CVE-2026-50278 iccDEV: CIccEmbedIO::Read8() size_t underflow

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a CIccEmbedIO::Read8 sizet underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing icSigEmbeddedV5ProfileTag data with...

CVE-2026-50278 iccDEV: CIccEmbedIO::Read8() size_t underflow

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a CIccEmbedIO::Read8 sizet underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing icSigEmbeddedV5ProfileTag data with...

CVE-2026-50278

iccDEV versions prior to 2.3.2.1 contain a size_t underflow in CIccEmbedIO::Read8(), triggered when parsing ICC profiles that include icSigEmbeddedV5ProfileTag data with icSigEmbeddedProfileType payloads. The defect is an embedded-profile read issue that can lead to denial of service (availabilit...

CVE-2026-50278 iccDEV: CIccEmbedIO::Read8() size_t underflow

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a CIccEmbedIO::Read8 sizet underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing icSigEmbeddedV5ProfileTag data with...

Linux Distros Unpatched Vulnerability : CVE-2026-73258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input...

CVE-2026-27875: Cleartext Storage of Sensitive Information in Memory

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...

PT-2026-79390

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions prior to 2.3.2.1 have a CIccEmbedIO::Read8 size t underflow. The issue arises due to an embedded-profile read defect when parsing ICC profiles containing icSigEmbeddedV5ProfileTag data with...

MINI-2XV6-HW46-48X7

Bulletin has no description...

DEBIAN-CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-73253

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

CVE-2026-73256

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The httpcb function in src/http.c tests hm.proto.len with an...

CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73257

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The clcount and tecount checks in the mghttpparse and httpcb paths in src/http.c accept both...

CVE-2026-73255 Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

MINI-HXGP-3834-2FP8

Bulletin has no description...

EUVD-2026-63119

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language HTML source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerabilit...

EUVD-2026-63117

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect...

EUVD-2026-63118

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the...

cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces...