MSC-2026-12838

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-12813

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-12815

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-12819

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-12792

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

EUVD-2026-97972

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process...

CVE-2026-19940: Use After Free

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfpag.c keeps its struct bthfpag objects in a static pool indexed by ACL connection index. On link teardown, hfpagdisconnected cancels ag-txwork and the per-call work items and then clears...

PT-2026-111348

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...

CVE-2026-19939: Expired Pointer Dereference

The AVDTP signalling layer arms a 6-second command timeout AVDTPTIMEOUT in avdtpsendcmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeoutwork before clearing the pending request, but btavdtpl2capdisconnected...

CVE-2026-19938: Use After Free

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...

PT-2026-111724

The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp ag.c keeps its struct bt hfp ag objects in a static pool indexed by ACL connection index. On link teardown, hfp ag disconnected cancels ag-tx work and the per-call work items and then clears...

CVE-2026-105390: Improper Resource Locking

Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive...

CloudPanel 2.5.4-3+clp-bookworm Nginx Virtual Host Configuration Injection

CloudPanel Community Edition version 2.5.4-3+clp-bookworm contains an nginx virtual-host configuration injection in the site-settings rootDirectory field. A proof of concept demonstrates authenticated injection of nginx directives leading to root command execution...

CVE-2026-85375: Use After Free

Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...

CVE-2026-96248: Stack-based Buffer Overflow

Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-85373: Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-85375: Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability

Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-88072: Windows Host Guardian Service Elevation of Privilege Vulnerability

Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-96248: Windows Host Guardian Service Denial of Service Vulnerability

Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network...

Microsoft Windows: CVE-2026-85918: Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability

Use after free in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to elevate privileges locally...