CVE-2026-68097

Summary: CVE-2026-68097 affects the Linux kernel ksmbd path handling POSIX ACLs. The root cause is a check failure in ACE validation: set_ntacl_dacl() validates sid.num_subauth but does not ensure the declared ACE size can contain all sub-authorities, allowing an undersized ACE to be copied and l...

Security update for perl-Date-Manip

This update for perl-Date-Manip fixes the following issues: CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check bsc1273063. CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in...

CVE-2026-65942

CVE-2026-65942 concerns TLS hostname verification in Apache Ranger Client Code for versions

CVE-2026-44630

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

EUVD-2026-55157

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

CVE-2026-66410

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

CVE-2026-21083

Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...

CVE-2026-66404

DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved...

CVE-2026-21070

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information...

CVE-2026-21073

Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...

CVE-2026-21066

Improper input validation in libcodec2secflacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-60074

A flaw was found in Date::Manip. This vulnerability allows an attacker to provide specially crafted input containing non-ASCII decimal digits to the Date::Manip library for Perl. The library's parsing logic incorrectly processes these digits, truncating the input and resulting in an inaccurate da...

CVE-2026-21060

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles...

CVE-2026-21061

Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...

CVE-2026-21058

Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...

CVE-2026-66410

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

CVE-2026-66410

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

CVE-2026-66410

CVE-2026-66410 affects the Android and iOS ECOVACS PRO App, with improper server certificate validation in the smartphone app. The vulnerability can allow a man-in-the-middle to retrieve and/or alter communications between the app and servers. Connected documents confirm the issue and reference r...

CVE-2026-66406

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege...

EUVD-2026-55113

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege...