CVE-2026-12519 Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in oncmdsocknotifyev drivers/modem/vendorstandalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via netbuflinearize, which caps the copy at 39 bytes and returns outlen = 39. The two...

CVE-2026-12519 Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in oncmdsocknotifyev drivers/modem/vendorstandalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via netbuflinearize, which caps the copy at 39 bytes and returns outlen = 39. The two...

CVE-2026-12519

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in oncmdsocknotifyev drivers/modem/vendorstandalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via netbuflinearize, which caps the copy at 39 bytes and returns outlen = 39. The two...

CVE-2026-12519 Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in oncmdsocknotifyev drivers/modem/vendorstandalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via netbuflinearize, which caps the copy at 39 bytes and returns outlen = 39. The two...

CVE-2026-9771

The flashcopy system call is verified by zvrfyflashcopy in drivers/flash/flashutil.c. On builds with CONFIGUSERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer KSYSCALLMEMORYWRITE and passed the two struct...

CVE-2026-9771 Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation

The flashcopy system call is verified by zvrfyflashcopy in drivers/flash/flashutil.c. On builds with CONFIGUSERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer KSYSCALLMEMORYWRITE and passed the two struct...

CVE-2026-9771 Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation

The flashcopy system call is verified by zvrfyflashcopy in drivers/flash/flashutil.c. On builds with CONFIGUSERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer KSYSCALLMEMORYWRITE and passed the two struct...

CVE-2026-9771

The flashcopy system call is verified by zvrfyflashcopy in drivers/flash/flashutil.c. On builds with CONFIGUSERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer KSYSCALLMEMORYWRITE and passed the two struct...

EUVD-2026-60268

The flashcopy system call is verified by zvrfyflashcopy in drivers/flash/flashutil.c. On builds with CONFIGUSERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer KSYSCALLMEMORYWRITE and passed the two struct...

CVE-2026-12630

Zephyr's 6LoWPAN IP Header Compression IPHC uncompression code contains an out-of-bounds read in getihpcinlinedsize subsys/net/ip/6lo.c. The destination inline size is looked up in dainlinesizetable, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC...

CVE-2026-12630 6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode

Zephyr's 6LoWPAN IP Header Compression IPHC uncompression code contains an out-of-bounds read in getihpcinlinedsize subsys/net/ip/6lo.c. The destination inline size is looked up in dainlinesizetable, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC...

CVE-2026-12630 6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode

Zephyr's 6LoWPAN IP Header Compression IPHC uncompression code contains an out-of-bounds read in getihpcinlinedsize subsys/net/ip/6lo.c. The destination inline size is looked up in dainlinesizetable, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC...

EUVD-2026-60267

Zephyr's 6LoWPAN IP Header Compression IPHC uncompression code contains an out-of-bounds read in getihpcinlinedsize subsys/net/ip/6lo.c. The destination inline size is looked up in dainlinesizetable, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC...

CVE-2026-12630 6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode

Zephyr's 6LoWPAN IP Header Compression IPHC uncompression code contains an out-of-bounds read in getihpcinlinedsize subsys/net/ip/6lo.c. The destination inline size is looked up in dainlinesizetable, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC...

CVE-2026-12630

Zephyr's 6LoWPAN IP Header Compression IPHC uncompression code contains an out-of-bounds read in getihpcinlinedsize subsys/net/ip/6lo.c. The destination inline size is looked up in dainlinesizetable, which has 13 entries, using an index built from the M, DAC and DAM bits of the received IPHC...

CVE-2026-75060

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools...

CVE-2026-75059

In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible...

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75044

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-73646

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...