A vulnerability in all versions of PyTorch's TorchServe allows a local user to exploit a predictable extraction directory in /tmp. This flaw enables the attacker to swap the model handler and execute code with the privileges of the TorchServe service account, resulting in local privilege escalation.
Bar Assistant versions from 6.0.0-rc1 up to but not including 6.11.0 contain an authorization vulnerability in the CocktailController::copy function. This flaw allows registered users who own a bar to bypass membership checks and copy private cocktail recipes and images from other bars by sending a crafted POST request. The issue is fixed in version 6.11.0.
A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to exploit a kernel I/O control interface that improperly handles user-mode pointers. This flaw enables the attacker to gain kernel-mode read and write access, potentially leading to local privilege escalation and arbitrary kernel code execution.
A newline injection vulnerability exists in the UPnP service of Archer BE805 version 1. An adjacent attacker on the local network can supply newline characters in a UPnP port-mapping description due to improper input sanitization. This can result in injection of unintended content into UPnP port-mapping data, allowing modification of runtime UPnP port-mapping information and creation of spoofed entries. The vulnerability affects the integrity of UPnP mapping data but does not allow code execution or privilege escalation.
A pre-authentication heap-based buffer overflow vulnerability exists in the SonicOS TACACS+ authentication client. Under specific conditions, this flaw could allow a remote unauthenticated attacker to cause an application-level denial of service. The vulnerability does not impact confidentiality or integrity but affects availability.
A pre-authentication heap-based buffer overflow vulnerability exists in the SonicOS SSL-VPN service. This flaw allows a remote unauthenticated attacker to cause an application-level denial of service by triggering the overflow. No confidentiality or integrity impacts are reported. The vulnerability has a high severity score of 7.5. No known exploits or patches are currently documented.
An authentication bypass and missing brute-force protection vulnerability exists in the remote.php/webdav/ endpoint of ownCloud server version 10.16.3. This flaw allows an unauthenticated remote attacker to perform unlimited online password guessing attacks against WebDAV accounts by repeatedly sending HTTP Basic Authentication requests to the WebDAV interface.
A use-after-free (UAF) vulnerability in the xen-netback driver of the Linux kernel was fixed. The issue occurs when network statistic data, protected by RCU, is freed without proper synchronization during queue teardown after an error connecting to the frontend. This can lead to access of freed or reused memory if the data is read concurrently via sysfs. The fix involves calling synchronize_net() before freeing the queue data to ensure safe memory access.
CVE-2026-19868 is an authentication enforcement vulnerability in the SonicOS SSLVPN service. It allows a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, including SAML-enforced multi-factor authentication (MFA). This could lead to unauthorized access with high confidentiality impact but limited integrity impact. The vulnerability has a CVSS score of 7.5, indicating high severity.
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 has an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669. The broker uses publicly documented default credentials and a weak 4-digit pairing PIN without rate limiting or lockout, allowing brute force attacks in about five seconds. Some actions require no pairing, enabling a LAN-adjacent attacker to inject key events, change volume, switch inputs, enumerate inputs, launch apps, and monitor pairing activity. This poses a significant risk especially in hotel environments with untrusted LAN access.
A weak password hashing vulnerability in SonicOS virtual appliances could allow an attacker with existing local access to disclose a platform credential. This credential grants access to a limited subset of platform settings. The vulnerability has a medium severity score of 5.1 and requires high privileges to exploit. No patch information is currently available.
An out-of-bounds read vulnerability exists in the TDS RPC procedure-name parser of the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4, and in Amazon Aurora PostgreSQL with Babelfish. This flaw may allow remote authenticated users to read adjacent process memory or cause a denial of service via a malformed TDS RPC request to the default TDS port 1433. Upgrades to fixed versions or restricting network access to the TDS port are recommended mitigations.
A permissive cross-domain policy vulnerability exists in the SonicOS management interface. Under certain conditions, this flaw could allow a remote unauthenticated attacker to perform unauthorized operations. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 has an unauthenticated access vulnerability in its DIAL service on TCP port 56789. This flaw allows any device on the local network to send control requests without authentication or user notification. Attackers can query application states, list installed apps, terminate sessions, launch apps, and bypass YouTube's Origin check, potentially disclosing user viewing activity and subscriptions or disrupting device functionality.
A heap-based buffer overflow vulnerability exists in the TDS prelogin parser of the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4, and in Amazon Aurora PostgreSQL with Babelfish. This flaw allows remote attackers to execute arbitrary OS commands as the database process user by sending a specially crafted malformed TDS prelogin packet to the TDS port. A related NULL-pointer dereference issue in the same parser is also consolidated in this record. Users are advised to upgrade to fixed versions or apply recommended workarounds.
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 includes a vulnerability due to an unauthenticated WebDriver automation server exposed on TCP port 4444. This server is part of a QA build of the Google Cobalt browser engine and is accessible without authentication from any LAN-adjacent attacker. Exploitation allows arbitrary JavaScript execution, data exfiltration, persistent display content injection, and filesystem and system-state operations via a native bridge.
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 has a missing authentication vulnerability in its UPnP/DLNA RenderingControl service on TCP port 38400. This flaw allows a LAN-adjacent attacker to issue commands such as SetVolume, SetMute, and SelectPreset (FactoryDefaults) after a one-time DLNA pairing without requiring per-command authentication or session tokens. Attackers can continuously send unauthenticated commands to override the physical remote control, adjust volume and mute settings, and reset picture and audio calibration.
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 has an unauthenticated denial-of-service vulnerability in its UPnP/DLNA AVTransport SOAP service. An attacker on the local network can send a crafted SetAVTransportURI request to TCP port 38400 to freeze the TV's software layer. This causes the device to become completely unresponsive to remote or front-panel inputs, requiring a physical power cycle to recover.
A use-after-free (UAF) vulnerability in the Linux kernel's xen-blkback component was resolved. The flaw occurred when reading I/O statistics via sysfs concurrently with tearing down a frontend device, due to lack of synchronization between reading statistics and freeing data. This could lead to UAF or NULL pointer dereference. The issue was fixed by introducing a read-write lock for synchronization.
A session validation vulnerability exists in the SonicOS management interface that could allow a remote unauthenticated attacker to perform unauthorized operations under certain conditions. This vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. No affected versions or patch information are currently provided.