CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ(NVD、OSV、GitHub)を、CVSS、EPSS、実際に悪用されているか(CISA KEV)とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 03/11/2026 |
| CVE-2026-99250 | In the Linux kernel, the following vulnerability has been resolved:
printk: Postpone kthread startup
There have been various bug reports related to SMP systems hanging
on boot. The reports vary but seem to have some overlap with regard
to missed IPI's during SMP setup. The reports also show that
reverting NBCON conso | 03/11/2026 |
| CVE-2026-99249 | In the Linux kernel, the following vulnerability has been resolved:
pid_namespace: make zap_pid_ns_processes() freezable
When the init of a pid namespace exits, zap_pid_ns_processes() waits
until all other pids in the namespace are freed. A tracer outside the
namespace that does not reap its traced zombies keeps thos | 03/11/2026 |
| CVE-2026-99248 | In the Linux kernel, the following vulnerability has been resolved:
i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
The devres conversion replaced manual pm_runtime_enable()/disable() with
devm_pm_runtime_set_active_enabled() and dropped the remove-time runtime
PM teardown. The managed release tears r | 03/11/2026 |
| CVE-2026-99247 | In the Linux kernel, the following vulnerability has been resolved:
tracing: Do not initialize tracefs work if tracing is disabled
If trace buffer allocation fails during early boot (e.g. in
early_trace_init() -> allocate_trace_buffers()), tracing_disabled is
left set to 1 and the global trace array events list rema | 03/11/2026 |
| CVE-2026-99246 | 高8.1 | In the Linux kernel, the following vulnerability has been resolved:
tipc: protect node reset trace dump with node lock
The tipc_node_reset_links trace event asks tipc_node_dump() to walk the
node's link entries. Unlike the other node events that request link data,
this event runs without the node lock.
This permits | 03/11/2026 |
| CVE-2026-99245 | In the Linux kernel, the following vulnerability has been resolved:
KEYS: Fix key_reject_and_link() race with keyring restriction
The restrict_link check in key_reject_and_link() is done before taking
the keyring semaphore, racing with a concurrent keyring_restrict()
that installs the restriction while holding the se | 03/11/2026 |
| CVE-2026-99244 | In the Linux kernel, the following vulnerability has been resolved:
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
Since commit 7fea700e04bd ("zap_pid_ns_processes: clear
TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processes()
clears TIF_NOTIFY_SIGNAL before every kernel_wait4() ca | 03/11/2026 |
| CVE-2026-114442 | 中6.5 | Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied | 03/11/2026 |
| CVE-2026-89293 | 高8.8 | In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling the connected and authenticated Mnestix AAS Generator backend | 03/11/2026 |
| CVE-2026-89292 | 緊急9.2 | In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures. | 03/11/2026 |
| CVE-2026-89229 | 中5.1 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing | 03/11/2026 |
| CVE-2026-77778 | 高7.1 | ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults. | 03/11/2026 |
| CVE-2026-77777 | 高7.1 | ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials. | 03/11/2026 |
| CVE-2026-77691 | 高8.1 | ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA | 03/11/2026 |
| CVE-2026-120333 | 高8.8 | The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend use | 03/11/2026 |
| CVE-2026-120332 | 中5.1 | The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report. | 03/11/2026 |
| CVE-2026-120331 | 中5.3 | Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network. | 03/11/2026 |