Fri, May 01 · 02:16 PM CDTCVE-2026-31705
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry. The bounds check on buf_free_len is performed before the value memcpy, but the alignment memset fires
CVECVE-2026-31705
SeverityCRITICAL
TypeUPDATED
PublishedFri, May 01 · 02:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-31718
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger When a durable file handle survives session disconnect (TCP close without SMB2_LOGOFF), session_fd_check() sets fp->conn = NULL to preserve the handle for later reconnection. However
CVECVE-2026-31718
SeverityCRITICAL
TypeUPDATED
PublishedFri, May 01 · 02:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-43011
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error). This error propagates back through the call chain: x25_queue_rx_frame returns 1 | v x25_state3_machine receiv
CVECVE-2026-43011
SeverityCRITICAL
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-43037
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_optio
CVECVE-2026-43037
SeverityCRITICAL
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-43038
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to
CVECVE-2026-43038
SeverityCRITICAL
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-43039
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: fix missing data copy and wrong recycle in ZC RX dispatch emac_dispatch_skb_zc() allocates a new skb via napi_alloc_skb() but never copies the packet data from the XDP buffer into it. The skb is passed up the stack containing uni
CVECVE-2026-43039
SeverityCRITICAL
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2025-54236
9.1/10 · Must read/watchNVDvuln
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue doe
CVECVE-2025-54236
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 09 · 02:15 PM CDT
ModifiedWed, Apr 22 · 07:00 PM CDT
CVE-2026-31706
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() smb_inherit_dacl() trusts the on-disk num_aces value from the parent directory's DACL xattr and uses it to size a heap allocation: aces_base = kmalloc(sizeof(struct smb_ace) * num_aces
CVECVE-2026-31706
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 02:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-31709
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor. The ori
CVECVE-2026-31709
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 02:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-31717
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate owner of durable handle on reconnect Currently, ksmbd does not verify if the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any authenticated user to hijack an orphaned dura
CVECVE-2026-31717
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 02:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-31735
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: iommupt: Fix short gather if the unmap goes into a large mapping unmap has the odd behavior that it can unmap more than requested if the ending point lands within the middle of a large or contiguous IOPTE. In this case the gather should flush everythin
CVECVE-2026-31735
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-31739
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing CRYPTO_ALG_ASYNC The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its asynchronous algorithms, causing the crypto API to select them for users that request only synchronous algorithms. This causes crashes (at le
CVECVE-2026-31739
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-31773
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: derive legacy responder STK authentication from MITM state The legacy responder path in smp_random() currently labels the stored STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH. That reflects what the local service r
CVECVE-2026-31773
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-43018
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt hci_conn lookup and field access must be covered by hdev lock in hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed concurrently. Extend the hci_dev_lock cri
CVECVE-2026-43018
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-43048
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: core: Mitigate potential OOB by removing bogus memset() The memset() in hid_report_raw_event() has the good intention of clearing out bogus data by zeroing the area from the end of the incoming data string to the assumed end of the buffer. However
CVECVE-2026-43048
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-7674
8.8/10 · Worth your timeNVDvuln
Summary
A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the component Web Management Interface. Executing a manipulation of the argument vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow. The attack can be executed remotely. The ve
CVECVE-2026-7674
SeverityHIGH
TypeNEW
PublishedSun, May 03 · 02:17 AM CDT
ModifiedSun, May 03 · 02:17 AM CDT
CVE-2026-7675
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. Impacted is the function start_lan of the file /apply.cgi. The manipulation of the argument Channel/ApCliSsid leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public
CVECVE-2026-7675
SeverityHIGH
TypeNEW
PublishedSun, May 03 · 03:16 AM CDT
ModifiedSun, May 03 · 03:16 AM CDT
CVE-2026-7684
8.8/10 · Worth your timeNVDvuln
Summary
A security vulnerability has been detected in Edimax BR-6428nC up to 1.16. This impacts an unknown function of the file /goform/setWAN. Such manipulation of the argument pptpDfGateway leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was c
CVECVE-2026-7684
SeverityHIGH
TypeNEW
PublishedSun, May 03 · 07:16 AM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-7685
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was detected in Edimax BR-6208AC up to 1.02. Affected is an unknown function of the file /goform/setWAN. Performing a manipulation of the argument pptpDfGateway results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early abo
CVECVE-2026-7685
SeverityHIGH
TypeNEW
PublishedSun, May 03 · 07:16 AM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-31712
8.3/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size in smb_check_perm_dacl() Both ACE-walk loops in smb_check_perm_dacl() only guard against an under-sized remaining buffer, not against an ACE whose declared `ace->size` is smaller than the struct it claims to describe: if
CVECVE-2026-31712
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 02:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-2554
8.1/10 · Worth your timeNVDvuln
Summary
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via the 'wcfm_delete_wcfm_customer' due to missing validation on the 'customerid' user controlled key. This
CVECVE-2026-2554
SeverityHIGH
TypeNEW
PublishedSat, May 02 · 02:16 PM CDT
ModifiedSat, May 02 · 02:16 PM CDT
CVE-2026-31708
8.1/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL and the default QUERY_INFO path. The QUERY_INFO branch clamps qi.input_buffer_length to the server-reported Output
CVECVE-2026-31708
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 02:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-31771
8.1/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: move wake reason storage into validated event handlers hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload l
CVECVE-2026-31771
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-31779
8.1/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() The memcpy function assumes the dynamic array notif->matches is at least as large as the number of bytes to copy. Otherwise, results->matches may contain unwanted d
CVECVE-2026-31779
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
CVE-2026-43051
8.1/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an out-of-bounds read when copying data into
CVECVE-2026-43051
SeverityHIGH
TypeUPDATED
PublishedFri, May 01 · 03:16 PM CDT
ModifiedSun, May 03 · 07:16 AM CDT
