CVE-2026-3555 Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability

Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this...

CVE-2026-3555

Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this...

CVE-2026-3555

CVE-2026-3555 describes a heap-based buffer overflow in the Zigbee stack of the Philips Hue Bridge. The flaw occurs in the handling of custom Zigbee ZCL frames during Model Info download, due to insufficient validation of data size before copying to a fixed-size heap buffer. This allows network-a...

GHSA-XVX8-77M6-GWG6 OpenClaw: Sandbox `writeFile` commit could race outside the validated path

Summary In affected versions of openclaw, the sandbox fs-bridge writeFile commit step used an unanchored container path during the final move into place. An attacker racing parent-path changes inside the sandbox could redirect the committed file outside the validated sandbox path. Impact This is ...

PT-2026-25393

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, the Zenoh uORB subscriber allocates a stack VLA directly from the incoming payload length without bounds. A remote Zenoh publisher can send an oversized fragmented message to force an unbounded stack allocation and copy,...

📄 Alipay Open Redirect / API Attacker Payload Insertion

A single crafted URL enables a complete attack chain against Alipay mobile application users that can allow for data exfiltration. As the vendor has stated this is normal behavior with no apparent plans to address the problem, this is being published to make users aware. Alipay Mobile App -...

EUVD-2025-208492

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unauthenticated attacker to read files accessible to the...

EUVD-2025-208491

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unauthenticated attacker to read files accessible to the...

CVE-2025-54659

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unauthenticated attacker to read files accessible to the...

CVE-2025-54659

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unauthenticated attacker to read files accessible to the...

CVE-2025-54659

The CVE-2025-54659 entry concerns Fortinet FortiSOAR Agent Communication Bridge (ACB) versions 1.1.0 and 1.0 (all versions) with a Path Traversal (CWE-22) flaw. An unauthenticated attacker can read files accessible to the FortiSOAR user by sending a crafted request to the agent port, due to impro...

CVE-2025-54659

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unauthenticated attacker to read files accessible to the...

[SECURITY] Fedora 43 Update: rust-pythonize-0.27.0-1.fc43

Serde Serializer & Deserializer from Rust Python, backed by PyO3...

Fortinet FortiSOAR Agent Communication Bridge 路径遍历漏洞

The Fortinet FortiSOAR Agent Communication Bridge is an agent communication component of the automation platform developed by Fortinet, a US-based company. Versions 1.1.0 and all versions of 1.0 of the Fortinet FortiSOAR Agent Communication Bridge contain a path traversal vulnerability. This...

CLSA-2026-1773047921 kernel: Fix of 70 CVEs

wifi: iwlwifi: mvm: guard against invalid STA ID on removal CVE-2024-36921 - ASoC: topology: Fix references to freed memory CVE-2024-41069 - net/sched: actmirred: don't override retval if we already lost the skb CVE-2024-26739 - drivers: base: Free devm resources when unregistering a device...

CVE-2026-28468

OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiring gateway authentication, allowing local attackers to access browser control endpoints. A local attacker can enumerate tabs, retrieve...

CVE-2026-30793

Cross-Site Request Forgery CSRF vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android Flutter URI scheme handler, FFI bridge modules allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart,...

PT-2026-23778

Name of the Vulnerable Software and Affected Versions Philips Hue Bridge affected versions not specified Description A heap-based buffer overflow exists in the HomeKit component of the Philips Hue Bridge, specifically within the hk hap pair storage put function. This issue could allow for remote...

(Pwn2Own) Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. User interaction is required to exploit this vulnerability in that the user must initiate the device pairing process. The specific flaw exists within the handling of...

(Pwn2Own) Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the hkhappairstorageput function. The issue results from the lack of proper...