CVE-2026-118571 is a vulnerability in the Drupal Media Alias Display module that involves the use of web browser cache containing sensitive information due to incorrectly configured access control security levels. This affects versions from 0.0.0 up to but not including 2.1.3, and from 3.0.0 up to but not including 3.0.3. Fixed versions are 2.1.3 and 3.0.3.
Brotli2Bitcoin is a purposely vulnerable web application exposed to the internet as a live hacking challenge with a $1,000 bitcoin bounty for achieving remote code execution (RCE). The challenge is streamed live, showing all attack attempts in real time. The scope is limited strictly to brotli2bitcoin.com, with authorized testing and rules to prevent denial of service or attacks outside the target. The first verified RCE that runs a specific command and reports the flag wins the bitcoin prize. This is a controlled security research exercise rather than an active threat or vulnerability disclosure.
CVE-2026-74915 is a vulnerability in Imagination Technologies Graphics DDK involving an out-of-range pointer offset (CWE-823). A specially crafted web page with unusual WebGPU content can cause an out-of-bounds read or write crash in the GPU GLES user-space shared library. On platforms where the graphics workload process has system privileges, this vulnerability could potentially enable further exploitation on the device.
CVE-2026-74912 is a vulnerability in Imagination Technologies Graphics DDK involving an out-of-range pointer offset due to integer truncation when mapping GPU buffer pages within the 0GB to 4GB range. This issue arises on GPU systems where the fix for CVE-2026-49746 is applied, limiting the mapping range of graphics buffers and causing errors that restrict kernel mode driver functionality.
CVE-2026-19199 is an integer overflow vulnerability in the Imagination Technologies Graphics DDK kernel mode driver. The flaw occurs during page-to-byte conversion of an allocation size, causing an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, potentially leading to disclosure of sensitive kernel data.
CVE-2026-18629 is an integer overflow vulnerability in Imagination Technologies Graphics DDK. It occurs when unusual GPU shader code causes arithmetic operations to overflow, leading to incorrect memory size calculations and memory allocation failures. If these failures are not handled properly, the GPU compiler process may dereference a NULL pointer, causing a crash. On some platforms where the compiler runs with system privileges, this crash could potentially be leveraged for further exploits.
CVE-2026-65587 is an out-of-bounds write vulnerability in Imagination Technologies Graphics DDK. It occurs when a web page with unusual WebGPU content is loaded into the GPU GLES render process, causing the GPU user-space driver to write data beyond the intended memory offset. This can lead to memory corruption and potentially crash the browser or GPU process.
CVE-2026-65586 is a use-after-free vulnerability in Imagination Technologies Graphics DDK. It involves improper GPU system calls by non-privileged software that can free memory still in use, allowing replacement of memory buffers and causing arbitrary memory reads or writes to physical memory pages. This occurs because a memory buffer managed by the CPU driver and accessed by GPU firmware can be freed while still in use, leading to unauthorized GPU access to memory not managed by the CPU driver.
php2shell comprises two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. Exploitation requires tailoring the attack to the specific PHP environment, making widespread mass exploitation difficult. However, network appliances running identical builds are vulnerable to a single calibrated exploit. Exploitation has been confirmed in the wild, including attacks on PAN-OS firewall management servers. Patching is available and strongly recommended, especially for internet-facing management interfaces and end-of-life PHP versions.
CVE-2026-65584 is a stack-based buffer overflow vulnerability in Imagination Technologies Graphics DDK. It arises from improper GPU system calls by non-privileged users, causing a stack overflow in the kernel when processing resolved Linux/Android fence synchronization checkpoints. This overflow leads to kernel memory corruption and typically results in a denial-of-service via a kernel crash. The flaw is due to copying excessive data beyond the allocated stack array from an internal buffer.
CVE-2026-118475 is an out-of-bounds read vulnerability in Eye of GNOME on Red Hat Enterprise Linux 7. It occurs when parsing a specially crafted PNG image with malformed color profile metadata, leading to reading beyond allocated buffer boundaries. This can cause the application to crash (Denial of Service) or potentially expose sensitive memory contents. Exploitation requires user interaction to open a malicious image in an interactive desktop session, limiting impact to the local user's permissions.
CVE-2026-112922 is a vulnerability in Ghostscript affecting Red Hat Enterprise Linux 10. It involves an out-of-bounds read triggered by processing specially crafted PDF or PostScript documents with malicious mesh shading data. Exploitation can cause application crashes leading to Denial of Service (DoS) or limited information disclosure. The vulnerability requires local user interaction to exploit and has a low severity rating. Currently, no mitigation or patch meeting Red Hat's criteria is available.
A security vulnerability (CVE-2026-8932) in libcurl, part of the curl packages provided by Red Hat, allows a security feature bypass due to improper mutual TLS (mTLS) connection reuse. This issue affects Red Hat Enterprise Linux 9 and related variants. The vulnerability has been rated as moderate in severity by Red Hat Product Security. An update addressing this issue is available in Red Hat Enterprise Linux 9.8 and Extended Update Support 9.8 packages.
CVE-2026-15466 is a use-after-free vulnerability in Imagination Technologies Graphics DDK. It arises from a race condition in the destruction path of hardware performance counters buffer, where improper GPU system calls by non-privileged users can cause the reference counter to be decremented non-atomically. This allows other code paths to access freed kernel heap memory, leading to potential read and/or write use-after-free conditions.
CVE-2026-91920 is a vulnerability in the ChunkReader component of the Undertow web server used by Red Hat build of Apache Camel for Spring Boot 4. The flaw arises from an incomplete bounds check on chunk sizes in HTTP chunked transfer encoding, allowing a crafted 15-digit chunk size to overflow internal state flags. This can cause premature termination of the request body and interpretation of remaining data as a separate smuggled HTTP request. Exploitation requires precise TCP segmentation control. The vulnerability is rated medium severity with a CVSS score of 6.5.
A vulnerability identified as CVE-2026-113724 affects version 3.0 of the Microsoft product virtualenv. The issue involves deletion recovery processes that can alter the mode (permissions) of a symlink target. No CVSS score or detailed impact information is provided.
A vulnerability identified as CVE-2026-97313 affects Microsoft software version 3.0, where specific Response Policy Zone (RPZ) configurations and query patterns may cause the software to exit unexpectedly. No CVSS score or detailed impact information is provided.
A vulnerability exists in Microsoft product version 3.0 where the Named service may terminate unexpectedly when a redirect zone is used with strict QNAME minimization enabled. This issue could cause service disruption due to unexpected termination.
A vulnerability identified as CVE-2026-94300 affects Microsoft software version 3.0, involving concurrent GSS-TSIG messages that can corrupt memory. This issue is categorized under CWE-415, which relates to double free or similar memory corruption errors. No CVSS score or detailed impact information is provided, and no patch or remediation details are available at this time.
CVE-2026-19630 is a vulnerability in Microsoft software version 3.0 involving amplified resource exhaustion during inbound message processing. The issue relates to inefficient handling of incoming messages that could lead to excessive consumption of system resources.