Vuldb Updates

A vulnerability was found in Amazon Linux AMI and classified as critical. This vulnerability affects unknown code of the component CA-Certificate Handler. Such manipulation leads to improper certificate validation. This vulnerability is traded as CVE-2023-32803. Access to the local network is required for this attack to succeed. There is no exploit available. A patch should be applied to remediate this issue.

A vulnerability was found in MediaWiki CheckUser Extension up to 1.35.10/1.38.6/1.39.3 and classified as problematic. This affects an unknown function of the component CheckUser. Such manipulation leads to improper access controls. This vulnerability is referenced as CVE-2023-37252. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability was found in Digital Druid HotelDruid up to 3.0.5. It has been classified as problematic. This impacts the function backup/restore of the component Backup/Restore. Performing a manipulation results in unrestricted upload. This vulnerability is identified as CVE-2023-34854. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability described as very critical has been identified in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings of the component HNAP1. The manipulation of the argument PAddress/SubnetMask/Gateway results in stack-based buffer overflow. This vulnerability is reported as CVE-2026-90680. The attack can be launched remotely. No exploit exists.

A vulnerability classified as problematic has been found in MediaWiki ProofreadPage Extension up to 1.35.10/1.38.6/1.39.3. The affected element is an unknown function. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2023-37253. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.12.108/6.18.49/7.2.3 and classified as very critical. This vulnerability affects the function nfsd3_proc_setacl of the component NFSv3 ACL Decoder. The manipulation of the argument mask/acl_access/acl_default results in null pointer dereference. This vulnerability is identified as CVE-2026-89671. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in Linux Kernel up to 6.18.50/7.2.3 and classified as very critical. Impacted is the function cifs_check_trans2 of the component SMB Client. This manipulation causes use after free. The identification of this vulnerability is CVE-2026-89637. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability was found in Linux Kernel up to 6.12.108/6.18.49/7.2.3 and classified as very critical. The impacted element is the function dlm_migrate_request_handler of the component ocfs2. The manipulation of the argument namelen/lockname_len/num_locks results in out-of-bounds write. This vulnerability is reported as CVE-2026-89495. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.12.108/6.18.49/7.2.3. It has been classified as very critical. This affects the function hid_sensor_custom_add_attributes of the component Sysfs Group Cleanup. This manipulation causes use after free. The identification of this vulnerability is CVE-2026-89626. The attack can only be executed locally. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability labeled as critical has been found in PostGIS address_standardizer up to 3.7.0. This impacts an unknown function of the file src/gamma.c of the component Address Standardizer. Such manipulation of the argument Weight leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-90775. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in Moritz Bunkus MKVToolNix up to 101.0 and classified as problematic. The affected element is an unknown function of the component ODML Superindex Parser. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability appears as CVE-2026-90783. The attack requires local access. There is no available exploit. Applying a patch is advised to resolve this issue.

A vulnerability categorized as problematic has been discovered in Orthanc DICOM Server up to 1.12.x. This vulnerability affects unknown code. The manipulation results in integer overflow. This vulnerability was named CVE-2026-87020. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability identified as problematic has been detected in dalance procs up to 0.14.12. This affects an unknown function of the component Command Column. This manipulation causes escaping of output. The identification of this vulnerability is CVE-2026-90773. The attack can only be executed locally. There is no exploit available.

A vulnerability, which was classified as problematic, was found in ALSA Project alsa-lib up to 1.2.16.1. This issue affects the function __snd_ctl_ascii_elem_id_parse of the component Control Element Identifier Parsing. Such manipulation of the argument Name leads to stack-based buffer overflow. This vulnerability is documented as CVE-2026-90781. The attack needs to be performed locally. There is not any exploit available. It is best practice to apply a patch to resolve this issue.

A vulnerability described as critical has been identified in Samsung Exynos. Impacted is an unknown function. Executing a manipulation can lead to infinite loop. This vulnerability appears as CVE-2023-37366. The attack requires local access. There is no available exploit.

A vulnerability was found in Paessler PRTG Network Monitor up to 23.3.86.1520. It has been classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to path traversal. This vulnerability is referenced as CVE-2023-45858. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability classified as problematic has been found in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. This vulnerability appears as CVE-2026-90681. The attack requires local access. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability classified as problematic was found in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAG_GPS_LAT/TAG_GPS_LONG leads to heap-based buffer overflow. This vulnerability is traded as CVE-2026-90682. An attack has to be approached locally. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in Extreme Networks IQ Engine up to 10.6r4. It has been declared as very critical. This affects the function ah_event_send of the component Bonjour Gateway. The manipulation results in buffer overflow. This vulnerability is identified as CVE-2023-46273. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. This vulnerability is known as CVE-2026-90683. Attacking locally is a requirement. Furthermore, an exploit is available. It is advisable to upgrade the affected component. This is not a duplicate of CVE-2021-46237 or CVE-2021-46234.