CVE-2026-54437
Improper Input Validation in the io-char library's DCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access to cause da
CVSS
6.2
Medium
EPSS
0.2%
p4
KEV
—
Exploit Today
1
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-1287
Not enough EPSS history yet.
Improper Input Validation in the io-char library's DCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access to cause data tampering in the memory input buffer of the Character I/O device driver.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1237109.8 CRI—
———A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.10hCVE-2026-402734.0 MED1.4%
——0Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted message which can cause an information disclosure in the QNX Neutrino kernel1dCVE-2026-632826.5 MED52.5%
——16Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation.2dCVE-2026-145433.9 LOW2.8%
——1The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account.2dCVE-2026-145426.7 MED1.6%
——0The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege
escalation. This flaw can only be exploited after authenticating with an admin-privileged service
account.2dCVE-2026-133129.9 CRI18.9%
——6A vulnerability that could allow an attacker to compromise a system.2d