CVE-2026-40855 Command Injection in T-Mobile 5G Box IDU router via ping functionality

WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the pingip, pingsize, and pingtimes POST parameters. The root cause is the failure to verify and sanitize...

AZL-101256 CVE-2026-89878 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob fw-datafwsize - 8 and fwsize - 4. If the firmware file is shorter than 8...

AZL-101142 CVE-2026-89853 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump qla2x00freefcetrace freed and cleared ha-fce while holding only fcemutex. The firmware-dump consumers qla27xxfwdtentryt264 and qla25xxcopyfce read ha-fce NULL check...

CVE-2026-86585

The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker who controls the delivery of an update to install unauthorised firmware...

EUVD-2026-80478

In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob fw-datafwsize - 8 and fwsize - 4. If the firmware file is shorter than 8...

CVE-2026-89878

CVE-2026-89878 affects the Linux kernel media: s2255 driver. In s2255_probe(), the function reads a 4-byte marker and version from the last 8 bytes of the firmware blob (fw->data[fw_size - 8] and [fw_size - 4]). If the firmware file is shorter than 8 bytes, fw_size - 8 underflows , causing an ...

CVE-2026-89878 media: s2255: check firmware size before reading trailing marker

In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob fw-datafwsize - 8 and fwsize - 4. If the firmware file is shorter than 8...

CVE-2026-89842 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started qlanvmexmtlsrsp bails out to the out: label when firmware is not started !ha-flags.fwstarted, but the out: path unconditionally calls qlanvmelsrejectiocb, which ends in...

CVE-2026-89826 drm/panthor: harden firmware build-info bounds checks

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthorfwreadbuildinfo checks whether the metadata range fits in the firmware image with hdr.metastart + hdr.metasize. Both fields are u32, so the addition can wrap and let an...

CVE-2026-89826

This vulnerability affects the Linux kernel 's drm/panthor GPU driver, specifically the panthor_fw_read_build_info() function. Two related flaws allow an out-of-bounds memory read: (1) the metadata range validation uses addition of two u32 fields (hdr.meta_start + hdr.meta_size), which can wrap a...

CVE-2026-89826 drm/panthor: harden firmware build-info bounds checks

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthorfwreadbuildinfo checks whether the metadata range fits in the firmware image with hdr.metastart + hdr.metasize. Both fields are u32, so the addition can wrap and let an...

CVE-2026-89825 drm/panthor: fix firmware control interface bounds checks

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix firmware control interface bounds checks panthorinitcsiface and panthorinitcsgiface validate firmware control interface offsets with 32-bit arithmetic and the size of the host wrapper structures. The offsets are...

CVE-2026-89825

CVE-2026-89825 affects the drm/panthor driver in the Linux kernel. The functions panthor_init_cs_iface() and panthor_init_csg_iface() validate firmware control interface offsets using 32-bit arithmetic , which can wrap before the bounds check executes. Additionally, the validation uses the host w...

CVE-2025-67399

CVE-2025-67399 Résumé de la vulnérabilité Le moniteur AQI de la maison intelligente AIRTH utilise un SoC Bluetooth CB3S basé sur le chipset BK7231N avec le numéro de version logicielle : 2.1.17. En accédant physiquement à l’appareil et en identifiant le SoC, les broches de débogage/programmation...

CVE-2026-86474

The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform man-in-the-middle attacks on the update channel...

CVE-2026-86585

CVE-2026-86585 affects VEO and VEO-XS Wi-Fi monitors (Fermax) in versions prior to 01.48.001 . The root cause is the lack of signature verification on firmware update packages, allowing an attacker who controls the delivery of an update to install unauthorised firmware on the device. The attack v...

DSL-2750U-Full-chain

analyse-du-firmware 1. Bogues DSL-2750U : mauvaise configuration du serveur tftp CVE-2021-3707 bogue d'injection de commandes CVE-2021-3708...

CVE-2026-86474

CVE-2026-86474 affects VEO and VEO-XS Wi-Fi monitors (by Fermax) in versions prior to 01.48.001 . The root cause is the lack of TLS certificate validation when downloading firmware updates, which allows an attacker to perform man-in-the-middle (MITM) attacks on the update channel. The CVSS 4.0 ba...

EUVD-2026-80386

The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform man-in-the-middle attacks on the update channel...

CVE-2026-86474 Improper Certificate Validation in the Firmware Download vulnerability

The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform man-in-the-middle attacks on the update channel...