🚨 CVE-2026-42169
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
🎖@cveNotify
A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.
🎖@cveNotify
🚨 CVE-2026-18569
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.
🎖@cveNotify
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.
🎖@cveNotify
Redhat
CVE-2026-18569 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-18739
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
🎖@cveNotify
A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
🎖@cveNotify
Redhat
CVE-2026-18739 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-68744
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
🎖@cveNotify
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
🎖@cveNotify
🚨 CVE-2026-70368
A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".
🎖@cveNotify
A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an out-of-bounds stack read and a potential crash. In certain corner cases, the same vulnerability could be used to replace a series of trailing "\n" characters with "\0".
🎖@cveNotify
Redhat
CVE-2026-70368 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-11368
The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system workqueue (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_sent), where bt_att_sent dereferences the channel and its ATT context (sys_slist_get(&att->reqs)).
When a peer disconnects while an ATT PDU (a server notification/indication or any response) is still in flight in the controller TX path, L2CAP tears the channel down in l2cap_chan_del(): it runs the disconnected callback and then the released callback (bt_att_released), which frees the channel slab slot. Because the in-flight buffer is held by the connection TX path rather than the channel's own queue, its deferred destroy work can run after the channel has been freed. The att_on_sent_cb guard intended to drop the stale callback itself dereferences meta->att_chan, which is now a dangling pointer into a freed (and possibly reused) slab slot.
A remote peer with an ATT connection can drive this by disconnecting during routine ATT traffic; no pairing or user interaction is required to reach the ATT bearer. The result is a use-after-free read/write of freed channel memory, reliably crashing the Bluetooth host (denial of service) and, because the channel slab slot may be reused, potentially corrupting live memory.
The fix makes bt_att_released() NULL the att_chan field of every tx_meta_data_storage[] entry still referencing the channel before freeing it, so the deferred guard observes a NULL pointer and drops the callback. Teardown and the destroy work both run on the cooperative system workqueue, so the array update is serialized and needs no lock.
🎖@cveNotify
The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system workqueue (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_sent), where bt_att_sent dereferences the channel and its ATT context (sys_slist_get(&att->reqs)).
When a peer disconnects while an ATT PDU (a server notification/indication or any response) is still in flight in the controller TX path, L2CAP tears the channel down in l2cap_chan_del(): it runs the disconnected callback and then the released callback (bt_att_released), which frees the channel slab slot. Because the in-flight buffer is held by the connection TX path rather than the channel's own queue, its deferred destroy work can run after the channel has been freed. The att_on_sent_cb guard intended to drop the stale callback itself dereferences meta->att_chan, which is now a dangling pointer into a freed (and possibly reused) slab slot.
A remote peer with an ATT connection can drive this by disconnecting during routine ATT traffic; no pairing or user interaction is required to reach the ATT bearer. The result is a use-after-free read/write of freed channel memory, reliably crashing the Bluetooth host (denial of service) and, because the channel slab slot may be reused, potentially corrupting live memory.
The fix makes bt_att_released() NULL the att_chan field of every tx_meta_data_storage[] entry still referencing the channel before freeing it, so the deferred guard observes a NULL pointer and drops the callback. Teardown and the destroy work both run on the cooperative system workqueue, so the array update is serialized and needs no lock.
🎖@cveNotify
GitHub
Bluetooth: Host: Fix use-after-free in bt_att_sent on disconnect · zephyrproject-rtos/zephyr@dfdea9b
When the peer disconnects mid-transfer, the bt_att and bt_att_chan are
freed (att_chan_detach()/att_reset(), then bt_att_released()) while a
deferred unenhanced-ATT "sent" callbac...
freed (att_chan_detach()/att_reset(), then bt_att_released()) while a
deferred unenhanced-ATT "sent" callbac...
🚨 CVE-2026-10032
The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.
🎖@cveNotify
The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default.
🎖@cveNotify
GitHub
`openUrl` permits `javascript:` URI execution via agent-supplied button actions
## `openUrl` permits `javascript:` URI execution via agent-supplied button actions
### Summary
The `openUrl` function in `@a2ui/web_core` passes an agent-controlled URL directly to `window.op...
### Summary
The `openUrl` function in `@a2ui/web_core` passes an agent-controlled URL directly to `window.op...
🚨 CVE-2026-21366
Memory corruption while processing a packet with a size close to the maximum allowed value.
🎖@cveNotify
Memory corruption while processing a packet with a size close to the maximum allowed value.
🎖@cveNotify
🚨 CVE-2026-24076
Memory Corruption when processing registry values with incorrect types using a direct query method.
🎖@cveNotify
Memory Corruption when processing registry values with incorrect types using a direct query method.
🎖@cveNotify
🚨 CVE-2026-24077
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
🎖@cveNotify
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
🎖@cveNotify
🚨 CVE-2026-24078
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
🎖@cveNotify
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.
🎖@cveNotify
🚨 CVE-2026-24079
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
🎖@cveNotify
Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.
🎖@cveNotify
🚨 CVE-2026-24080
Memory Corruption when handling malformed request parameters in the fingerprint TA.
🎖@cveNotify
Memory Corruption when handling malformed request parameters in the fingerprint TA.
🎖@cveNotify
🚨 CVE-2026-24083
Memory Corruption while processing IOCTL device driver requests with invalid arguments.
🎖@cveNotify
Memory Corruption while processing IOCTL device driver requests with invalid arguments.
🎖@cveNotify
🚨 CVE-2026-24084
Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
🎖@cveNotify
Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities.
🎖@cveNotify
🚨 CVE-2026-25288
Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.
🎖@cveNotify
Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.
🎖@cveNotify
🚨 CVE-2026-25289
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
🎖@cveNotify
Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
🎖@cveNotify
🚨 CVE-2026-25292
Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.
🎖@cveNotify
Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.
🎖@cveNotify
🚨 CVE-2026-15314
Tapo P110 v1
smart Wi-Fi Plug contains an improper boundary validation vulnerability in the
handling of authenticated HTTP request bodies due to insufficient input
validation before memory copy operations. This may lead to buffer overflow condition,
causing the web service process to crash.
Successful exploitation
may cause the web service process to stop responding or restart, resulting in a
denial-of-service condition.
🎖@cveNotify
Tapo P110 v1
smart Wi-Fi Plug contains an improper boundary validation vulnerability in the
handling of authenticated HTTP request bodies due to insufficient input
validation before memory copy operations. This may lead to buffer overflow condition,
causing the web service process to crash.
Successful exploitation
may cause the web service process to stop responding or restart, resulting in a
denial-of-service condition.
🎖@cveNotify
TP-Link
Download for Tapo P110 | TP-Link
TP Link - Download Center Detail
🚨 CVE-2026-63455
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
🎖@cveNotify
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
🎖@cveNotify
🚨 CVE-2026-63456
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
🎖@cveNotify
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
🎖@cveNotify