🚨 CVE-2026-66315
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-66316
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
🎖@cveNotify
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
🎖@cveNotify
🚨 CVE-2026-66317
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.
🎖@cveNotify
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.
🎖@cveNotify
🚨 CVE-2026-66318
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-66321
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-66322
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
🎖@cveNotify
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
🎖@cveNotify
🚨 CVE-2026-66325
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
🎖@cveNotify
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
🎖@cveNotify
🚨 CVE-2026-66326
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-17614
A path traversal flaw was found in WildFly's domain mode
implementation. The LocalFileRepository.getFile() and
getConfigurationFile() methods in
wildfly-core/deployment-repository do not validate that the
resolved file path remains within the configured repository or
configuration root directories. A remote attacker who has
obtained the slave host controller secret or compromised a slave
host controller can supply a crafted relative path containing
directory traversal sequences (e.g., ../../etc/passwd) via the
slave-DC wire protocol, causing the Domain Controller to resolve
and serve arbitrary files readable by the DC process. This leads
to unauthorized disclosure of sensitive information such as
configuration files, keystores, and system credentials.
🎖@cveNotify
A path traversal flaw was found in WildFly's domain mode
implementation. The LocalFileRepository.getFile() and
getConfigurationFile() methods in
wildfly-core/deployment-repository do not validate that the
resolved file path remains within the configured repository or
configuration root directories. A remote attacker who has
obtained the slave host controller secret or compromised a slave
host controller can supply a crafted relative path containing
directory traversal sequences (e.g., ../../etc/passwd) via the
slave-DC wire protocol, causing the Domain Controller to resolve
and serve arbitrary files readable by the DC process. This leads
to unauthorized disclosure of sensitive information such as
configuration files, keystores, and system credentials.
🎖@cveNotify
Redhat
CVE-2026-17614 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-42169
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
🎖@cveNotify
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
🎖@cveNotify
🚨 CVE-2026-18569
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.
🎖@cveNotify
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.
🎖@cveNotify
Redhat
CVE-2026-18569 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-18739
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
🎖@cveNotify
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
🎖@cveNotify
Redhat
CVE-2026-18739 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-68744
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
🎖@cveNotify
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
🎖@cveNotify
🚨 CVE-2026-70368
A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".
🎖@cveNotify
A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".
🎖@cveNotify
Redhat
CVE-2026-70368 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-11368
The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system workqueue (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_sent), where bt_att_sent dereferences the channel and its ATT context (sys_slist_get(&att->reqs)).
When a peer disconnects while an ATT PDU (a server notification/indication or any response) is still in flight in the controller TX path, L2CAP tears the channel down in l2cap_chan_del(): it runs the disconnected callback and then the released callback (bt_att_released), which frees the channel slab slot. Because the in-flight buffer is held by the connection TX path rather than the channel's own queue, its deferred destroy work can run after the channel has been freed. The att_on_sent_cb guard intended to drop the stale callback itself dereferences meta->att_chan, which is now a dangling pointer into a freed (and possibly reused) slab slot.
A remote peer with an ATT connection can drive this by disconnecting during routine ATT traffic; no pairing or user interaction is required to reach the ATT bearer. The result is a use-after-free read/write of freed channel memory, reliably crashing the Bluetooth host (denial of service) and, because the channel slab slot may be reused, potentially corrupting live memory.
The fix makes bt_att_released() NULL the att_chan field of every tx_meta_data_storage[] entry still referencing the channel before freeing it, so the deferred guard observes a NULL pointer and drops the callback. Teardown and the destroy work both run on the cooperative system workqueue, so the array update is serialized and needs no lock.
🎖@cveNotify
The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system workqueue (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_sent), where bt_att_sent dereferences the channel and its ATT context (sys_slist_get(&att->reqs)).
When a peer disconnects while an ATT PDU (a server notification/indication or any response) is still in flight in the controller TX path, L2CAP tears the channel down in l2cap_chan_del(): it runs the disconnected callback and then the released callback (bt_att_released), which frees the channel slab slot. Because the in-flight buffer is held by the connection TX path rather than the channel's own queue, its deferred destroy work can run after the channel has been freed. The att_on_sent_cb guard intended to drop the stale callback itself dereferences meta->att_chan, which is now a dangling pointer into a freed (and possibly reused) slab slot.
A remote peer with an ATT connection can drive this by disconnecting during routine ATT traffic; no pairing or user interaction is required to reach the ATT bearer. The result is a use-after-free read/write of freed channel memory, reliably crashing the Bluetooth host (denial of service) and, because the channel slab slot may be reused, potentially corrupting live memory.
The fix makes bt_att_released() NULL the att_chan field of every tx_meta_data_storage[] entry still referencing the channel before freeing it, so the deferred guard observes a NULL pointer and drops the callback. Teardown and the destroy work both run on the cooperative system workqueue, so the array update is serialized and needs no lock.
🎖@cveNotify
GitHub
Bluetooth: Host: Fix use-after-free in bt_att_sent on disconnect · zephyrproject-rtos/zephyr@dfdea9b
When the peer disconnects mid-transfer, the bt_att and bt_att_chan are
freed (att_chan_detach()/att_reset(), then bt_att_released()) while a
deferred unenhanced-ATT "sent" callbac...
freed (att_chan_detach()/att_reset(), then bt_att_released()) while a
deferred unenhanced-ATT "sent" callbac...
🚨 CVE-2026-10032
The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.
🎖@cveNotify
The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.
🎖@cveNotify
GitHub
`openUrl` permits `javascript:` URI execution via agent-supplied button actions
## `openUrl` permits `javascript:` URI execution via agent-supplied button actions
### Summary
The `openUrl` function in `@a2ui/web_core` passes an agent-controlled URL directly to `window.op...
### Summary
The `openUrl` function in `@a2ui/web_core` passes an agent-controlled URL directly to `window.op...
🚨 CVE-2026-21366
Memory corruption while processing a packet with a size close to the maximum allowed value.
🎖@cveNotify
Memory corruption while processing a packet with a size close to the maximum allowed value.
🎖@cveNotify
🚨 CVE-2026-24076
Memory Corruption when processing registry values with incorrect types using a direct query method.
🎖@cveNotify
Memory Corruption when processing registry values with incorrect types using a direct query method.
🎖@cveNotify
🚨 CVE-2026-24077
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
🎖@cveNotify
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
🎖@cveNotify
🚨 CVE-2026-24078
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
🎖@cveNotify
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
🎖@cveNotify
🚨 CVE-2026-24079
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
🎖@cveNotify
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
🎖@cveNotify