|
301
|
- |
-
|
-
|
-
|
In the Linux kernel, the following vulnerability has been resolved:
driver core: enforce device_lock for driver_match_device()
Currently, driver_match_device() is called from three sites. One site
…
New
|
-
|
CVE-2026-31688
|
2026-04-28 03:32 |
2026-04-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
302
|
- |
-
|
-
|
-
|
In the Linux kernel, the following vulnerability has been resolved:
mm/kasan: fix double free for kasan pXds
kasan_free_pxd() assumes the page table is always struct page aligned.
But that's not a…
New
|
-
|
CVE-2026-31686
|
2026-04-28 03:32 |
2026-04-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
303
|
- |
-
|
-
|
-
|
In the Linux kernel, the following vulnerability has been resolved:
EDAC/mc: Fix error path ordering in edac_mc_alloc()
When the mci->pvt_info allocation in edac_mc_alloc() fails, the error path
wi…
New
|
-
|
CVE-2026-31689
|
2026-04-28 03:32 |
2026-04-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
304
|
- |
-
|
-
|
-
|
In the Linux kernel, the following vulnerability has been resolved:
firmware: thead: Fix buffer overflow and use standard endian macros
Addresses two issues in the TH1520 AON firmware protocol driv…
New
|
-
|
CVE-2026-31690
|
2026-04-28 03:32 |
2026-04-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
305
|
- |
-
|
-
|
-
|
In the Linux kernel, the following vulnerability has been resolved:
igb: remove napi_synchronize() in igb_down()
When an AF_XDP zero-copy application terminates abruptly (e.g., kill -9),
the XSK bu…
New
|
-
|
CVE-2026-31691
|
2026-04-28 03:32 |
2026-04-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
306
|
8.1 |
HIGH
Network
|
zfnd
|
zebra-consensus
zebrad
|
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic error in Zebra's transaction verification cache could allow a malicious miner …
Update
|
CWE-1025
Comparison Using Wrong Factors
|
CVE-2026-40880
|
2026-04-28 03:26 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
307
|
9.8 |
CRITICAL
Network
|
jizhicms
|
jizhicms
|
Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.
Update
|
CWE-89
SQL Injection
|
CVE-2025-50229
|
2026-04-28 03:24 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
308
|
7.5 |
HIGH
Network
|
zfnd
|
zebra-network
zebrad
|
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-network version 5.0.1, when deserializing addr or addrv2 messages, which contain vectors of addresses, Zebra wo…
Update
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-40881
|
2026-04-28 03:24 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
309
|
4.3 |
MEDIUM
Network
|
ibm
|
guardium_data_protection
|
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user access control panel.
Update
|
CWE-613
Insufficient Session Expiration
|
CVE-2026-1272
|
2026-04-28 03:23 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
310
|
4.9 |
MEDIUM
Network
|
ibm
|
guardium_data_protection
|
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access management control panel.
Update
|
CWE-840
Business Logic Errors
|
CVE-2026-1274
|
2026-04-28 03:23 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
311
|
6.5 |
MEDIUM
Network
|
ibm
|
db2
|
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutr…
Update
|
CWE-1284
Improper Validation of Specified Quantity in Input
|
CVE-2026-1352
|
2026-04-28 03:22 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
312
|
6.6 |
MEDIUM
Local
|
samsung
|
one
|
Improper validation of STRING tensor offsets could allows malformed string metadata to trigger out of bounds access during constant tensor import in Samsung Open Source ONE
Affected version is prior …
Update
|
CWE-1284
Improper Validation of Specified Quantity in Input
|
CVE-2026-6839
|
2026-04-28 03:22 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
313
|
6.6 |
MEDIUM
Local
|
samsung
|
one
|
Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant nodes.
Affected version is prior to commit 1.30.0.
Update
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-41667
|
2026-04-28 03:21 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
314
|
6.1 |
MEDIUM
Local
|
samsung
|
one
|
Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for large intermediate tensors.
Affected version is prior to commit…
Update
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-41665
|
2026-04-28 03:21 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
315
|
6.6 |
MEDIUM
Local
|
samsung
|
one
|
Integer overflow in tensor copy size calculation in Samsung Open Source ONE could lead to out of bounds access during loop state propagation.
Affected version is prior to commit 1.30.0.
Update
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-41666
|
2026-04-28 03:21 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
316
|
6.6 |
MEDIUM
Local
|
samsung
|
one
|
Integer overflow in memory copy size calculation in Samsung Open Source ONE could lead to invalid memory operations with large tensor shapes.
Affected version is prior to commit 1.30.0.
Update
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-41664
|
2026-04-28 03:21 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
317
|
4.8 |
MEDIUM
Network
|
ibm
|
guardium_key_lifecycle_manager
|
IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1
Update
|
CWE-269
NVD-CWE-noinfo
Improper Privilege Management
|
CVE-2026-1726
|
2026-04-28 03:21 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
318
|
6.6 |
MEDIUM
Local
|
samsung
|
one
|
Integer overflow in output tensor copy size calculation in Samsung Open Source ONE could cause incorrect copy length and memory corruption for oversized tensors.
Affected version is prior to commit …
Update
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-40450
|
2026-04-28 03:21 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
319
|
6.6 |
MEDIUM
Local
|
samsung
|
one
|
Integer overflow in buffer size calculation could result in out of bounds memory access when handling large tensors in Samsung Open Source ONE.
Affected version is prior to commit 1.30.0.
Update
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-40449
|
2026-04-28 03:21 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
320
|
9.8 |
CRITICAL
Network
|
rclone
|
rclone
|
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate …
Update
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-41176
|
2026-04-28 03:19 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
321
|
5.3 |
MEDIUM
Local
|
samsung
|
one
|
Potential Integer overflow in tensor allocation size calculation could lead to insufficient memory allocation for large tensors in Samsung Open Source ONE.
Affected version is prior to commit 1.30.0.
Update
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-40448
|
2026-04-28 03:18 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
322
|
9.8 |
CRITICAL
Network
|
rclone
|
rclone
|
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinf…
Update
|
CWE-78
CWE-306
OS Command
Missing Authentication for Critical Function
|
CVE-2026-41179
|
2026-04-28 03:18 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
323
|
- |
-
|
-
|
-
|
An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter i…
Update
|
CWE-79
Cross-site Scripting
|
CVE-2026-3837
|
2026-04-28 03:16 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
324
|
4.9 |
MEDIUM
Network
|
ibm
|
guardium_data_protection
|
IBM Guardium Data Protection 12.1 could allow an administrative user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../…
Update
|
CWE-22
Path Traversal
|
CVE-2026-4917
|
2026-04-28 03:13 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
325
|
4.8 |
MEDIUM
Network
|
ibm
|
guardium_data_protection
|
IBM Guardium Data Protection 12.1 is vulnerable to stored cross-site scripting. This vulnerability allows an administrative user to embed arbitrary JavaScript code in the Web UI thus altering the int…
Update
|
CWE-79
Cross-site Scripting
|
CVE-2026-4918
|
2026-04-28 03:13 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
326
|
4.8 |
MEDIUM
Network
|
ibm
|
guardium_data_protection
|
IBM Guardium Data Protection 12.1 is vulnerable to cross-site scripting. This vulnerability allows an administrative user to embed arbitrary JavaScript code in the Web UI thus altering the intended f…
Update
|
CWE-79
Cross-site Scripting
|
CVE-2026-4919
|
2026-04-28 03:11 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
327
|
5.3 |
MEDIUM
Network
|
oracle
|
goldengate
|
Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 23.4-23.10. Easily exploitable vulnerability allows unauthenticated attacker with network access v…
Update
|
CWE-200
Information Exposure
|
CVE-2026-34273
|
2026-04-28 03:08 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
328
|
7.5 |
HIGH
Network
|
oracle
|
financial_services_customer_screening
|
Vulnerability in the Oracle Financial Services Customer Screening product of Oracle Financial Services Applications (component: User Interface). The supported version that is affected is 8.1.2.8.0.…
Update
|
CWE-285
Improper Authorization
|
CVE-2026-34320
|
2026-04-28 03:08 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
329
|
7.5 |
HIGH
Network
|
oracle
|
financial_services_transaction_filtering
|
Vulnerability in the Oracle Financial Services Transaction Filtering product of Oracle Financial Services Applications (component: User Interface). The supported version that is affected is 8.1.2.8…
Update
|
CWE-284
Improper Access Control
|
CVE-2026-35231
|
2026-04-28 03:07 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
330
|
5.4 |
MEDIUM
Network
|
linuxfoundation
|
tekton_pipelines
|
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Prior to 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restr…
Update
|
CWE-22
Path Traversal
|
CVE-2026-40923
|
2026-04-28 03:07 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
331
|
6.5 |
MEDIUM
Network
|
linuxfoundation
|
tekton_pipelines
|
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Prior to 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response…
Update
|
CWE-400
Uncontrolled Resource Consumption
|
CVE-2026-40924
|
2026-04-28 03:06 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
332
|
7.5 |
HIGH
Network
|
linuxfoundation
|
tekton_pipelines
|
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. From 1.0.0 to before 1.11.0, the git resolver's revision parameter is passed directly as a positional argume…
Update
|
CWE-88
Argument Injection
|
CVE-2026-40938
|
2026-04-28 03:05 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
333
|
7.5 |
HIGH
Network
|
lxml
|
lxml
|
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML in…
New
|
CWE-611
XXE
|
CVE-2026-41066
|
2026-04-28 02:59 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
334
|
7.7 |
HIGH
Network
|
kyverno
|
kyverno
|
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the `forEach` mutation handler allows any user wit…
Update
|
CWE-617
Reachable Assertion
|
CVE-2026-41485
|
2026-04-28 02:54 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
335
|
9.1 |
CRITICAL
Network
|
kyverno
|
kyverno
|
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attache…
Update
|
CWE-200
CWE-918
Information Exposure
Server-Side Request Forgery (SSRF)
|
CVE-2026-41323
|
2026-04-28 02:53 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
336
|
7.5 |
HIGH
Network
|
patrickjuchli
|
basic-ftp
|
basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A mal…
Update
|
CWE-400
CWE-770
Uncontrolled Resource Consumption
Allocation of Resources Without Limits or Throttling
|
CVE-2026-41324
|
2026-04-28 02:48 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
337
|
7.7 |
HIGH
Network
|
kyverno
|
kyverno
|
Kyverno is a policy engine designed for cloud native platform engineering teams. The patch for CVE-2026-22039 fixed cross-namespace privilege escalation in Kyverno's `apiCall` context by validating t…
Update
|
CWE-863
Incorrect Authorization
|
CVE-2026-41068
|
2026-04-28 02:48 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
338
|
6.1 |
MEDIUM
Network
|
freerdp
|
freerdp
|
FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/client/drive_file.c`. The `contains_dotdot…
Update
|
CWE-193
Off-by-one Error
|
CVE-2026-40254
|
2026-04-28 02:44 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
339
|
5.5 |
MEDIUM
Local
|
angryip
|
angry_ip_scanner
|
Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the application by supplying malformed input to the port selection field. Attackers ca…
Update
|
CWE-787
Out-of-bounds Write
|
CVE-2018-25262
|
2026-04-28 02:30 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
340
|
7.8 |
HIGH
Local
|
lizardsystems
|
lanspy
|
LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execute arbitrary code by exploiting structured exception handling mechanisms. Attac…
Update
|
CWE-787
Out-of-bounds Write
|
CVE-2018-25265
|
2026-04-28 02:28 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
341
|
5.5 |
MEDIUM
Local
|
angryip
|
angry_ip_scanner
|
Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to crash the application by supplying an excessively large string. Attackers can …
Update
|
CWE-787
Out-of-bounds Write
|
CVE-2018-25266
|
2026-04-28 02:28 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342
|
7.8 |
HIGH
Local
|
lizardsystems
|
lanspy
|
LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction pointer by supplying oversized input to the scan field. Attackers can craft a payloa…
Update
|
CWE-787
Out-of-bounds Write
|
CVE-2018-25268
|
2026-04-28 02:25 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
343
|
9.8 |
CRITICAL
Network
|
thinkphp
|
thinkphp
|
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can c…
Update
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2018-25270
|
2026-04-28 02:20 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
344
|
5.5 |
MEDIUM
Local
|
helios
|
textpad
|
Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long buffer string through the Run command interface. Attacke…
Update
|
CWE-787
Out-of-bounds Write
|
CVE-2018-25271
|
2026-04-28 02:13 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
345
|
9.8 |
CRITICAL
Network
|
dell
|
powerprotect_dp_series_appliance
data_domain_operating_system
|
Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.10, LTS2024 release versions 7.13.1.0…
Update
|
CWE-121
CWE-787
Stack-based Buffer Overflow
Out-of-bounds Write
|
CVE-2026-26354
|
2026-04-28 02:09 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346
|
6.2 |
MEDIUM
Local
|
apple
|
ipados
iphone_os
|
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2. Notifications marked for deletion could be unexpectedly …
Update
|
CWE-359
Exposure of Private Personal Information to an Unauthorized Actor
|
CVE-2026-28950
|
2026-04-28 02:07 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
347
|
9.1 |
CRITICAL
Network
|
espocrm
|
espocrm
|
EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an au…
Update
|
CWE-22
Path Traversal
|
CVE-2026-33656
|
2026-04-28 02:04 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
348
|
7.8 |
HIGH
Local
|
radare
|
radare2
|
radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with …
Update
|
CWE-78
OS Command
|
CVE-2026-40517
|
2026-04-28 02:04 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
349
|
7.5 |
HIGH
Network
|
powerdns
|
recursor
|
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Update
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-33256
|
2026-04-28 02:04 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
350
|
7.5 |
HIGH
Network
|
powerdns
|
authoritative
dnsdist
recursor
|
An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The internal web server is disabled by default.
Update
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-33257
|
2026-04-28 02:03 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
