9941 matches found
CVE-2026-37229
FlexRIC v2.0.0 contains a reachable assertion in e2apcreatepdu triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence e.g., a single 0x00 byte over SCTP to the near-RT RIC port 36421 or iApp port 36422 to crash the process via SIGABRT. The...
FlexRIC security vulnerabilities
FlexRIC is an open-source RAN intelligent controller developed by Mosaic5G. Version FlexRIC v2.0.0 contains a security vulnerability. This vulnerability arises from handling RICINDICATION messages that do not contain the ranfuncid field, causing an assert to be triggered or null pointer...
CVE-2026-10300: Reachable Assertion
A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/loramanager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lorapath leads to reachable assertion. The attack can be launched...
CVE-2026-37229: Reachable Assertion
FlexRIC v2.0.0 contains a reachable assertion in e2apcreatepdu triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence e.g., a single 0x00 byte over SCTP to the near-RT RIC port 36421 or iApp port 36422 to crash the process via SIGABRT. The...
CVE-2026-37227: Reachable Assertion
FlexRIC v2.0.0 contains reachable assert0 calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near-RT RIC. A remote unauthenticated attacker can send a decodable E2AP PDU of such a type e.g., E2nodeConfigurationUpdate to crash the near-RT RIC process port...
CVE-2026-37225: Reachable Assertion
FlexRIC v2.0.0 crashes when the iApp receives an E42RICSUBSCRIPTIONREQUEST with an empty ricEventTriggerDefinition field. The E42 layer decoder accepts this as valid, but the E2AP encoder asserts a non-empty constraint when forwarding the request. A remote unauthenticated attacker can crash the...
CVE-2026-37223: Reachable Assertion
FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert. A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp...
CVE-2026-37220: Reachable Assertion
FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2SETUPREQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 node always exists in the cleanup path and enforces this via assert. A remote unauthenticated attacker can crash the near-RT RIC port 36421...
CLSA-2026-1780135072 glibc: Fix of CVE-2026-4046
CVE-2026-4046: fix assertion failure in IBM1390 and IBM1399 iconv modules RHEL-162891. Minimal backport of the iconvdata/ibm1364.c hunks from upstream commit d6f08d1cf027 Red Hat glibc-2.28-251.el810.37, RHSA-2026:20587 — uses the count state variable to store the pending 4-byte UCS-4 code point...
EUVD-2026-33449
The SocketCAN implementation validates the length of a user-provided buffer containing a socketcanframe object using only a NETASSERT statement in zcansendtoctx before dereferencing it in socketcantocanframe. In production builds where assertions are disabled, a userspace application that control...
CVE-2026-5071
The SocketCAN implementation validates the length of a user-provided buffer containing a socketcanframe object using only a NETASSERT statement in zcansendtoctx before dereferencing it in socketcantocanframe. In production builds where assertions are disabled, a userspace application that control...
PT-2026-45078
Name of the Vulnerable Software and Affected Versions SocketCAN affected versions not specified Description The SocketCAN implementation contains an out-of-bounds read issue. The function zcan sendto ctx validates the length of a user-provided buffer containing a socketcan frame object using only...
Zephyr security vulnerabilities
Zephyr is an open-source, scalable real-time operating system RTOS developed by Zephyr. There is a security vulnerability in Zephyr, which stems from the use of NETASSERT for verifying buffer length only in the zcansendtoctx function. Disabling this feature in production builds may lead to...
GHSA-C3M2-JQMQ-PVP3 authentik's XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user
Summary authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed assertion to authenticate as another federated user. Patches authentik 2026.5.1, 2026.2.4 and...
CVE-2026-49381
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible...
CVE-2026-49380
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible...
CVE-2026-49380
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible...
EUVD-2026-33388
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible...