CVE-2026-14296 nRF54H20: MCUBoot can be tricked to executing unauthenticated code

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

EUVD-2026-72297

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

CVE-2026-14296

CVE-2026-14296 affects MCUBoot in its bare (upstream) configuration on the nRF54H20 SoC. When using the Direct XIP update strategy, the main application image can start other cores (e.g., the radio core) by providing an address from an unauthenticated slot, because MCUboot may select different sl...

CVE-2026-14296: Improper Verification of Cryptographic Signature

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

PT-2026-86649

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

EUVD-2026-69925

Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...

PT-2026-84686

Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...

CVE-2026-81289: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...

intercept v2.33.0

Support the developer of this open-source project Signal Intelligence Platform A web-based interface for software-defined radio tools. Features Pager Decoding - POCSAG/FLEX via rtlfm + multimon-ng 433MHz Sensors - Weather stations, TPMS, IoT devices via rtl433 Sub-GHz Analyzer - RF capture and...

CVE-2026-81660

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin, in versions prior to 4.5.13 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to validate or escape values submitted to certain optional web form fields (specifically dropdown or radio f...

WordPress Forminator Forms plugin <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) vulnerability

Unauthenticated Stored Cross-Site Scripting via Radio Field Save and Continue Draft vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.57.0.2...

ROS-20260826-73-0004

The vulnerability of the usbsharkprobe function in the drivers/media/radio/radio-shark.c module of the Linux kernel-based multimedia device driver relates to insufficient input data validation. Exploiting this vulnerability could allow an attacker to cause service failures...

CVE-2026-18323

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-65314

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18323 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18323 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18323

The Forminator Forms plugin for WordPress (versions up to and including 1.57.0.2 ) is vulnerable to unauthenticated Stored XSS via the Radio Field "Save and Continue Draft" feature. The root cause is insufficient input sanitization and output escaping: the Save-and-Continue AJAX endpoint is regis...

PT-2026-81189

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18323: Improper Neutralization of Input During Web Page Generation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

Astra Linux – Vulnerability in Linux, Linux 5.10

A flaw was discovered in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability...