CVE-2026-13480 Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler

The LoRaWAN TS004 Fragmented Data Block Transport handler fragtransportpackagecallback in subsys/lorawan/services/fragtransport.c parses downlink command bytes without validating that enough payload bytes remain before each access. The loop's only bound is rxpos fragsize, capped at...

ECHO-D7AB-3F98-D4D5 Fixed by bumping the vendored OpenJPH (HTJ2K codec). 3.1.13 has no HTJ2K support and ships no external/OpenJPH.

Bulletin has no description...

WordPress Appointment Hour Booking plugin < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability

Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability discovered by Researcher1: Alessandro Greco aka Aleff; Researcher2: Giovambattista Ianni; Company/Organization: University of Calabria UNICAL in WordPress Plugin Appointment Hour Booking versions 1.5.88...

Path traversal in apimock's file-serving fallback

The file-serving fallback joined a request-derived path onto the configured response directory and checked only that the result existed, never that it stayed inside that directory. A request containing a raw .. segment could read any file readable by the process, returned with HTTP 200. Read-only...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by an improper Unicode handling vulnerability due to Python setuptools

Summary Python setuptools is used by IBM Integrated Analytics System as a package management library for downloading, building, installing, and managing Python packages. CVE-2026-59890 affects setuptools versions prior to 83.0.0, where the FileList class applies MANIFEST.in exclusion directives b...

ECHO-C31D-7527-5AC7

Bulletin has no description...

MINI-78HC-7XVX-P466

Bulletin has no description...

MINI-4HQ5-QX93-F39R

Bulletin has no description...

MINI-RQVX-V4MR-3VJM

Bulletin has no description...

MINI-V2QC-5WFV-JHRR

Bulletin has no description...

CVE-2026-79263

creationtimestamp| type| source ---|---|--- 2026-08-26 05:19:06+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260826 2026-08-31 05:18:25+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260831...

CVE-2026-79233

creationtimestamp| type| source ---|---|--- 2026-08-26 05:17:55+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260826...

CVE-2026-78980

creationtimestamp| type| source ---|---|--- 2026-08-26 04:47:45+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260826 2026-08-31 04:47:49+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260831...

CVE-2026-78908

creationtimestamp| type| source ---|---|--- 2026-08-26 04:45:47+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260826 2026-08-31 04:46:02+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260831...

CVE-2026-62862

creationtimestamp| type| source ---|---|--- 2026-08-26 00:07:47+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtx237f5qa24 2026-08-26 01:25:23+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mtx6fxkvpy2i 2026-08-26 01:40:05+00:00| seen|...

CVE-2026-79912

creationtimestamp| type| source ---|---|--- 2026-08-26 00:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtwzpwfn6i2r 2026-08-26 01:25:26+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mtx6g2uyyj2r...

PT-2026-81952

The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-061550)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-061550 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 5.7.36 and prior and 8.0....

Oracle Linux 9 : mod_http2 (ELSA-2026-59387)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-59387 advisory. 2.0.26-6.2 - Resolves: RHEL-190583 - address CVE-2026-43951 and CVE-2026-48913 in modhttp2 Tenable has extracted the preceding description block...

CVE-2026-13479: Out-of-bounds Read

The LoRaWAN application-layer clock-synchronization service parses downlinks in clocksyncpackagecallback subsys/lorawan/services/clocksync.c. Its command loop only guarantees that the one-byte command id is in bounds; for the CLOCKSYNCCMDAPPTIME AppTimeAns command the handler then reads a 4-byte...