Thu, Dec 12 · 07:15 PM CSTCVE-2024-55875
9.8/10 · Must read/watchNVDvuln
Summary
http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Reque
CVECVE-2024-55875
SeverityCRITICAL
TypeUPDATED
PublishedThu, Dec 12 · 07:15 PM CST
ModifiedTue, Jun 09 · 11:16 AM CDT
CVE-2025-59718
9.8/10 · Must read/watchNVDvuln
Summary
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.
CVECVE-2025-59718
SeverityCRITICAL
TypeUPDATED
PublishedTue, Dec 09 · 06:15 PM CST
ModifiedTue, Jun 09 · 12:47 PM CDT
CVE-2026-24858
9.8/10 · Must read/watchNVDvuln
Summary
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9,
CVECVE-2026-24858
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jan 27 · 08:16 PM CST
ModifiedTue, Jun 09 · 06:30 PM CDT
CVE-2026-11165
9.6/10 · Must read/watchNVDvuln
Summary
Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVECVE-2026-11165
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jun 04 · 11:17 PM CDT
ModifiedTue, Jun 09 · 02:24 PM CDT
CVE-2026-0257
9.1/10 · Must read/watchNVDvuln
Summary
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
CVECVE-2026-0257
SeverityCRITICAL
TypeUPDATED
PublishedWed, May 13 · 07:17 PM CDT
ModifiedTue, Jun 09 · 12:47 PM CDT
CVE-2026-46155
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validating that the entire OutputBufferLength fits
CVECVE-2026-46155
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedTue, Jun 09 · 09:04 PM CDT
CVE-2026-46244
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten
CVECVE-2026-46244
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jun 03 · 06:16 PM CDT
ModifiedTue, Jun 09 · 08:35 PM CDT
CVE-2026-46266
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field
CVECVE-2026-46266
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jun 03 · 06:16 PM CDT
ModifiedTue, Jun 09 · 07:47 PM CDT
CVE-2026-10941
8.8/10 · Worth your timeNVDvuln
Summary
Out of bounds memory access in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-10941
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:16 PM CDT
ModifiedTue, Jun 09 · 07:21 PM CDT
CVE-2026-10943
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-10943
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:16 PM CDT
ModifiedTue, Jun 09 · 07:02 PM CDT
CVE-2026-10945
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
CVECVE-2026-10945
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:16 PM CDT
ModifiedTue, Jun 09 · 07:01 PM CDT
CVE-2026-10947
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-10947
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:16 PM CDT
ModifiedTue, Jun 09 · 06:53 PM CDT
CVE-2026-10948
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-10948
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:16 PM CDT
ModifiedTue, Jun 09 · 06:52 PM CDT
CVE-2026-10954
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-10954
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:16 PM CDT
ModifiedTue, Jun 09 · 06:49 PM CDT
CVE-2026-10956
8.8/10 · Worth your timeNVDvuln
Summary
Use after free in MimeHandlerView in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-10956
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:16 PM CDT
ModifiedTue, Jun 09 · 06:48 PM CDT
CVE-2026-1784
8.8/10 · Worth your timeNVDvuln
Summary
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
CVECVE-2026-1784
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 02 · 09:16 AM CDT
ModifiedWed, Jun 10 · 10:16 AM CDT
CVE-2026-31709
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor. The ori
CVECVE-2026-31709
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 02:16 PM CDT
ModifiedTue, Jun 09 · 11:16 AM CDT
CVE-2026-46152
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share one instance and can overwrite each other's
CVECVE-2026-46152
SeverityHIGH
TypeUPDATED
PublishedThu, May 28 · 10:16 AM CDT
ModifiedTue, Jun 09 · 09:06 PM CDT
CVE-2026-46264
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Fix sysfs initialization In case of devm_add_action_or_reset() failure the provided cleanup action will be run immediately on the not yet initialized kobject. This may lead to errors like: [ ] kobject: '(null)' (ff110001393608e0): is not ini
CVECVE-2026-46264
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 03 · 06:16 PM CDT
ModifiedTue, Jun 09 · 05:26 PM CDT
CVE-2026-46273
8.6/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MSS Some physical adapters on Power systems do not support segmentation offload when the MSS is less than 224 bytes. Attempting to send such packets causes the adapter to freeze, stopping all traffic until ma
CVECVE-2026-46273
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 03 · 06:16 PM CDT
ModifiedTue, Jun 09 · 05:31 PM CDT
CVE-2026-46251
8.4/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree dirty_list corruption When the incompat flag EXTENT_TREE_V2 is set, we unconditionally add the block group tree to the switch_commits list before calling switch_commit_roots, as we do for the tree root and the chunk root. Ho
CVECVE-2026-46251
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 03 · 06:16 PM CDT
ModifiedTue, Jun 09 · 08:38 PM CDT
CVE-2026-46270
8.4/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in power_supply_changed() Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated
CVECVE-2026-46270
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 03 · 06:16 PM CDT
ModifiedTue, Jun 09 · 07:52 PM CDT
CVE-2026-10949
8.3/10 · Worth your timeNVDvuln
Summary
Heap buffer overflow in Video in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-10949
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 04 · 11:16 PM CDT
ModifiedTue, Jun 09 · 06:52 PM CDT
CVE-2026-32759
8.1/10 · Worth your timeNVDvuln
Summary
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions on the 2.x branch prior to 2.33.8, the TUS resumable upload handler parses the Upload-Length header as a signed 64-bit integer without validating that the value is non-neg
CVECVE-2026-32759
SeverityHIGH
TypeUPDATED
PublishedFri, Mar 20 · 12:16 AM CDT
ModifiedTue, Jun 09 · 01:16 PM CDT
CVE-2025-52903
8.0/10 · Worth your timeNVDvuln
Summary
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions on the 2.x branch prior to 2.33.10, the Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user
CVECVE-2025-52903
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 26 · 07:15 PM CDT
ModifiedTue, Jun 09 · 01:16 PM CDT
