Export limit exceeded: 374130 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (374130 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-64583 | 1 Linux | 1 Linux Kernel | 2026-08-06 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm only after bdc_remove() returns. devm releases resources in reverse LIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() -> bdc_mem_free() manually before returning: bdc_udc_exit() tears down individual endpoint objects via bdc_free_ep(), while bdc_hw_exit() -> bdc_mem_free() frees and NULLs the DMA-coherent status-report ring (bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while the IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED) remains deliverable in the window up to the post-remove devm free_irq(). On receipt of a shared interrupt in that window, bdc_udc_interrupt() dereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA) and dispatches sr_handler callbacks that index into bdc_ep_array, causing a NULL-deref or use-after-free. The same window affects the delayed_work bdc->func_wake_notify, which is armed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change() -> schedule_delayed_work() and may self-rearm from its own callback bdc_func_wake_timer(). No cancel exists anywhere in the driver, so a queued work item that fires after bdc_remove() returns and the bdc structure is devm-freed dereferences freed memory. Replace devm_request_irq() with request_irq() and add an explicit free_irq(bdc->irq, bdc) in bdc_remove(). Clear BDC_GIE before free_irq() to stop the device from asserting interrupts, then free_irq() drains any in-flight handler, then cancel_delayed_work_sync() drains the func_wake_notify delayed work. This ordering ensures the IRQ handler and delayed work cannot interfere with the subsequent endpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the matching free_irq() into the bdc_udc_init() error path so the IRQ is released on probe failure, and route the bdc_init_ep() failure through err0 instead of returning directly. This issue was found by an in-house static analysis tool. | ||||
| CVE-2023-7353 | 2026-08-06 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2026-51400 | 2026-08-06 | 8.4 High | ||
| An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c | ||||
| CVE-2026-44945 | 1 Suse | 1 Rancher | 2026-08-06 | 9.1 Critical |
| A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2. | ||||
| CVE-2026-55997 | 1 Rancher | 1 Rancher | 2026-08-06 | 8.8 High |
| Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster. | ||||
| CVE-2026-70446 | 2026-08-06 | 4.3 Medium | ||
| Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-24076 | 1 Qualcomm | 1 Snapdragon | 2026-08-06 | 6.7 Medium |
| Memory Corruption when processing registry values with incorrect types using a direct query method. | ||||
| CVE-2023-54389 | 2026-08-06 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2026-70442 | 2026-08-06 | 4.3 Medium | ||
| Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use. | ||||
| CVE-2023-54388 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54387 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54386 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54385 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54384 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54383 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54382 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | ||||
| CVE-2023-54381 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | ||||
| CVE-2023-54380 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | ||||
| CVE-2023-54379 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | ||||
| CVE-2023-54378 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | ||||