CVE-2026-12366

Summary: CVE-2026-12366 in Zephyr describes a use-after-free in the dynamic object disposal path for kernels objects. When a user-thread holds the last permission on a timer (K_OBJ_TIMER) and frees it, the timer’s memory is released without cancelling its embedded _timeout node from the global _t...

CVE-2026-12366 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal

Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...

CVE-2026-70629

A flaw was found in FFmpeg. An uninitialized heap memory read vulnerability exists in the native RSCC decoder. An attacker can supply a crafted video file with a compressed tile that decompresses fewer bytes than required. This leads to the unwritten portion of an intermediate buffer being copied...

MINI-6C5Q-XQ57-8QWM

Bulletin has no description...

CVE-2026-70630

A flaw was found in FFmpeg. An uninitialized heap memory read vulnerability in the native Screenpresso decoder allows attackers to recover sensitive memory contents. This occurs when a crafted SPV1 packet with a valid zlib stream is supplied, causing the screenpressodecodeframe function to fail i...

MINI-GMX2-C4VW-66HM

Bulletin has no description...

MINI-C527-3VH2-VQGC

Bulletin has no description...

MINI-GXF3-RFGP-CMWM

Bulletin has no description...

MINI-WPCX-2P4Q-5XGH

Bulletin has no description...

MINI-PV4J-Q6MR-M3RH

Bulletin has no description...

MINI-53JH-C6PC-C4WM

Bulletin has no description...

MINI-G256-W99W-MH8P

Bulletin has no description...

CVE-2026-70631

A flaw was found in FFmpeg. An attacker can exploit an uninitialized heap memory disclosure vulnerability in the native TIFF decoder by providing a specially crafted TIFF file. This crafted file can cause the tiffunpackzlib function to include stale data from previous memory allocations in the...

MINI-FQXJ-MVV3-59Q4

Bulletin has no description...

CVE-2026-73633

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny...

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

MINI-Q8J4-XPP3-GJ68

Bulletin has no description...

MINI-H8PW-P7GF-C9G5

Bulletin has no description...

EUVD-2026-58662

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny...

CVE-2026-73633 Apache Struts: Unbounded read of a JSON request body

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny...