CVE-2026-57159

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

CVE-2026-57159 PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

CVE-2026-57159

PJSIP is an open-source multimedia communication library in C. Prior to commit 673b978 , a crafted remote SDP offer or answer can trigger an out-of-bounds read and write in assign_pt_and_update_map() within pjmedia/src/pjmedia/sdp_neg.c, which indexes fixed-size internal tables using payload-type...

CVE-2026-57159 PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

EUVD-2026-71653

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

AZL-99522 CVE-2026-80801 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...

CVE-2026-80801

CVE-2026-80801 affects the Linux kernel's NFC microread driver. The function microread_target_discovered() parses target discovery payloads from skb->data according to the HCI gate, but fixed field offsets and UID copies were validated only against the destination nfc_target buffers rather tha...

EUVD-2026-71236

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...

CVE-2026-80801 nfc: microread: validate target discovery payload lengths

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...

CVE-2026-80801 nfc: microread: validate target discovery payload lengths

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...

CVE-2026-80801

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...

CVE-2026-85598

Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent...

CVE-2026-85598 Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages

Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent...

CVE-2026-85598 Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages

Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig-assembled XSS payloads. Attackers with page-edit rights can create modular pages with malicious Twig code that executes in visitor browsers when the parent...

MAL-2026-15925 Malicious code in tailwind-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5 The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at...

Malicious code in tailwind-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5 The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-good (UTSA-2026-106456)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106456 advisory. GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

Linux Distros Unpatched Vulnerability : CVE-2026-80801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. Th...

CVE-2026-85593: Improper Neutralization of Input During Web Page Generation

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks that calls htmlentitydecode on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that...

CVE-2026-85438

MOOS-IvP through version 24.8.1 is affected by a buffer overflow vulnerability in StringToIvPFunction() , where dimension, piece, and degree counts from encoded BHV_IPF payloads are used as allocation sizes and loop bounds without validation. An attacker can supply crafted payloads with mismatche...