CVE-2022-27518_POC

CVE-2022-27518POC docker pull quay.io/citrix/citrix-k8s-cpx-ingress:13.0-58.30 Use the following command to verify if CPX image is installed in docker images docker images | grep 'citrix-k8s-cpx-ingress' Use the following command to create a CPX container instance running in bridge mode docker ru...

CVE-2026-115653 Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mod...

CVE-2026-115653

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603 , the PendSV handler of the Cortex-M module ports contains a vulnerability where it saves a preempted user-mode module thread's registers in privileged mode using an unchecked stack pointer . Because the handler does not validate the pointer ...

PLANET IGS-5225-8P2T4S Use of Weak Hash (CVE-2026-81946)

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged- mode access...

CVE-2026-94024

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended...

EUVD-2026-105147

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended...

EUVD-2026-105027

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...

CVE-2026-95111 Module queue front-send validates a word count as a byte count

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...

CVE-2026-95111 Module queue front-send validates a word count as a byte count

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...

PT-2026-118438

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended txm module object pointer get...

PT-2026-118414

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's tx queue message size is a count of ULONGs and the cop...

Eclipse ThreadX buffer error vulnerability

A buffer error vulnerability exists in Eclipse ThreadX versions 6.0.1 through 6.5.1.202602a. This vulnerability stems from the queue front send scheduling layer, which passes the number of bytes defined by txqueuemessagesize directly to the range check performed by Module Manager. Instead of...

Eclipse ThreadX buffer error vulnerability

A security vulnerability exists in Eclipse ThreadX versions 6.0.1 through 6.5.1.202602a. It arises because the Module Manager object searches only by verifying the length of the search name; it fails to utilize a buffer with a length limit parameter. Under privileged mode, it iterates through...

CVE-2026-102757

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided whether a privileged service could dereferenc...

CVE-2026-102757

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode, and can use that to clear the MPU enable bit and remove its own isolation boundary. The Module Manager decided whether a privileged service could dereferenc...

PT-2026-102769

Name of the Vulnerable Software and Affected Versions ThreadX affected versions not specified Description An unprivileged, memory-protected module can force the kernel to read and write memory at arbitrary addresses in privileged mode, allowing the module to clear the MPU Memory Protection Unit...

CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

CVE-2026-81946 PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 Algorithm

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

SUSE-SU-2026:3423-1 Security update for xen

This update for xen fixes the following issues - CVE-2026-42493: x86 shadow paging is deprecated bsc1271528. - CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling bsc1271530. - CVE-2026-62426,CVE-2026-62427: sysctl and...

CVE-2026-44849

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer enforces seven EndpointSecuritySettings restrictions that...