CVE-2026-10848 Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)

The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parserpcmsg subsys/net/lib/ocpp/ocppj.c using a hand-rolled helper, extractstringfield, that copied the message's uid and action fields with strncpyoutbuf, token + 1, outlen - 1 and then scanned the result with...

UBUNTU-CVE-2026-9335

A vulnerability in keras-team/keras versions = 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.loadweights functions bypass the safegeth5group and safegeth5dataset helpers, which are designed to reject...

CVE-2026-9335 Improper Handling of HDF5 ExternalLinks in keras-team/keras

A vulnerability in keras-team/keras versions = 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The KerasFileEditor and keras.saving.loadweights functions bypass the safegeth5group and safegeth5dataset helpers, which are designed to reject...

PT-2026-67346

Name of the Vulnerable Software and Affected Versions keras-team/keras versions prior to 3.14.1 Description Improper handling of HDF5 ExternalLinks allows for arbitrary local HDF5 file content disclosure. The KerasFileEditor and keras.saving.load weights functions bypass the safe get h5 group and...

OESA-2026-3213 mozjs102 security update

SpiderMonkey is the code-name for Mozilla Firefox's C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. Security Fixes: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a...

OESA-2026-3214 mozjs102 security update

SpiderMonkey is the code-name for Mozilla Firefox's C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. Security Fixes: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a...

kernel: fanotify: fix false positive on permission events

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the fsnotifygetmarksafe function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventin...

Chromium: CVE-2026-17799 Insufficient validation of untrusted input in Safe Browsing

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-43832

Full details and mitigation steps are currently restricted and will be published at a later date...

CVE-2026-63223

CodeIgniter (PHP framework) prior to version 4.7.4 is affected by an upload validation bypass in the is_image and mime_in rules. If an application preserves the client-supplied filename and stores uploads in a web-accessible, script-enabled directory, a remote attacker could upload executable con...

CVE-2026-43832

CVE-2026-43832 involves a stack-based buffer overflow in the Cookie parsing methods of an unspecified software product. Successful exploitation could allow an unauthenticated attacker to conduct code execution when the SafeEnhancement feature is enabled. Specific details regarding the affected ve...

EUVD-2026-51389

Full details and mitigation steps are currently restricted and will be published at a later date...

CVE-2026-43832 tbc

Full details and mitigation steps are currently restricted and will be published at a later date...

CVE-2026-43829

CVE-2026-43829 describes a stack-based buffer overflow within the password functionality of an unspecified software component. Successful exploitation could allow an unauthenticated attacker to achieve code execution when the SafeEnhancement feature is enabled. While most documents state that ful...

EUVD-2026-51385

Full details and mitigation steps are currently restricted and will be published at a later date...

SUSE CVE-2026-17799

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a malicious file. Chromium security severity: Medium...

The vulnerability of the SAFE_FOR_TEMPLATES() function in the JavaScript library for safe cleaning and protection of HTML code by DOMPurify, allowing attackers to execute arbitrary code.

The vulnerability of the SAFEFORTEMPLATES function in the JavaScript library for safe cleaning and protection of DOMPurify’s HTML code is related to the lack of protective measures for website structures. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

PT-2026-66671

Successful exploitation of the vulnerability could allow an unauthenticated attacker to exploit a stack-based buffer overflow in the password functionality to conduct code execution when the SafeEnhancement feature is enabled...

PT-2026-66674

Successful exploitation of the vulnerability could allow an unauthenticated attacker to exploit a stack-based buffer overflow in the Cookie parsing methods to conduct code execution when the SafeEnhancement feature is enabled...

📄 Trilium Notes 0.102.1 Remote Code Execution

A proof of concept exploit for Trilium Notes TriliumNext versions 0.102.1 and earlier that contain a remote code execution vulnerability. The exploit imports a crafted Trilium export archive that bypasses the application's safe import protections through a path traversal and stored cross site...