CVE-2026-71264

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

CVE-2026-71256

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71255

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71255 nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

EUVD-2026-53332

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71256 nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71255 nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

EUVD-2026-53333

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71256

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71255

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

GHSA-MFX4-HV73-Q22V

creationtimestamp| type| source ---|---|--- 2026-08-04 03:31:26+00:00| seen| https://gist.github.com/alon710/b3523524be79c42fa548f91ed3953ea3...

MINI-9HJM-J876-R823

Bulletin has no description...

ECHO-32AF-C182-7508

Bulletin has no description...

ECHO-9EB8-7124-0A2B

Bulletin has no description...

JLSEC-2026-1036 ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur. This issue has been fixed in versions 6.9.13-51...

CVE-2026-17959

creationtimestamp| type| source ---|---|--- 2026-07-30 05:22:21+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730 2026-08-03 10:50:02+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260803...

CVE-2026-67191

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses ...

CVE-2026-67191

Xlight FTP Server prior to 3.9.5 is affected by a pre-authentication heap buffer overflow in the SSH parser. A logic error in the recv loop termination (OR instead of AND) enables exploitation on any SSH or SFTP connection before authentication, allowing remote unauthenticated access with high im...

EUVD-2026-50398

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses ...

CVE-2026-64546

A flaw was found in the Linux kernel. A specially crafted Extended Display Identification Data EDID, which describes display capabilities, can cause a heap out-of-bounds read in the drmparsetiledblock function within the drm/edid component. This vulnerability could lead to system instability or t...