CVE-2026-56568

The CVE-2026-56568 entry concerns HCL iControl and a vulnerability that exposes verbose client-side API error messages. Affected component: the application’s error handling/display logic may reveal internal endpoint names, request parameters, error codes, and authentication status to users instea...

EUVD-2026-51542

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

CVE-2026-56568 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

EUVD-2026-51554

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

CVE-2026-10685 Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

Microsoft Edge (Chromium-based) Tampering Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

Microsoft Edge (Chromium-based) Tampering Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering over a network...

CVE-2026-9611

REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

PT-2026-66765

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

The vulnerability of the amd_isp_dw_i2c_plat_probe() function in the drivers/i2c/busses/i2c-designware-amdisp.c driver for the I2C hardware interface of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the amdispdwi2cplatprobe function in the drivers/i2c/busses/i2c-designware-amdisp.c driver for the I2C hardware interface of the Linux operating system is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability could allo...

Oracle Linux 9 : kernel (ELSA-2026-45192)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-45192 advisory. - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Aidan Wallace RHEL-213468 CVE-2026-63807 - KVM: x86: Don't recheck L1...

IBM Langflow OSS configuration error vulnerability

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

PT-2026-66768

HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors to be generated...

The vulnerability of the leave_alt-screen() function in the drivers/tty/vt/vt.c file of the Linux kernel-based virtual terminal driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the leavealt-screen function in the drivers/tty/vt/vt.c module of the Linux kernel virtual terminal driver framework is related to an incorrect calculation of the buffer size. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

CVE-2026-63033

A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObjectParseObjectAddress to read one byte past the end of the heap-allocated message buffer...

CVE-2026-61526

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute...

CVE-2026-61526 AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute...