CVE-2026-51260

CVE-2026-51260 affects the schreibfaul1 ESP32-audioI2S component (version 3.4.5). The issue is an unsafe fixed-size memcpy in AudioBuffer::writeSpace(), where a full UINT16_MAX bytes are copied without validating available destination space, causing an out-of-bounds heap write. This is the concre...

CVE-2026-51251

CVE-2026-51251 has concrete details in connected sources: ESP32-audioI2S 3.4.5 contains a buffer overflow in the MP3Decoder::decode() function of the MP3 decoder, caused by missing size validation on untrusted mainDataBegin and nSlots values. This vulnerability is specific to that component/versi...

CVE-2026-51252

The connected records identify a concrete issue: ESP32-audioI2S 3.4.5 contains a buffer overflow in MP3Decoder::UnpackSFMPEG1 caused by missing input validation on attacker-controlled MP3 metadata. This is a vulnerability in the MP3 decoding path; exploitation details are not provided in the docu...

MiracleLinux 8 : dotnet8.0-8.0.129-1.el8_10.ML.1 (AXSA:2026-1370:14)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1370:14 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

CVE-2026-51274

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2026-65633

Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet and STUN attribute bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception in...

A Structuration Approach to Theorizing Cybersecurity Practice: The STARC Model

The problem: Cybersecurity practice runs simultaneously across analysts, teams, organizations, sectors, and regulators, co-evolves with adversaries, and increasingly blends human and algorithmic decision-making. The theories applied to it operate at single organizational levels and cannot explain...

CVE-2026-51266

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2026-51266

CVE-2026-51266 is rejected/not used and does not represent an active vulnerability entry.

ALBA-2026:47115 None: coreutils bug fix and enhancement update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Bug Fixes and Enhancements: Fix execution of the downstream tests in coreutils-df-direct.patch and coreutils-i18n.patch almalinux-8.10.z...

PT-2026-65612

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.9.1 through 0.60.1 Description An issue exists where the software silently dereferences HTTP or HTTPS URLs provided in JSON Schema $ref values without performing IP or host validation, scheme allow-listing, ...

CVE-2026-51275

The CVE-2026-51275 record is supported by connected sources indicating a concrete issue in schreibfaul1 ESP32-audioI2S 3.4.5. The vulnerability is a heap-based buffer overflow in the ID3v2 APIC frame parsing within audiolib, caused by missing length validation of the APIC frame size. This leads t...

CVE-2026-51259

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2026-51267

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2026-65650

Summary When the Pydantic v2 output mode is in use, datamodel-code-generator reads a validators array from each model entry in the --extra-template-data file and synthesises a Pydantic @field validator... decorator from each entry. The field names and the validator mode are interpolated into the...

PT-2026-65642

Summary A malicious input schema OpenAPI / JSON Schema can execute arbitrary Python code on the machine that imports the generated model. The x-python-import and customTypePath schema extensions flow, unsanitized, into the import statements datamodel-code-generator emits. A newline embedded in th...

CVE-2026-51254

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2026-65639

Webhook Custom Path Authentication Bypass in pytonapi Summary TonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup, bearer tokens are stored only under the default suffix paths...

PT-2026-65684

Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet and STUN attribute bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception in...

PT-2026-65665

Summary datamodel-code-generator's built-in HTTP fetcher http.get body issues an httpx.GET against any URL passed to --url or reached via a redirect chain with no allow-list, no deny-list, no IP/host validation, and follow redirects=True. Loopback addresses, RFC1918 ranges, link-local...