CVE-2026-45813

Out-of-bounds Write, Integer Underflow Wrap or Wraparound vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearb...

CVE-2026-46452

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version...

CVE-2026-46452 Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version...

EUVD-2026-48567

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version...

CVE-2026-45816

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts otherwise assert would trigger before NULL dereference and bogus or misbehaving controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are...

CVE-2026-45815

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response BLEATTOPREADMULTVARRSP may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through...

EUVD-2026-48565

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response BLEATTOPREADMULTVARRSP may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through...

CVE-2026-45813 Apache NimBLE: Incorrect data validation in BASS add/modify source operation

Out-of-bounds Write, Integer Underflow Wrap or Wraparound vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearb...

CVE-2026-45813

CVE-2026-45813 covers an out-of-bounds write and integer underflow in the Apache NimBLE BASS service. The issue arises from improper validation when parsing the BASS service “Add Source” and “Modify Source” PDUs, which can cause a stack buffer overflow or arbitrary out-of-bounds read. It is trigg...

CVE-2026-45812 Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler

Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...

EUVD-2026-48585

Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...

CVE-2026-45811 Apache NimBLE: Buffer overflow in socket HCI transport

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either...

CVE-2026-45811

CVE-2026-45811: Buffer Copy without Checking Size of Input in Apache NimBLE's HCI socket transport allows a buffer overflow because the received HCI event might not fit the configured event pool. Affects NimBLE up to version 1.9.0; upgrade to 1.10.0 to fix. Exploitation requires either a misconfi...

PT-2026-64284

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version...

PT-2026-64282

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response BLE ATT OP READ MULT VAR RSP may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE:...

PT-2026-64280

Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...

PT-2026-64283

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts otherwise assert would trigger before NULL dereference and bogus or misbehaving controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are...

Uncaught Exception

Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Uncaught Exception via the receiveloop function in the shared/session.py file. An attacker can cause the server to crash and require a restart by deliberately triggering an exception after establishin...

CVE-2023-51784

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick 1 to solve it. 1...

PT-2024-30938 · Microcks · Microcks

Name of the Vulnerable Software and Affected Versions: Microcks versions prior to 1.10.0 Description: The issue allows non-administrator access to the "POST /api/import" and "POST /api/export" endpoints. Recommendations: For versions prior to 1.10.0, update to version 1.10.0 or later to resolve t...