CVE-2026-12052

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

CVE-2026-12051

The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...

CVE-2026-11894

The Realtek BEE Bluetooth HCI driver's send callback, bthcibeesend in drivers/bluetooth/hci/hcibee.c, violated the bthcidriverapi buffer-ownership contract. That contract requires the driver to consume unref the transmit netbuf only on success; on an error return the host caller retains ownership...

OpenEMR < 7.0.1 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. id: CVE-2023-2948 info: name: OpenEMR 7.0.1 - Cross-Site Scripting author: ritikchaddha,princechaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr...

Gradio > 4.19.1 UploadButton - Path Traversal

gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. id: CVE-2024-1728 info: name: Gradio 4.19.1 UploadButton - Path Traversal author: isacaya severity: high description: | gradio-app/gradio is...

CVE-2026-12052

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

EUVD-2026-55967

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

CVE-2026-12052 Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

CVE-2026-12052 Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

CVE-2026-12052 Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

CVE-2026-12052

The CVE-2026-12052 issue affects Zephyr’s USB device CDC NCM class (usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c). The handler builds fixed-size responses for GET_NTB_PARAMETERS (28-byte) and GET_NTB_INPUT_SIZE (8-byte) and copies the entire structure into the control DATA IN b...

CVE-2026-18348

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

CVE-2026-18348 Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

CVE-2026-18348 Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

EUVD-2026-55961

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

CVE-2026-18348 Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

CVE-2026-18348

Velociraptor CVE-2026-18348 involves missing authorization checks in the upload_azure, upload_sftp, and upload_smb VQL plugins. An authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL boundary. This c...

CVE-2026-12051

The CVE affects Zephyr’s USB DFU, specifically the device_next USB device stack. In handle_download() the code dereferences buf without verifying buf is NULL during DFU_DNLOAD with no Data OUT stage (zero-length terminate). This NULL pointer dereference on the control endpoint after transitioning...

CVE-2026-12051 NULL pointer dereference in USB DFU device_next download handler (handle_download)

The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...

CVE-2026-12051 NULL pointer dereference in USB DFU device_next download handler (handle_download)

The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...