, the RNG seeding fails, causing the system to panic to prevent insecure operation. This issue affects certain Linux Azure kernel versions and has been addressed by requiring RDRAND seeding at boot time.