CVE-2026-80185 - Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root
CVE ID :CVE-2026-80185
Published : Aug. 25, 2026, 10:17 p.m. | 36 minutes ago
Description :BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
Severity: 5.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-80185
Published : Aug. 25, 2026, 10:17 p.m. | 36 minutes ago
Description :BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
Severity: 5.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-80186 - Bluez: stack overflow in name2utf8 causes dos and potential code execution
CVE ID :CVE-2026-80186
Published : Aug. 25, 2026, 10:17 p.m. | 36 minutes ago
Description :A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-80186
Published : Aug. 25, 2026, 10:17 p.m. | 36 minutes ago
Description :A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-18985 - Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093
CVE ID :CVE-2026-18985
Published : Aug. 25, 2026, 10:19 p.m. | 33 minutes ago
Description :Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-18985
Published : Aug. 25, 2026, 10:19 p.m. | 33 minutes ago
Description :Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-18261 - Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092
CVE ID :CVE-2026-18261
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-18261
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-18260 - Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091
CVE ID :CVE-2026-18260
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-18260
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-18259 - Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
CVE ID :CVE-2026-18259
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-18259
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-15088 - Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089
CVE ID :CVE-2026-15088
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15088
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16645 - PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088
CVE ID :CVE-2026-16645
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16645
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16644 - Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
CVE ID :CVE-2026-16644
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16644
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16643 - Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086
CVE ID :CVE-2026-16643
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16643
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16642 - Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085
CVE ID :CVE-2026-16642
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16642
Published : Aug. 25, 2026, 10:21 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16641 - Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
CVE ID :CVE-2026-16641
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16641
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16646 - PanKM - Critical - Unsupported - SA-CONTRIB-2026-083
CVE ID :CVE-2026-16646
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16646
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16640 - Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
CVE ID :CVE-2026-16640
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16640
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16639 - Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
CVE ID :CVE-2026-16639
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16639
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-16638 - Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
CVE ID :CVE-2026-16638
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-16638
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-55805 - Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
CVE ID :CVE-2026-55805
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-55805
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-15917 - Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
CVE ID :CVE-2026-15917
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15917
Published : Aug. 25, 2026, 10:22 p.m. | 31 minutes ago
Description :Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-15916 - Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
CVE ID :CVE-2026-15916
Published : Aug. 25, 2026, 10:22 p.m. | 30 minutes ago
Description :Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-15916
Published : Aug. 25, 2026, 10:22 p.m. | 30 minutes ago
Description :Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-79912 - TOTOLINK N600R cstecgi.cgi getCurrentTime command injection
CVE ID :CVE-2026-79912
Published : Aug. 25, 2026, 10:30 p.m. | 23 minutes ago
Description :A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-79912
Published : Aug. 25, 2026, 10:30 p.m. | 23 minutes ago
Description :A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be initiated remotely. The exploit is now public and may be used.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-41707 - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
CVE ID :CVE-2026-41707
Published : Aug. 25, 2026, 10:34 p.m. | 18 minutes ago
Description :Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11
Severity: 7.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-41707
Published : Aug. 25, 2026, 10:34 p.m. | 18 minutes ago
Description :Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries by flooding the server with dummy requests, then replay intercepted valid DPoP proofs. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11
Severity: 7.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...