CVE-2026-27828

EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118chargerImpl::handlesessionsetup uses v2gctx after it has been freed when ISO15118 initialization fails e.g., no IPv6 link-local address. The EVSE process can be crashed remotely by an attacker with MQTT access who issue...

EUVD-2026-16228

EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118chargerImpl::handlesessionsetup uses v2gctx after it has been freed when ISO15118 initialization fails e.g., no IPv6 link-local address. The EVSE process can be crashed remotely by an attacker with MQTT access who issue...

CVE-2026-27828

EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118chargerImpl::handlesessionsetup uses v2gctx after it has been freed when ISO15118 initialization fails e.g., no IPv6 link-local address. The EVSE process can be crashed remotely by an attacker with MQTT access who issue...

CVE-2026-23995

EVerest is an EV charging software stack. Prior to version 2026.02.0, stack-based buffer overflow in CAN interface initialization: passing an interface name longer than IFNAMSIZ 16 to CAN open routines overflows ifreq.ifrname, corrupting adjacent stack data and enabling potential code execution. ...

CVE-2026-27646

OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize host-side ACP runtime. Attackers can bypass sandbox restrictions by invoking the /acp spawn slash-command to cross from sandboxed chat conte...

CVE-2026-33038

WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfiguration.php endpoint. install/checkConfiguration.php performs full application initialization: database setup, admin account creation, and...

CVE-2026-0940

A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to modify data and execute arbitrary code...

CVE-2026-26148

External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally...

Inadequate Encryption Strength

github.com/cloudflare/gokey is vulnerable to Inadequate Encryption Strength. The vulnerability is due to flawed seed decryption logic that uses only limited entropy from the initialization vector and authentication tag, which allows an attacker with access to the seed file to derive generated...

EVerest 资源管理错误漏洞

EVerest is an open-source firmware for electric vehicle charging stations developed by EVerest. Versions of EVerest prior to 2026.02.0 contained a resource management vulnerability. This vulnerability stemmed from the ISO15118chargerImpl::handlesessionsetup function using a released v2gctx after...

The vulnerability of the `ftrace_make_nop()` function in the `arch/arm64/kernel/ftrace.c` module, which is part of the Linux operating system’s ARM 64-bit kernel support, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ftracemakenop function in the arch/arm64/kernel/ftrace.c module, which is part of the Linux operating system’s ARM 64-bit kernel support, is related to improper initialization of resources. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the sdma_clean() function in the drivers/infiniband/hw/hfi1/sdma.c module of the Linux operating system’s kernel driver allows a malicious actor to cause a service failure.

The vulnerability of the sdmaclean function in the drivers/infiniband/hw/hfi1/sdma.c module of the Linux operating system’s InfiniBand support driver is related to incorrect initialization of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-32353

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the netfilter module, the process sdp function declares a union nf inet addr named rtp addr on the stack. This variable is only initialized when a recognized media type with a non-zer...

The vulnerabilities of the functions __mptcp_close_ssk() and mptcp_worker() in the net/mptcp/protocol.c module of the Linux kernel allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the mptcpclosessk and mptcpworker functions in the net/mptcp/protocol.c module of the Linux kernel is related to improper initialization. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the __drm_universal_plane_init() function in the drivers/gpu/drm/drm_plane.c file of the DRI support driver for the Linux operating system’s kernel allows a attacker to cause a service failure.

The vulnerability of the drmuniversalplaneinit function in the drivers/gpu/drm/drmplane.c file of the DRI support driver for the Linux operating system is related to code errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the ath9k_hif_usb_alloc_tx_urbs() function in the drivers/net/wireless/ath/ath9k/hif_usb.c module of the Atheros/Qualcomm wireless adapter driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ath9khifusballoctxurbs function in the drivers/net/wireless/ath/ath9k/hifusb.c module of the Atheros/Qualcomm wireless adapter driver in the Linux operating system is related to incorrect initialization of resources. Exploiting this vulnerability could allow an attacker t...

The vulnerability of the vmbus_exit() function in the drivers/hv/vmbus_drv.c file of the support driver for Microsoft HyperV Linux kernel allows a attacker to cause a service failure.

The vulnerability of the vmbusexit function in the drivers/hv/vmbusdrv.c file of the Microsoft HyperV support driver for the Linux operating system is related to improper initialization. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the kvm_xen_init_vcpu() function in the arch/x86/kvm/xen.c module of the virtualization subsystem on the x86 kernel of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the kvmxeninitvcpu function in the arch/x86/kvm/xen.c module of the virtualization subsystem on the x86-based Linux kernel platform is related to improper initialization. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the mlx5_esw_vport_disable() function in the drivers/net/ethernet/mellanox/mlx5/core/eswitch.c file of the Mellanox Ethernet network adapter driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the mlx5eswvportdisable function in the drivers/net/ethernet/mellanox/mlx5/core/eswitch.c file of the Mellanox Ethernet network adapter driver for the Linux operating system is related to improper initialization. Exploiting this vulnerability could allow an attacker to cause ...

PT-2026-28362

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2026.02.0 Description EVerest is an EV charging software stack. The ISO15118 chargerImpl::handle session setup function uses the v2g ctx variable after it has been freed when ISO15118 initialization fails, such as whe...