CVE-2026-20481: Out-of-bounds Write

In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965373; Issue ID: MSV-6935...

CVE-2026-20467: Exposed Dangerous Method or Function

In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue ID: MSV-6767...

PT-2026-67345

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a...

PT-2026-67178

In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981478 Note: For MT6890, MT6990, MT6988 / AUTO00851173 Note: For...

CVE-2026-20470: Improper Export of Android Application Components

In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11086431; Issue ID: MSV-8189...

PT-2026-67387

Name of the Vulnerable Software and Affected Versions Check Point Security Management Server affected versions not specified Check Point Multi-Domain Security Management Server MDS affected versions not specified Description An authentication bypass allows an unauthenticated remote attacker with...

CVE-2026-12802: Improper Validation of Integrity Check Value

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...

PT-2026-67153

Name of the Vulnerable Software and Affected Versions wlan AP driver affected versions not specified Description A missing bounds check in the wlan AP driver allows for an out-of-bounds write. This condition can be exploited by a remote attacker in proximal or adjacent network positions to achiev...

CVE-2026-20485: Out-of-bounds Write

In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11049569; Issue ID: MSV-7931...

PT-2026-67185

Name of the Vulnerable Software and Affected Versions geniezone affected versions not specified Description A missing permission check allows for a local escalation of privilege. This issue can be exploited by a malicious actor who has already obtained System privilege, and it does not require us...

PT-2026-67158

In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11086431; Issue ID: MSV-8189...

PT-2026-67561

Time-of-check time-of-use toctou race condition in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

PT-2026-67019

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Description The MLS wire decoder allocates memory based on an opaque length declared by an attacker before performing a bounds check. This behavior can lead to excessive memory allocation...

CVE-2026-20477: Out-of-bounds Write

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11009963; Issue ID: MSV-7658...

CVE-2026-20488: Out-of-bounds Read

In display, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7757...

CVE-2026-59642: Improper Validation of Integrity Check Value

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X seri...

CVE-2026-58061: Improper Validation of Integrity Check Value

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

PT-2026-67172

In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11053160; Issue ID: MSV-8004...

CVE-2026-12803: Improper Validation of Integrity Check Value

In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross-nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

PT-2026-67397

Name of the Vulnerable Software and Affected Versions GL.iNet GL-MT3000 versions prior to 4.4.6 Description Command injection is possible via remote exploitation in the ovpn-client.so Native Plugin. The issue exists within the ovpn-client.check config function located in the /cgi-bin/glc file,...