1909 matches found
CVE-2026-13212
The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...
CVE-2026-13212
The Zephyr RTOS virtio driver contains an out-of-bounds read in virtio_isr() (drivers/virtio/virtio_common.c). The device-written descriptor-chain head id from the used ring is used directly as an index into recv_cbs[] and desc[] without a bounds check. A malicious or compromised virtio backend (...
CVE-2026-13212 Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id
The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...
EUVD-2026-64925
The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...
CVE-2026-13212: Improper Validation of Array Index
The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...
CVE-2026-72703: Always-Incorrect Control Flow Implementation
The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between the different bodies of that fixpoint. finduniformparameters in kernel/inductive.ml inspects only self-recursive calls, so when no body calls itself the function concludes th...
CVE-2026-19874: Heap-based Buffer Overflow
A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kicknum" to determine the number of...
CVE-2026-72705: Always-Incorrect Control Flow Implementation
The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function t...
CVE-2026-46457
A flaw was found in Apache Camel NATS component. Due to improper input validation, a client capable of publishing to a NATS subject can inject arbitrary Camel control headers into the Camel Exchange. These injected headers can then influence the behavior of downstream producers in the route,...
CVE-2026-12522: Out-of-bounds Write
The HL7800 cellular modem driver's +CGCONTRDP: response handler oncmdatcmdinfoipaddr in drivers/modem/vendorstandalone/hl7800.c parses the PDP-context dynamic parameters local address, subnet mask, gateway, and DNS servers that the cellular network assigns to the device. The response is linearize...
ROS-20260819-73-0050
The vulnerability in Tomcat is related to the implementation of incorrect control flow. Exploiting this vulnerability allows a remote attacker to cause service interruptions...
ROS-20260819-73-0051
The vulnerability in Tomcat10 is related to the implementation of incorrect control flow. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
ROS-20260819-73-0057
The vulnerability in Tomcat10 is related to the implementation of incorrect control flow. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
ROS-20260819-73-0056
The vulnerability in Tomcat is related to the implementation of incorrect control flow. Exploiting this vulnerability allows a remote attacker to cause service interruptions...
ROS-20260819-73-0058
The vulnerability in Tomcat11 is related to the implementation of incorrect control flow. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...
ROS-20260819-73-0052
The vulnerability in Tomcat11 is related to the implementation of incorrect control flow. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
Summary When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...
ANT-2026-C6E98TYX · liboqs · Uninitialized Function Pointer (CWE-824)
other high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-C6E98TYX: 01-liboqs-ntru-uninit-fn-ptr The NTRU constructors in...
ANT-2026-QRPT15J8 · duckdb · Stack-buffer-overflow
stack-buffer-overflow high Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-QRPT15J8: Stack-buffer-overflow in...