Analysis

A fix in the mvpp2 network driver of the Linux kernel addresses a case where a receive buffer could be returned to the hardware buffer manager after the driver had already handed it to XDP or to a socket buffer. The record says this could let hardware DMA into memory the RX ring no longer owns, and the CNA rates it 9.8 (critical, CVSS 3.1). Commits fixing the issue are linked for several stable branches.

CVE-2026-25150 is a prototype pollution flaw (CWE-1321) in the formToObj() function of the @builder.io/qwik-city middleware in Qwik versions before 1.19.0. The record states that unauthenticated attackers may reach it through crafted HTTP POST requests, with possible consequences including privilege escalation, authentication bypass or denial of service. The issue is patched in 1.19.0, and the record does not list it in CISA KEV.

Langroid versions before 0.59.32 contain a bypass of an earlier fix (CVE-2025-46724) for code injection in the pandas_eval tool used by TableChatAgent. NVD rates the issue CVSS 3.1 9.6 (critical), and the upstream patch is in version 0.59.32. No confirmed exploitation appears in the sources consulted and the CVE is not listed in CISA KEV.

CVE-2026-52811 affects Gogs, a self-hosted Git service, before 0.14.3. The repository file upload function checks for symlinks only on the final path component, unlike sibling file operations, which allows writes outside the intended directory. The CNA rates it critical (CVSS 4.0 score 9), the fix is in 0.14.3, and CISA KEV does not list it.

School ERP Pro 1.0 contains a SQL injection flaw in the es_messagesid parameter, reachable through GET requests. NVD scores it 9.8 under CVSS 3.1 and classifies it as CWE-89. The CISA KEV catalog does not list it, and the record includes no vendor fix.

CVE-2025-59818 is a command injection flaw (CWE-77) in Zenitel Tcis-3 Firmware versions below 9.2.3.3, according to the record. The description says an authenticated user can run arbitrary commands on the underlying system through the file name of an uploaded file. NVD rates it 9.8 (CVSS 3.1) and the CNA rates it 10, but the record lists no fixed version and no confirmed exploitation.

Rocket.Chat versions before the fixed releases can accept an email address supplied in the request when the Apple identity token does not contain one, which the advisory links to account takeover. The CNA rates the issue critical with CVSS 4.0 score 9.3, and the CWE is CWE-287 (Improper Authentication). The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

CVE-2020-37068 is a classic buffer overflow (CWE-120) in the LIST command of Konica Minolta FTP Utility 1.0, according to the VulnCheck record. The record states that the flaw can overwrite system registers, crash the FTP server and potentially allow unauthorized code execution. The CVSS 3.1 base score is 9.8 (critical), and no confirmed exploitation appears in the sources consulted.

CVE-2026-13032 is a use-after-free flaw (CWE-416) in the WebGL component of Google Chrome on Android before 149.0.7827.197. The CNA, Google, reports that a remote attacker could potentially escape the sandbox through a crafted HTML page, and rates the CVSS 3.1 base score at 9.6. No confirmed exploitation appears in the sources consulted, and the record does not list the CVE in CISA KEV.

SiYuan versions before 3.7.0 render some attribute-view (database) cell values without escaping them, which allows stored cross-site scripting. The record states that on the Electron desktop client, where Node integration is enabled, this can extend to code execution on the host. The record identifies 3.7.0 as the fixed version.

CVE-2026-25240 is a SQL injection flaw in the PEAR Pearweb project affecting versions before 1.33.0. The issue occurs in user::maintains() when role filters are passed as an array and inserted into an IN clause. The record states the problem is patched in version 1.33.0, and NVD rates it 9.8 under CVSS 3.1.

The Linux kernel SCTP cookie unpacking code does not fully validate the embedded INIT chunk length, the raw address list length, or address parameter headers, which can lead to out-of-bounds reads (CWE-125). The CNA assigned a CVSS 3.1 score of 9.1 with a network attack vector and no privileges or user interaction required. The record indicates no KEV listing and no confirmed exploitation in the sources consulted.

CVE-2026-53010 is a use-after-free (CWE-416) in the ksmbd SMB server of the Linux kernel, triggered when a durable reconnect releases a file descriptor reference too early in smb2_open. The CNA assigned a CVSS 3.1 base score of 9.8 (critical), with a network attack vector and no privileges or user interaction required. The sources consulted show no confirmed exploitation.

CVE-2020-37080 is a file deletion weakness in the print_layout.php administration component of webTareas 2.0.p8, classified as CWE-73. VulnCheck, the CNA, lists a CVSS 3.1 base score of 9.8 (critical), while the record shows no confirmed exploitation in CISA KEV and no fixed version data.

Rocket.Chat's SAML service provider skips both SAML Response and Assertion signature validation when the IdP certificate field is empty, which is the default setting. The record assigns CVSS 4.0 9.3 (critical) and CWE-347, and states the flaw is fixed in 8.5.0 and several other release lines. The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted.