CVE-2026-21330

creationtimestamp| type| source ---|---|--- 2026-02-11 11:17:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mele4dy5fx2a...

CVE-2026-0505

The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the...

OSV-2026-229 Segv on unknown address in aiAnimation::~aiAnimation

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=483188619 Crash type: Segv on unknown address Crash state: aiAnimation::aiAnimation aiScene::aiScene Assimp::BaseImporter::ReadFile...

Huawei EMUI and Huawei HarmonyOS Communication Module Address Reading Vulnerability

Huawei EMUI is a mobile operating system developed based on Android.Huawei HarmonyOS is an operating system. Provides a full-scene distributed operating system based on a microkernel. An address reading vulnerability exists in the Huawei EMUI and Huawei HarmonyOS communication module, which can b...

D-Link DIR-600 Command Injection Vulnerability

The D-Link DIR-600 is a wireless router from China's AUO D-Link. A command injection vulnerability exists in D-Link DIR-600 2.15WWb02 and earlier versions, which stems from the failure to properly filter constructed command special characters, commands, etc. in the parameter...

Netty HttpRequestEncoder URL Replacement

The vulnerability of the io.netty.handler.codec.http.HttpRequestEncoder component in the Netty networking framework is related to the failure to handle CRLF sequences when processing the HttpRequestEncoder parameter. Exploiting this vulnerability allows a remote attacker to replace the URL addres...

CVE-2026-1495

CVE-2026-1495 concerns an information-insertion vulnerability in AVEVA PI to CONNECT Agent. The CVE describes that an attacker with Event Log Reader privileges (S-1-5-32-573) can access proxy details, including the proxy URL and credentials, from the PI to CONNECT event log files. This could enab...

CVE-2025-48517

Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality...

CVE-2025-48517

Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality...

UBUNTU-CVE-2025-48517

Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality...

CVE-2025-48517

Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality...

CVE-2025-48517

CVE-2025-48517 concerns AMD SEV firmware where insufficient granularity of access control could let a privileged attacker with a malicious hypervisor create a SEV-ES guest using an ASID reserved for SEV-SNP guests, potentially causing partial confidentiality loss. Reported across multiple sources...

CVE-2025-48517

Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality...

CVE-2026-21528

Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network...

CVE-2026-21528

Binding to an unrestricted ip address in Azure IoT SDK allows an unauthorized attacker to disclose information over a network...

CVE-2026-25993

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / requestpath values—derived from the urlkey stored in the database—into SQL statements via string concatenation and passes them to execute. As a result, if a malicio...

CVE-2026-25993 EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / requestpath values—derived from the urlkey stored in the database—into SQL statements via string concatenation and passes them to execute. As a result, if a malicio...

Azure IoT Explorer Information Disclosure Vulnerability

Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network...

CVE-2026-23720

creationtimestamp| type| source ---|---|--- 2026-02-10 10:17:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3meiqbm6tvf22 2026-02-17 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-048-01...

assimp:assimp_fuzzer_gltf: Heap-buffer-overflow in unsigned long glTF2::Accessor::ExtractData<aiVector3t<float>>

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=4916291875176448 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzergltf Job Type: libfuzzerasanassimp Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...