Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.
A security vulnerability has been identified in michaelrsweet mxml version 4.0.5 and several other specific versions. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity level. It requires network access with low attack complexity and privileges, and user interaction is needed. The impact includes limited confidentiality, integrity, and availability losses. No public exploit or known active exploitation has been reported. The affected versions include multiple specific builds from 2.7-1 through 4.0.4-6.
A medium severity vulnerability (CVE-2026-112077) was detected in radareorg radare2 affecting multiple versions including 0.9.6-3.1ubuntu1 through 6.1.8+ds-1. The CVSS 3.1 score is 5.6, indicating a network attack vector with high attack complexity and no privileges or user interaction required. The impact includes low confidentiality, integrity, and availability impacts. No public exploits or known active exploitation have been reported. The vulnerability affects various Ubuntu package versions of radare2.
A medium severity vulnerability (CVE-2026-112036) was detected in Artifex MuPDF up to version 1.28.5. The flaw impacts availability but does not affect confidentiality or integrity. No public exploits or active exploitation in the wild are known. The vulnerability was published on October 23, 2026.
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-112034 is an open redirect vulnerability in aircheng-org iWebShop-5 versions 5.0 through 5.16. The issue exists in the IController::redirect function within the plugins/_userInfo/_userInfo.php file, where manipulation of the callback argument allows an attacker to redirect users to arbitrary external URLs. The vulnerability can be exploited remotely and requires user interaction. Public exploit code is available, but the vendor has not yet responded or issued a fix.
CVE-2026-112033 is a cross-site request forgery (CSRF) vulnerability in aircheng-org iWebShop-5 versions 5.0 through 5.16. The flaw exists in the password change functions admin_repwd and admin_repwd_act within controllers/system.php. An attacker can remotely exploit this vulnerability by manipulating the password and repassword parameters. Public exploit code is available, but the vendor has not yet responded or issued a fix.
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability in the Linux kernel's mac80211 wireless subsystem allows oversized IEEE 802.11 fragments to cause an integer overflow in the fragment payload length accumulator. This overflow leads to insufficient buffer allocation and ultimately triggers a kernel crash in softirq context when processing fragmented frames. The issue arises because the fragment length sum is stored in a 16-bit unsigned integer, which can overflow when large fragments are received. The flaw has been fixed by adding a check to drop frames that would cause overflow without increasing memory footprint.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel_pcie) involving an integer overflow in the plen calculation has been resolved. The plen variable, originally a 16-bit unsigned integer, could overflow when adding HDR_SIZE and dlen, allowing packet truncation checks to be bypassed. This issue was fixed by widening plen to a 32-bit unsigned integer to prevent overflow.
CVE-2026-98865 is a vulnerability in the Linux kernel's sched_ext component where ops.dequeue() is called while holding a DSQ lock, leading to potential self-deadlocks in BPF schedulers. The issue arises because ops.dequeue() is invoked with the source user DSQ's lock still held on certain paths, causing recursion lock dependency checks to fail. The flaw has been addressed by moving the ops.dequeue() call after the DSQ unlock on all affected paths, ensuring the callback is invoked exactly once.
CVE-2026-98864 is a medium severity vulnerability in the Linux kernel scheduler extension (sched_ext) where a task can be re-enqueued prematurely due to improper waiting for the SCX_OPSS_DISPATCHING state to clear. This flaw could cause the dispatcher's final state update to overwrite the queued state, resulting in dropped dispatches of the task. The issue affects multiple specific Linux kernel versions, including various 4.15.x, 5.0.x, and 5.3.x builds. The vulnerability has been addressed by ensuring the scheduler waits for SCX_OPSS_DISPATCHING to clear before re-enqueueing tasks, aligning with the behavior in ops_dequeue().
A use-after-free vulnerability exists in the Linux kernel's HID winwing driver related to force feedback teardown. The issue arises because the driver's private data, allocated with devm_kzalloc(), is incorrectly freed twice: once by the force-feedback core and again by the device resource management, causing memory corruption. This can occur during device unbind, module removal, hot-unplug, or system suspend operations.
A vulnerability in the Linux kernel firewire cdev subsystem caused an incorrect state transition in the iso_resource_auto client resource. Concurrent access could cause the state to revert backwards, potentially leading to inconsistent resource management. This issue has been fixed by adding checks to prevent the back-transition.
CVE-2026-98557 is a medium severity vulnerability in the Linux kernel's gve driver related to incorrect header length calculation for UDP Generic Segmentation Offload (GSO) packets. The function gve_can_send_tso() incorrectly uses TCP header length for UDP packets, causing miscalculation of segment boundaries. This can lead to either unnecessary disabling of GSO or handing the device packets that exceed buffer limits. The issue affects specific Linux kernel versions and has been resolved by correctly using the UDP header length for SKB_GSO_UDP_L4 packets.
A vulnerability in the Linux kernel's fprobe feature causes improper termination of the fgraph_data list when a reservation is not filled. This can lead to an exit handler running twice or running despite being skipped by its entry handler. The issue arises because reserved shadow stack space is not cleared, causing fprobe_return() to misinterpret unused data. The fix involves writing a zero word after the last entry to properly terminate the list and adjusting the header decoding to handle zeroed slots correctly.
CVE-2026-98500 is a medium severity vulnerability in the Linux kernel's HID subsystem (hid-oxp driver). The issue arises because the remove function uses cancel_delayed_work() which only dequeues pending work without waiting for ongoing callbacks to finish. This can lead to concurrent access to a HID device after it has been closed and stopped, potentially causing undefined behavior. The fix involves using cancel_delayed_work_sync() to ensure any in-progress work completes before device teardown.
CVE-2026-98859 is a vulnerability in the Linux kernel's HID multitouch driver where the release timer can be rearmed after it has been deleted during device removal. This leads to a use-after-free condition when the timer callback dereferences freed memory. The issue arises because timer_delete_sync() does not prevent the timer from being rearmed by incoming reports, causing a timer callback to access freed data. The fix involves using timer_shutdown_sync() to ensure the timer cannot be rearmed after deletion, preventing the use-after-free.
A use-after-free vulnerability in the Linux kernel's io_uring subsystem with SQPOLL mode has been fixed. The issue occurs when the sqpoll thread frees the ring context while another function still accesses it, leading to a kernel slab use-after-free error detected by KASAN. The fix involves holding an RCU read lock during the add operation and waiting for a grace period before freeing the context.
A vulnerability in the Linux kernel's IP Virtual Server (ipvs) component related to unbounded growth of LBLCR and LBLC cache entries has been resolved. The functions ip_vs_lblcr_new() and ip_vs_lblc_new() previously created cache entries for every new destination address without effectively limiting cache size, allowing potential resource exhaustion. The fix introduces a rejection of new cache entries once the cache size reaches 1.5 times the configured max_size, preventing uncontrolled growth while maintaining serviceability.