cve.bz

New CVEs this week, the last 7 days, newest first, page 44

Filter

The new CVEs published in the last 7 days, newest first, with CVSS, EPSS, CISA KEV and public exploits for each. Refreshed every few minutes. Narrow it: in CISA KEV · critical. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, Patch Tuesday

  1. 7.8CVE-2026-56944EPSS 0.1%

    In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with Use…

  2. 2.3CVE-2026-56943EPSS 0.1%

    In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed.…

  3. 7.0CVE-2026-56938EPSS 0.1%

    In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

  4. 4.0CVE-2026-56935EPSS 0.1%

    In km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for expl…

  5. 7.8CVE-2026-56934EPSS 0.1%

    In arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interactio…

  6. 7.8CVE-2026-56933EPSS 0.08%

    In RecordApTx of efw_ap_transport.c, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

  7. 8.4CVE-2026-56930EPSS 0.08%

    In smmu_find_ste of smmu.c, there is a possible way to retain stale translation lookaside buffer entries across stream identifiers due to a confused deputy. This could lead to local escalation of privilege with no additional execution priv…

  8. 7.8CVE-2026-56929EPSS 0.1%

    In TrustyKeyMintManager::VerifyHat of trusty_keymint_manager.cc, there is a possible Security check bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interactio…

  9. 8.4CVE-2026-56926EPSS 0.1%

    In multiple functions of PssSubscriptionManager.java, there is a possible way to spoof subscription switch results and trigger a device reboot due to a confused deputy. This could lead to local escalation of privilege with no additional ex…

  10. 8.8CVE-2026-56919EPSS 0.1%

    In PackageSignatureChecker of SystemUIGoogleModule.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interac…

  11. 7.8CVE-2026-56916EPSS 0.1%

    In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is …

  12. 7.8CVE-2026-56912EPSS 0.1%

    In ac_remove_smmu_prot_internal of acfw_smmu.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

  13. 6.7CVE-2026-56911EPSS 0.1%

    In handle_fips_hmac_req of hwcrypto_proxy.c, there is a possible heap buffer overflow due to missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for…

  14. 8.4CVE-2026-56910EPSS 0.08%

    In multiple locations, there is a possible way to trigger an out of bounds read and write in shared memory due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. U…

  15. 6.7CVE-2026-56909EPSS 0.1%

    In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure software due to a missing permission check. This could lead to local escalation of privilege with System execution privile…

  16. 4.0CVE-2026-56902EPSS 0.2%

    In multiple locations, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploita…

  17. 8.4CVE-2026-56898EPSS 0.1%

    In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges ne…

  18. 4.0CVE-2026-56897EPSS 0.09%

    In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack memory in key attestation certificates due to uninitialized data. This could lead to local information disclosure with no…

  19. 6.7CVE-2026-56884EPSS 0.1%

    In ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry configurations via unvalidated parameters due to improper input validation. This could lead to local escalation of privilege with System execution…

  20. 9.8CVE-2026-55362EPSS 0.2%

    In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

  21. 8.4CVE-2026-55360EPSS 0.1%

    In secure_transport_usecase_handshake of secure_transport.c, there is a possible way to bypass secure transport channel encryption due to a logic error. This could lead to local escalation of privilege with no additional execution privileg…

  22. 2.3CVE-2026-55348EPSS 0.1%

    In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sign extension of a negative buffer size due to an improper or implicit cast. This could lead to local information disclosu…

  23. 6.7CVE-2026-55346EPSS 0.1%

    In km_read_data_response of keymaster.c, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User in…

  24. 7.8CVE-2026-55344EPSS 0.08%

    In TzSharedMemory of TzSharedMemory.c, there is a possible Heap buffer overflow due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

  25. 9.8CVE-2026-55335EPSS 0.2%

    In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

  26. 7.8CVE-2026-55321EPSS 0.08%

    In parse_prime256v1 of keymint_asn1.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

  27. 8.4CVE-2026-55319EPSS 0.1%

    In thread_free of thread.c, there is a possible way to corrupt kernel heap metadata on thread creation failure due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User …

  28. 6.8CVE-2026-55316EPSS 0.1%

    In handle_dpm_image of seclib.rs, there is a possible Logic error due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for expl…

  29. 7.8CVE-2026-55312EPSS 0.08%

    In insert_node of remap.c, there is a possible way to trigger an out of bounds write in the address remapping table due to a non-heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed…

  30. 8.4CVE-2026-55311EPSS 0.1%

    In N/A of gdmc/gsp/project/gdmc.mk, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo…

  31. 8.4CVE-2026-55309EPSS 0.1%

    In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault injection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges n…

  32. 6.4CVE-2026-55297EPSS 0.08%

    In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent shared memory modification due to a race condition. This could lead to local escalation of privilege with System execution…

  33. 3.3CVE-2026-50080EPSS 0.1%

    Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACPI request.

  34. 3.3CVE-2026-50079EPSS 0.08%

    Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM.

  35. 4.4CVE-2026-50078EPSS 0.1%

    Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosure or a crash of the QVM.

  36. 7.7CVE-2026-50077EPSS 0.1%

    Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the QVM to cause memory corruption, information disclosure or a crash of the QVM.

  37. 8.8CVE-2026-26248EPSS 0.6%

    A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 th…

  38. 2.3CVE-2026-14447EPSS 0.1%

    In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-by-one check due to an incorrect bounds check. This could lead to local information disclosure with System execution pri…

  39. 3.7CVE-2026-126062EPSS 0.4%

    Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external D…

  40. 4.3CVE-2026-126061EPSS 0.3%

    Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controllers\MyAccount controller inherits the FormController actions create, update, and preview while declaring an empty $…

  41. 2.0CVE-2026-125341EPSS 0.3%

    Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source at…

  42. 4.5CVE-2026-125340EPSS 0.4%

    Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encod…

  43. 6.1CVE-2026-125339EPSS 0.2%

    Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invok…

  44. 4.5CVE-2026-125338EPSS 0.4%

    Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the…

  45. 8.3CVE-2026-125337EPSS 0.4%

    Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::ex…

  46. 6.8CVE-2026-124848EPSS 0.1%

    Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any…

  47. 6.9CVE-2026-124016EPSS 0.6%

    postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested …

  48. 6.6CVE-2026-121530EPSS 0.7%

    A improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper access control via an invalid token after entering a valid username and password

  49. 9.6CVE-2026-121529EPSS 0.2%

    A origin validation error vulnerability in Fortinet FortiClientMac 7.4.0 through 7.4.7, FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2.0 through 7.2.14, FortiClientWindowsPAM 7.4.7, FortiClientWindowsPAM 7.2.14 may allow an…

  50. 8.7CVE-2026-121371EPSS 0.7%

    On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.