2026

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional

In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System exec

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or wr

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a S

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserializa

In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This i

In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also a

In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects B

In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.

In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also af

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forg

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue al

In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This is

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue a

In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local e

In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local es

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of serv

In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (pro

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens

In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue als

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issu

In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This is

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. T

In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affect

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue

In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue al

In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also a

In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This i

A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution.

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions throu

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes vi

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across AL

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine p

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowin

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey delet

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalize

The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operati

The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before str

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the req

The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one o

The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party