Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments

Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale POS terminal reads over near-field communication NFC, without breaking any of the card...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fixed a race condition between rfkill and nciunregisterdevice. syzbot reported the issue below 0 without providing a reproduction guide. It was noted that the struct ncidev.cmdwq was destroyed before nciclosedevice was...

The vulnerability of the digital_in_recv_sdd_res() function in the net/nfc/digital_technology.c module of the NFC subsystem of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the digitalinrecvsddres function in the net/nfc/digitaltechnology.c module of the NFC subsystem of the Linux operating system is related to the copying of buffers without checking the input data. Exploiting this vulnerability could allow an attacker to influence the...

CVE-2026-66061 Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the...

CVE-2026-66061

CVE-2026-66061 affects the Home Assistant project via its iOS Companion app. The root cause is that, prior to version 2026.5.0, tag links (NFC or QR) delivered through OS-level routing (e.g., iOS universal links) could be treated as if physically scanned without validating the calling app or prom...

CVE-2026-66060 Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user...

The vulnerability of the nfc_unregister_device() function in the net/nfc/core.c module of the NFC subsystem of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nfcunregisterdevice function in the net/nfc/core.c module of the Linux NFC subsystem is related to the mutual locking of execution threads. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protect...

OESA-2026-3191 python-setuptools security update

Setuptools is a collection of enhancements to the Python distutils that allow you to more easily build and distribute Python packages, especially ones that have dependencies on other packages. Security Fixes: setuptools is a package that allows users to download, build, install, upgrade, and...

CVE-2026-17910

An insufficient policy enforcement flaw was found in the NFC component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=501749600...

CVE-2026-17904

An insufficient policy enforcement flaw was found in the NFC component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497337759...

CVE-2026-17910

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-17910

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-17904

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17904

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-50659

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17910

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17910

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17910

CVE-2026-17910 concerns Google Chrome on Android. The issue is described as insufficient policy enforcement in the NFC component, present in Chrome on Android versions prior to 151.0.7922.72, which could allow a remote attacker to leak cross-origin data via a crafted HTML page. The CVSS v3.1 base...

CVE-2026-17904

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17904

Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...