CVE-2026-64240 media: rc: igorplugusb: fix control request setup packet

In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f "media: rc: igorplugusb: heed coherency rules" changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA...

CVE-2026-64232 block: recompute nr_integrity_segments in blk_insert_cloned_request

In the Linux kernel, the following vulnerability has been resolved: block: recompute nrintegritysegments in blkinsertclonedrequest blkinsertclonedrequest already recomputes nrphyssegments against the bottom queue, because "the queue settings related to segment counting may differ from the origina...

CVE-2026-55731

Unchecked input for loop condition CWE-606 in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to cause persistent denial of service CPU exhaustion via a crafted SNMP GETNEXT request with...

CVE-2026-12496

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Summary The httplib2 HTTP client library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. A malicious or compromised HTTP server can return a small compressed payload approximately 150 KB that expands to an arbitrarily large size in memory 1...

EUVD-2026-48601

Server-side request forgery ssrf in Data Quality allows an unauthorized attacker to elevate privileges over a network...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through inefficient route matching in the manifest endpoint. An attacker can cause excessive server load and degrade response times by sending unauthenticated targeted requests. Note: This is only...

CVE-2026-55731

Loytec LINX firmware (LINX-A64) versions up to 8.4.16 are affected by an unchecked input for loop condition (CWE-606) in the SNMP agent. The issue allows an unauthenticated remote attacker to cause persistent denial of service (CPU exhaustion) by sending a crafted SNMP GETNEXT request with a larg...

CVE-2026-12496

Loytec LINX firmware (LINX-A64, affected on 8.4.16 and earlier) contains an unauthenticated stored XSS in the OPC XML-DA server statistics. A crafted User-Agent header in a POST /da request can execute arbitrary JavaScript in an administrator’s browser, enabling session hijacking, credential thef...

CVE-2026-12496 Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

EUVD-2026-48589

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

CVE-2026-12496

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

CVE-2026-45815

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response BLEATTOPREADMULTVARRSP may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through...

CVE-2026-45816

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts otherwise assert would trigger before NULL dereference and bogus or misbehaving controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are...

CVE-2026-45816

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts otherwise assert would trigger before NULL dereference and bogus or misbehaving controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are...

CVE-2026-45816 Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts otherwise assert would trigger before NULL dereference and bogus or misbehaving controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are...

CVE-2026-45816

A NULL Pointer Dereference vulnerability exists in Apache NimBLE during the LE Long Term Key Request event. This flaw is triggered by a bogus or misbehaving controller and specifically requires disabled asserts to occur, as an active assert would normally trigger before the dereference. The issue...

CVE-2026-45815

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response BLEATTOPREADMULTVARRSP may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through...

Why AI Needs a “Genie Coefficient”

This essay was written with Barath Raghavan, and originally appeared inIEEE Spectrum. Major benchmarks measure what AI can do. None measure whether it does what you mean: the distance between what you ask an AI to do and the unspoken assumptions about how you want the AI to do it. We propose a ne...

laravel-threat-detection v1.4.0

Laravel Threat Detection Passive intrusion detection for Laravel — see every SQL injection, XSS, scanner, and bot probe hitting your app, logged with full context. It's an IDS, not a WAF: it never blocks, filters, or modifies a request. Drop it into any Laravel 10–13 app and it starts scanning...