2026

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation o

In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privileg

In TFA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of servic

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service

In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local inf

In trusted_mem, there is a possible escalation of privilege due to improper input validation. This could lead to local e

In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of

In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalatio

In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalat

In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (pro

In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalatio

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Re

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also a

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.

In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue als

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issu

In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also aff

In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects

In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This is

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. T

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affect

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue

In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This iss

In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue al

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in.

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of th

In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also a

In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This i

A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions throu

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes vi

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrar

Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/blue

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field th

Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-col

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across AL

FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine p

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowin

better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., B

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey delet

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalize