CVE-2026-43679

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...

CVE-2026-43679

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...

EUVD-2026-63777

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...

CVE-2026-43679

CVE-2026-43679 is a permissions-checking flaw in the FaceTime component of Apple Watch Series 6 and later . An attacker with physical access to a locked Apple Watch may be able to view user contacts. The issue was addressed with improved permissions checking and is fixed in watchOS 26.4 . The vul...

CVE-2026-18280

Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exist...

CVE-2026-18283

Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

EUVD-2026-63420

Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows physically present attackers to escalate privileges on affected installations of Kenwood DNR1007XR devices. An attacker must first obtain the ability to execute low-privileged...

EUVD-2026-63419

Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2026-18272

The Kenwood DNR1007XR's startUpdateProcess() function passes a user-supplied string directly to a system call without validation, enabling command injection as root. Exploitation requires physical access (CVSS 6.8 MEDIUM), and no firmware fix or workaround is currently available per ZDI-CAN-28981...

EUVD-2026-63418

Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specifi...

CVE-2026-18267

The Kenwood DNR1007XR firmware update process fails to validate symbolic links, allowing a physically present, unauthenticated attacker to move files to arbitrary locations and execute code as root. No fixed version is available; affected versions are unspecified. Exploitation requires physical d...

CVE-2026-20302

A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root privileges. This vulnerability is due to insufficient boundary checks for specific data that is provided...

CVE-2024-13942 Rockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privileges

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...

EUVD-2024-55729

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...

CVE-2026-20302

CVE-2026-20302 is a buffer overflow vulnerability in the USB driver of Cisco RoomOS . The root cause is insufficient boundary checks on data processed through the USB driver. An unauthenticated, local attacker with physical access to the device's USB port can exploit this by connecting a maliciou...

EUVD-2026-62479

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...

PT-2026-78494

Name of the Vulnerable Software and Affected Versions Cisco RoomOS affected versions not specified Description An issue in the USB driver allows an unauthenticated local attacker with physical access to the USB port to execute arbitrary code with root privileges. This occurs due to insufficient...

EUVD-2026-62480

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...

CVE-2026-50720

Ingenic T31 SoC boot ROM compares only one 32-bit word of RSA signature output against SHA-256 digest instead of full data, enabling SPL image forgery with ~2/3 success probability by attackers with physical boot-media access. Validated on Wyze Video Doorbell v2 (T31X). No patch or workaround det...

CVE-2026-50719

Ingenic T41/T32/T40/A1 SoC boot ROMs execute an attacker-controlled init table from the SPL header before secure boot verification, using 32-bit writes to disable SRAM-resident secure boot state, allowing unsigned boot code. Hardware-validated on T41; ROM analysis confirms behavior on other chips...