2026

When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has b

NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secu

The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing,

Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **wri

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource

Two client-side TLS/DTLS handshake parsers in NetX Secure read fields from a server-supplied message before validating t

FTP Passive Data Connection Not Bound to the Authenticated Control Peer

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read

Out-of-bounds Read from Unvalidated MSRP Attribute List Length

NULL Pointer Dereference When Evicting the Sole MSRP Attribute

NULL Pointer Dereference on MSRP Attribute Table Exhaustion

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only cov

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram.

A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a kilobyte past the

Predictable DTLS HelloVerifyRequest Cookie in NetX Secure

hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length agains

An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Sessio

Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. Th

`_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmpv6_validate_options.

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes (nxd_tf

On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-lis

Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `

Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dis

Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 unti

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB des

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, t

A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size v

A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its inc

A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL

Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases

Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Jooml

Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4

Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1

Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1

Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did no

Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layo

Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 - A

Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs use

Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template fea

Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -

Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6

Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.

Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of

Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.

Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8,

Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads t

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundati

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bas