CVE-2025-56364

A use of uninitialized value vulnerability exists in the Matter SDK connectedhomeip before 1.4.0, where the GetDestinationGroupId.Value method is called without first checking whether a value exists. This leads to a crash when an InvokeCommand is sent without initializing the destination group ID...

CVE-2026-57973

creationtimestamp| type| source ---|---|--- 2026-07-14 22:04:52+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:04:18+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-16 12:52:15+00:00| seen|...

JLSEC-2026-714

Two potential heap out-of-bounds write locations existed in DecodeObjectId in wolfcrypt/src/asn.c. First, a bounds check only validates one available slot before writing two OID arc values out0 and out1, enabling a 2-byte out-of-bounds write when outSz equals 1. Second, multiple callers pass...

JLSEC-2026-694 OCSP CertID serial-number length-confusion in `wolfSSL_OCSP_resp_find_status` allows a same-issuer...

OCSP CertID serial-number length-confusion in wolfSSLOCSPrespfindstatus allows a same-issuer SingleResponse whose serial is a prefix of the target serial to be reported as the revocation status of a different certificate. The lookup compared serial-number bytes without first requiring the two...

GHSA-Q3V2-XJ35-9GRX

creationtimestamp| type| source ---|---|--- 2026-07-14 20:12:07+00:00| seen| https://gist.github.com/alon710/57f8fdc68fb17b420e33683532c115ad...

GHSA-2P2F-PX33-4VV5 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

Impact The web handler renderMobileBundle internal/web/handlers.go:1325 passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build internal/mobilebundle/builder.go:54, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build never calls...

nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

Impact The web handler renderMobileBundle internal/web/handlers.go:1325 passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build internal/mobilebundle/builder.go:54, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build never calls...

CVE-2026-50407

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:46+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:36+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:29+00:00| seen|...

CVE-2026-49806

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:39+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:58+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:21+00:00| seen|...

CVE-2026-50355

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:31+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:34+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:13+00:00| seen|...

CVE-2026-50391

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:30+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:55+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:12+00:00| seen|...

CVE-2026-57087

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:27+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 21:10:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqn4l4f3em26 2026-07-14 22:02:18+00:00| seen|...

CVE-2026-55003

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:07+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:33+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:00+00:00| seen|...

CVE-2026-56185

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:04+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:36+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:00:58+00:00| seen|...

CVE-2026-47305

creationtimestamp| type| source ---|---|--- 2026-07-14 19:00:59+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0235 2026-07-14 20:09:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmz5tcsbl24 2026-07-14 22:03:29+00:00| seen|...

CVE-2026-55033

creationtimestamp| type| source ---|---|--- 2026-07-14 19:00:54+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0237 2026-07-14 22:02:18+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:00:48+00:00| seen|...

EUVD-2026-37897

Woodpecker gRPC agentid metadata can be spoofed- cross-tenant agent impersonation...

GHSA-G7MM-9VX7-JM7H Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation

Impact A vulnerability in Woodpecker CI's gRPC layer allowed any authenticated agent to impersonate any other agent on the same server by injecting a forged agentid value into outgoing gRPC metadata. The server correctly verified the JWT token but then discarded the verified agent identity in fav...

CVE-2026-55017

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-15703

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument userid results in sql injection. It is possible to initiate the attack remotely...