CVE-2026-120339 is a cross-site scripting (XSS) vulnerability in the mathurvishal CloudClassroom-PHP-Project. The flaw exists in the updatedetailsfromfaculty.php file, where manipulation of the fname argument can lead to XSS attacks. The vulnerability can be exploited remotely and public exploit code is available. The product uses a rolling release model, so specific affected versions are not identified. The vendor has not responded to the disclosure. The CVSS 4.0 score is 5.3, indicating a medium severity risk.
.NET 9.0 on Red Hat Enterprise Linux contains an elevation of privilege vulnerability in ASP.NET Core identified as CVE-2026-114148. This security issue affects multiple .NET versions including 8.0, 9.0, 10.0, and 11.0. Red Hat has released security updates for these versions as part of their Extended Update Support for RHEL 10.0. The vulnerability allows an attacker to gain elevated privileges, potentially compromising system security.
Multiple security vulnerabilities have been identified in nginx, a widely used web and proxy server. These include code execution, denial of service, heap-based buffer overflow, heap buffer over-read, and memory disclosure issues affecting various nginx modules such as ngx_http_rewrite_module, HTTP/2 header processing, and ngx_http_slice_module. Red Hat has released security updates addressing these vulnerabilities in Red Hat Enterprise Linux 9.2 and related products.
.NET 8.0 on Red Hat Enterprise Linux contains security vulnerabilities including an out-of-bounds write in the Google Brotli decoder (CVE-2026-111497) and an elevation of privilege vulnerability in ASP.NET Core (CVE-2026-114148). These issues have been addressed in updated SDK and runtime packages. The update is rated as Important by Red Hat Product Security.
A denial of service vulnerability (CVE-2026-94286) exists in the X.Org X11 libXtst runtime library due to an out-of-bounds read in the RECORD reply parser. This issue affects Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. Red Hat has issued a security advisory with an update to address this vulnerability.
Multiple heap buffer overflow vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME. These vulnerabilities arise from WebSocket handling issues including Pong signal type confusion, message reassembly, receive-buffer growth, and client-frame masking. Red Hat has issued security updates addressing these flaws in Red Hat Enterprise Linux 8.8 variants.
Multiple security vulnerabilities have been identified and fixed in the libxml2 library used in Red Hat Enterprise Linux 8.8. These include denial of service via use-after-free, arbitrary code execution through various buffer overflows, data integrity issues from integer overflow, information disclosure, SSRF, and double-free/use-after-free in Python bindings. The update addresses these issues with security patches and bug fixes.
A vulnerability in ip_stack allows an out of bounds read due to improper input validation. This flaw can be exploited remotely without user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation could result in a denial of service condition.
A vulnerability in the Modem component allows an out of bounds read due to an integer overflow. This flaw can be exploited remotely by an attacker controlling a rogue base station to cause a denial of service on a user equipment (UE) device without requiring user interaction or additional privileges.
A logic error in the modem application can cause it to crash, potentially leading to a remote denial of service (DoS). Exploitation requires no user interaction and can occur if a user equipment (UE) connects to a rogue base station controlled by an attacker.
An integer overflow vulnerability exists in the modem component that could allow a remote denial of service (DoS) attack. Exploitation requires no user interaction and can occur if a user equipment (UE) connects to a rogue base station controlled by an attacker. No additional execution privileges are needed for the attack.
A vulnerability in the Modem component allows a possible escalation of privilege due to a permissions bypass. This issue could enable local privilege escalation if an attacker already has System-level privileges. Exploitation does not require user interaction. A patch is referenced by IDs ALPS09608864 and ALPS09327759.
A vulnerability in the modem component allows an out of bounds read due to improper input validation. This flaw can be exploited remotely without user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker. The exploitation could result in a denial of service condition.
CVE-2026-20591 is a vulnerability in GPU pdma involving a missing permission check that allows local escalation of privilege without requiring additional execution privileges or user interaction.
A vulnerability in the Modem component allows a possible out-of-bounds write due to a missing bounds check. This flaw could enable local escalation of privilege if an attacker already has System privileges. Exploitation does not require user interaction. No affected versions or patch information are provided.
A vulnerability in the modem component allows an out of bounds read due to a missing bounds check. This flaw can be exploited remotely by an attacker controlling a rogue base station to cause a denial of service on the user equipment (UE) without requiring user interaction or additional privileges.
A vulnerability in the Modem component allows for possible local escalation of privilege due to a missing permission check. Exploitation does not require user interaction but requires the attacker to have already obtained System privilege.