Recently updated CVEs

Nov 2, 2026 UTC

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.

Nov 2, 2026 UTC

A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.

Nov 2, 2026 UTC

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

Nov 2, 2026 UTC

DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.

Nov 2, 2026 UTC

Buffer overflow vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect availability.

Nov 2, 2026 UTC

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.10.

Nov 2, 2026 UTC

Null pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect availability.

Nov 2, 2026 UTC

Permission control vulnerability in the background task management module. Impact: Successful exploitation of this vulnerability may affect service integrity.

Nov 2, 2026 UTC

DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.

Nov 2, 2026 UTC

Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.

Nov 2, 2026 UTC

The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such s…

Nov 2, 2026 UTC

A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may result in an unexpected device reb…

Nov 2, 2026 UTC

An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. Because of improper validation of length parameters in the HTTPS management interface, an unauthenticated remote attacker could send specially crafted requests th…

Nov 2, 2026 UTC

An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administrative account. Successful explo…

Nov 2, 2026 UTC

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack…