CVE-2026-74521

ksmbd: use memcmp() to compare ClientGUIDs

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp() to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp() stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equal. Use memcmp() in SMB3 multichannel session binding and FSCTL_VALIDATE_NEGOTIATE_INFO to compare all SMB2_CLIENT_GUID_SIZE bytes.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2024-47408

net/smc: check smcd_v2_ext_offset when receiving proposal msg

In the Linux kernel, the following vulnerability has been resolved: net/smc: check smcd_v2_ext_offset when receiving proposal msg When receiving proposal msg in server, the field smcd_v2_ext_offset in proposal msg is from the remote client and can not be fully trusted. Once the value of smcd_v2_ext_offset exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the value of smcd_v2_ext_offset before using it.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-47360

Apache HTTP Server: mod_session: Session cookie not removed during internal redirect

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.   When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Hummingbird

CVE-2026-100258

Missing Authorization Allows Read-Only Users to View Project Settings in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-64892

Sensitive Information Exposure via Common Resource Locations in Johnson Controls Easy IO Neo

- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue affects Easy IO Neo: before 3.3b63.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Johnson Controls

Products

Easy Io Neo

CVE-2026-85532

Apache WSS4J: Insufficient Validation of Derived-Key Parameters

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Wss4j

CVE-2026-17523

can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet

In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet This patch switches the timer to HRTIMER_MODE_SOFT, which executed the timer callback in softirq context and removes the hrtimer_tasklet.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2026-73555

vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py does not remove traceback-style file paths, allowing unauthenticated malformed JSON requests to /v1/chat/completions, /v1/completions, /tokenize, and /detokenize to disclose the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This issue is fixed in version 0.26.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-100078

wifi: iwlwifi: mei: pass correct argument to function

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: pass correct argument to function The first argument to iwl_mei_write_cyclic_buf() should be the cldev but the q_head pointer is passed instead. Fix it.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-77987

GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Github

Products

Enterprise Server

CVE-2026-18036

NTRU leaks private key information by reducing secret values with a non-constant-time integer division

In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are deliberately division-free, so each reduction was carried out by an integer division whose latency depends on the secret operand. Polynomial.modQ divided by a variable divisor, which a compiler cannot strength-reduce to a multiply the way it can a constant one, so it emitted a division on every call including on the decapsulation path where the dividend derives from the private key; Polynomial.mod3 and NTRUSampling.mod3 divided the secret key polynomials f and g during key generation, the message polynomials r and m during encapsulation, and coefficients recovered during decapsulation. An attacker able to measure that timing can recover information about the NTRU private key. modQ now masks, which is exact because q is always a power of two, and mod3 uses the reference implementation's division-free fold and select; the results are unchanged.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Legion Of The Bouncy Castle Inc.

Products

Bc-java

CVE-2026-104415

Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Ghost

Products

Ghost

CVE-2026-32584

WordPress Smart One Click Setup – Complete Demo Import &amp; Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import &amp; Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import &amp; Export: from n/a through 1.4.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-95381

chromium-browser: Improper input validation in Printing

Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-95382

chromium-browser: chromium-browser: Improper input validation in Auth

Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-90988

Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Request A Quote

CVE-2026-97317

Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rafflepress Wordpress-extensions

Products

Giveaways And Contests By Rafflepress Giveaways And Contests By Rafflepress

CVE-2026-104455

YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-104439

YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Yeswiki

Products

Yeswiki

CVE-2026-102823

russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belongs to a channel the client opened and established. A malicious SSH server can send lifecycle events for predicted, unopened, unconfirmed, or released channel identifiers, causing application panics or corrupting command completion and exit-code tracking. This issue is fixed in version 0.63.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eugeny

Products

Russh