CVE-2026-71264

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

CVE-2026-71264

CVE-2026-71264 affects WLED. The GET /json/cfg endpoint discloses the device’s general configuration (network, hardware, LED setup) to any unauthenticated client because it calls serveJson() without a settings-PIN check, unlike the /edit endpoint which enforces correctPIN. Additionally, the globa...

CVE-2026-71256

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71255

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71256 nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

EUVD-2026-53332

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71255 nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71255 nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71255

NanoMODBUS up to v1.23.0 contains a client-side out-of-bounds write in nanomodbus.c: recv_read_device_identification_res() uses server-provided object_length (0–246) to copy data, but only validates against remaining PDU, not against caller buffers_length. After strncpy(buffers_out[buf_index], st...

EUVD-2026-53333

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71255 nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71256

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71256

nanoMODBUS v1.23.0 is affected by an out-of-bounds stack read that enables a wild-pointer write via object_id handling in nanomodbus.c (nmbs_read_device_identification_basic()/recv_read_device_identification_res). A fixed 3-element array order maps object_id to buffer indices; server-provided obj...

CVE-2026-71255

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71256 nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-64580

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

CVE-2026-64571

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...

CVE-2026-64571

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...

UBUNTU-CVE-2026-64580

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

CVE-2026-64580 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...