FXBIA/cve-intelligence-stream huggingface dataset:
CVE ID: CVE-2026-46243 Severity: HIGH (CVSS 7.1) CWE: CWE-20 KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.
CVE ID: CVE-2026-46242 Severity: HIGH (CVSS 7.8) KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.
CVE ID: CVE-2026-45956 Severity: HIGH (CVSS 7.8) KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to obtain a struct vidi_context pointer. However, drm_dev->dev is the exynos-drm master device, and the driver_data contained therein is not the vidi component device, but a completely different device. This can lead to various bugs, ranging from null pointer dereferences and garbage value accesses to, in unlucky cases, out-of-bounds errors, use-after-free errors, and more. To resolve this issue, we need to store/delete the vidi device pointer in exynos_drm_private->vidi_dev during bind/unbind, and then read this exynos_drm_private->vidi_dev within ioctl() to obtain the correct struct vidi_context pointer.
CVE ID: CVE-2026-45955 Severity: HIGH (CVSS 7.1) KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout When llbitmap_suspend_timeout() times out waiting for percpu_ref to become zero, it returns -ETIMEDOUT without resurrecting the percpu_ref. The caller (md_llbitmap_daemon_fn) then continues to the next page without calling llbitmap_resume(), leaving the percpu_ref in a killed state permanently. Fix this by resurrecting the percpu_ref before returning the error, ensuring the page control structure remains usable for subsequent operations.
CVE ID: CVE-2025-11022 Severity: CRITICAL (CVSS 9.6) CWE: CWE-352 KEV (actively exploited): NO Description: Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery. This CSRF vulnerability resulting in Command Injection has been identified. This issue affects Panilux: before v.0.10.0. NOTE: The vendor was contacted and responded that they deny ownership of the mentioned product.
CVE ID: CVE-2025-10970 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kolay Software Inc. Talentics allows Blind SQL Injection. This issue affects Talentics: through 20022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-62338 Severity: LOW (CVSS 3.3) KEV (actively exploited): NO Description: HCL BigFix Cloud Lifecycle Management is affected by lack of input validation. This low-level flaw allows unauthorized access and may lead to information exposure.
CVE ID: CVE-2018-1002206 Severity: MEDIUM (CVSS 5.5) CWE: CWE-22 Affected: cpe:2.3:a:adamhathcock:sharpcompress:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
CVE ID: CVE-2026-37700 Severity: MEDIUM (CVSS 4.1) CWE: CWE-79 KEV (actively exploited): NO Description: Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file upload endpoint used by admin_page
CVE ID: CVE-2026-36603 Severity: HIGH (CVSS 8.1) CWE: CWE-306 KEV (actively exploited): NO Description: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interface, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics.
CVE ID: CVE-2026-36602 Severity: MEDIUM (CVSS 4.3) CWE: CWE-200 KEV (actively exploited): NO Description: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP GetStatusInfo action. An unauthenticated attacker on the adjacent network can obtain a raw MIPS KSEG0 kernel pointer, revealing kernel memory layout and aiding further exploitation.
CVE ID: CVE-2026-34003 Severity: HIGH (CVSS 7.8) CWE: CWE-125 KEV (actively exploited): NO Description: A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.
CVE ID: CVE-2026-34002 Severity: CRITICAL (CVSS 9.1) CWE: CWE-805 Affected: cpe:2.3:a:x.org:x_server:-:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.
CVE ID: CVE-2026-34001 Severity: HIGH (CVSS 7.8) CWE: CWE-825 KEV (actively exploited): NO Description: A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.
CVE ID: CVE-2026-34000 Severity: CRITICAL (CVSS 9.1) CWE: CWE-125 Affected: cpe:2.3:a:x.org:x_server:-:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.
CVE ID: CVE-2026-33999 Severity: HIGH (CVSS 7.8) CWE: CWE-191 KEV (actively exploited): NO Description: A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.
CVE ID: CVE-2026-10022 Severity: HIGH (CVSS 7.5) CWE: CWE-843 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Type Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE ID: CVE-2025-71273 Severity: MEDIUM (CVSS 5.5) CWE: CWE-401 Affected: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() Simplify the code by using device managed memory allocations. This also fixes a memory leak in rtw_register_hw(). The supported bands were not freed in the error path. Copied from commit 145df52a8671 ("wifi: rtw89: Convert rtw89_core_set_supported_band to use devm_*").
CVE ID: CVE-2026-41308 Severity: MEDIUM (CVSS 6.5) CWE: CWE-288 Affected: cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.
CVE ID: CVE-2024-7593 Severity: CRITICAL (CVSS 9.8) CWE: CWE-287, CWE-303 Affected: cpe:2.3:a:ivanti:virtual_traffic_manager:22.2:*:*:*:*:*:*:*, cpe:2.3:a:ivanti:virtual_traffic_manager:22.3:-:*:*:*:*:*:*, cpe:2.3:a:ivanti:virtual_traffic_manager:22.3:r2:*:*:*:*:*:*, cpe:2.3:a:ivanti:virtual_traffic_manager:22.5:r1:*:*:*:*:*:*, cpe:2.3:a:ivanti:virtual_traffic_manager:22.6:r1:*:*:*:*:*:* KEV (actively exploited): YES Description: Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE ID: CVE-2026-3087 Severity: MEDIUM (CVSS 6.0) CWE: CWE-22 Affected: cpe:2.3:a:python:python:*:*:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:* KEV (actively exploited): NO Description: If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
CVE ID: CVE-2026-43084 Severity: HIGH (CVSS 7.8) CWE: CWE-416 Affected: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: make hash table per queue Sharing a global hash table among all queues is tempting, but it can cause crash: BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] [..] nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] nfnetlink_rcv_msg+0x46a/0x930 kmem_cache_alloc_node_noprof+0x11e/0x450 struct nf_queue_entry is freed via kfree, but parallel cpu can still encounter such an nf_queue_entry when walking the list. Alternative fix is to free the nf_queue_entry via kfree_rcu() instead, but as we have to alloc/free for each skb this will cause more mem pressure.
CVE ID: CVE-2024-0193 Severity: MEDIUM (CVSS 6.7) CWE: CWE-416 Affected: cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:aarch64:*, cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.2:*:*:*:*:*:x64:*, cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.4:*:*:*:*:*:arm64:*, cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.4:*:*:*:*:*:x64:*, cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.6:*:*:*:*:*:arm64:* KEV (actively exploited): NO Description: A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.
CVE ID: CVE-2026-7251 Severity: CRITICAL (CVSS 9.3) CWE: CWE-259 KEV (actively exploited): NO Description: Eppendorf BioFlo 320 is vulnerable due to VNC server using a hard-coded password. If a remote attacker knows the network address of any BioFlo 320 model with remote access enabled, they can gain full control of the user interface by using this password. Once connected, the attacker would have full access to all control panel features for the BioFlo 320. VNC traffic is not encrypted.
CVE ID: CVE-2026-6074 Severity: CRITICAL (CVSS 9.3) CWE: CWE-35 KEV (actively exploited): NO Description: Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the download_debuglog_file.php endpoint used for Debug Logs downloads. An unauthenticated attacker can manipulate the name parameter to read arbitrary files outside the intended directory.
CVE ID: CVE-2026-25109 Severity: HIGH (CVSS 8.8) CWE: CWE-78 Affected: cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*, cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*, cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*, cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*, cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field when accessing the get setup route.
CVE ID: CVE-2026-20910 Severity: HIGH (CVSS 8.8) CWE: CWE-78 Affected: cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*, cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*, cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*, cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*, cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve remote code execution.
CVE ID: CVE-2017-6034 Severity: CRITICAL (CVSS 9.8) CWE: CWE-287, CWE-294 Affected: cpe:2.3:h:schneider-electric:modbus:-:*:*:*:*:*:*:*, cpe:2.3:o:schneider-electric:modbus_firmware:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download.
CVE ID: CVE-2017-6030 Severity: MEDIUM (CVSS 6.5) CWE: CWE-331, CWE-343 Affected: cpe:2.3:h:schneider-electric:modicon_m221:-:*:*:*:*:*:*:*, cpe:2.3:h:schneider-electric:modicon_m241:-:*:*:*:*:*:*:*, cpe:2.3:h:schneider-electric:modicon_m251:-:*:*:*:*:*:*:*, cpe:2.3:o:schneider-electric:modicon_m221_firmware:*:*:*:*:*:*:*:*, cpe:2.3:o:schneider-electric:modicon_m241_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0, Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The affected products generate insufficiently random TCP initial sequence numbers that may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections.
CVE: CVE-2026-43073 Severity: MEDIUM (CVSS 5.5) Software: Linux Linux Kernel Exploit available: NO KEV: NO In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal "start user space access" logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC and all) to do kernel copies without ever even caring about the exception handling, _just_ for the non-temporal destination. Rename it as a first small step to actually make it halfway sane, and change the prototype to be more normal: it doesn't take a user pointer unless the caller has done the proper conversion, and the argument size is the full size_t (it still won't actually copy more than 4GB in one go, but there's also no reason to silently truncate the size argument in the caller). Finally, use this now sanely named function in the NTB code, which mis-used a user copy version (with STAC/CLAC and all) of this interface despite it not actually being a user copy at all.