CVE-2026-19740 Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure

The Link Layer Control Procedure LLCP implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LLPHYUPDATEIND so that it can later be reused for the host notification when the update instant is reached llcprxnoderetain in...

CVE-2026-19740

The Zephyr software Bluetooth LE Controller contains a vulnerability in its Link Layer Control Procedure (LLCP) implementation. Specifically, the functions llcp_lp_pu_rx() and llcp_rp_pu_rx() in subsys/bluetooth/controller/ll_sw/ull_llcp_phy.c fail to release a retained receive node when processi...

CVE-2026-19740 Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure

The Link Layer Control Procedure LLCP implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LLPHYUPDATEIND so that it can later be reused for the host notification when the update instant is reached llcprxnoderetain in...

CVE-2026-19738 Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures

The Bluetooth Link Layer Control Procedure LLCP implementation for Connected Isochronous Stream CIS creation retains an RX node ctx-noderef.rx, marked NODERXTYPERETAIN so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LLCISREQ, and on the...

CVE-2026-19738 Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures

The Bluetooth Link Layer Control Procedure LLCP implementation for Connected Isochronous Stream CIS creation retains an RX node ctx-noderef.rx, marked NODERXTYPERETAIN so it can later be reused as the host notification — on the peripheral while awaiting the Host's reply to an LLCISREQ, and on the...

PT-2026-110227

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.4.0 through 3.7.x Description The Link Layer Control Procedure LLCP implementation of the Bluetooth LE Controller fails to release a retained receive node when processing invalid Protocol Data Units PDUs during PHY Update,...

CVE-2026-107838 RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoapfileserver callers in sys/net/applicationlayer/nanocoap/fileserver.c ignore a failure returned by respinit when...

CVE-2026-108105

Open5GS through 2.8.0 contains a reachable assertion vulnerability in mmegnhandlesgsncontextrequest that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can...

CVE-2026-39453

The Red Lion Controls N-Tron 700 Series switch is vulnerable to a Reachable Assertion (CWE-617) flaw. Navigating to a specific URL on the device's web server triggers an automatic reboot. An attacker can automate this action using tools like curl to create a persistent Denial of Service (DoS) con...

CVE-2026-102916 Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vieemulatemovs and vieemulatestos in usr/src/uts/intel/io/vmm/vmminstructionemul.c do not clear the VIESREPEAT status...

EUVD-2026-95795

Open5GS through 2.8.0 contains a reachable assertion vulnerability in mmegnhandlesgsncontextrequest that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can...

EUVD-2026-95700

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...

CVE-2026-97791 Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...

CVE-2026-97791

In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...

PT-2026-108867

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description An issue exists in the STSTokenValidator where the result of the SAML assertion signature check is stored in an object shared...

Oracle Linux 8 : bind9.16 (ELSA-2026-79113)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-79113 advisory. - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NSEC and NSEC3...

Security update for bind

This update for bind fixes the following issues: CVE-2026-19666: Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path bsc1280433. CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dnsncacheadd bsc1280435. CVE-2026-80274: Validating resolver can abort while...

SUSE-SU-2026:4597-1 Security update for bind

This update for bind fixes the following issues: - CVE-2026-19666: Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path bsc1280433. - CVE-2026-19667: Remote assertion failure via 16-bit length truncation in dnsncacheadd bsc1280435. - CVE-2026-80274: Validating resolver can abort whi...

vcenter_saml_login

Strumento di Accesso SAML per vCenter Uno strumento per estrarre il certificato dell'Identity Provider IdP dai backup di vCenter e accedere come Administrator Contesto Comunemente, durante gli engagement, otteniamo accesso ai backup di vCenter su un file server o accesso root all'host VCSA tramit...

CVE-2026-84276

IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the...