CVE-2026-95109 Cortex-A7 module data validation checks only the first address of a caller-supplied range

The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating one address — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and...

CVE-2026-95109 Cortex-A7 module data validation checks only the first address of a caller-supplied range

The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating one address — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and...

CVE-2026-95109

The Cortex-A7 MMU Modules port contains a data validation flaw where it only translates the first byte of a caller-supplied buffer instead of the entire range. While the Module Manager provides the start address and complete byte size, the Cortex-A7 implementation discards the size, allowing memo...

EUVD-2026-105145

The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating one address — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and...

CVE-2026-92843 Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

EUVD-2026-105140

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CVE-2026-92843 Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CVE-2026-92843 Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CVE-2026-92843

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure allows a malicious TLS 1.3 server to trigger an unsigned-integer underflow . This results in a heap out-of-bounds read in any peer processing a remote Certificate message. The vulnerability is reachable pre-authentica...

CVE-2026-92843

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CVE-2026-92853

The NetX Secure TLS 1.3 Certificate-message parser is vulnerable to an out-of-bounds read due to an integer underflow . The parser decrements the message length to skip a context byte without verifying if a byte exists; a zero-length Certificate message causes the unsigned length to wrap to 0xFFF...

CVE-2026-92853 Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows...

EUVD-2026-105133

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows...

CVE-2026-92853 Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows...

CVE-2026-92853

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to "0xFFFFFFFF", which makes the bounds check that follo...

CVE-2026-92853 Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows...

CLSA-2026-1792508765 bluez: Fix of 5 CVEs

CVE-2026-19774: fix stack-based buffer overflow in A2DP remote stream endpoint codec capability storage and validate cached capabilities on load - CVE-2026-75032: fix out-of-bounds read in AVRCP GetFolderItems response parsing by bounding media item and folder names to the received packet length...

EUVD-2026-105130

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

CVE-2026-91057 Out-of-bounds read when a multi-line text view string ends with a carriage return

gxmultilinetextviewdisplayinfoget reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return \r. The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in...

CVE-2026-91057 Out-of-bounds read when a multi-line text view string ends with a carriage return

gxmultilinetextviewdisplayinfoget reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return \r. The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in...