CVE-2026-18269 Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability

Kenwood DNR1007XR tchdrbytestreamread Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specif...

CVE-2026-18269

CVE-2026-18269 is an out-of-bounds write vulnerability in the tchdr_bytestream_read function of the Kenwood DNR1007XR car audio/navigation unit. The root cause is insufficient validation of user-supplied data, allowing a write past the end of an allocated buffer. A physically present attacker can...

EUVD-2026-63416

Kenwood DNR1007XR tchdrbytestreamread Out-Of-Bounds Write Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not required to exploit this vulnerability. The specif...

CVE-2026-54616

NanaZip (a 7-Zip derivative for modern Windows) is affected by a heap out-of-bounds read in the SquashFS LZ4 decompressor (Lz4Decode in SquashfsHandler.cpp). The root cause is that the function only rejects a zero return from LZ4_decompress_safe, while malformed input produces a negative error va...

CVE-2026-54616 NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4decompresssafe...

CVE-2026-54616 NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4decompresssafe...

EUVD-2026-63481

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4decompresssafe...

CVE-2026-54616 NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 1.0.88.0 until stable version 6.0.1698.0 and preview version 6.5.1742.0, the Lz4Decode function in NanaZip.Core/SevenZip/CPP/7zip/Archive/SquashfsHandler.cpp rejects only a zero return from LZ4decompresssafe...

devalue: devalue: Excessive memory consumption via deserialization of sparse arrays

A flaw was found in devalue, a JavaScript library used for serializing values. Due to quirks in some JavaScript engines, the devalue.parse function could be exploited by a remote attacker when deserializing specially crafted sparse arrays. This could lead to excessive memory consumption, resultin...

linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability

A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of ON² for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker...

Important: Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update

An update for rh-podman-desktop is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

CVE-2026-77004 Comfast CF-N1-S mbox-config sprintf command injection

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptestsn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may b...

EUVD-2026-63479

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptestsn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may b...

CVE-2026-77004

Comfast CF-N1-S firmware 2.6.0.1 exposes a command injection flaw in the sprintf function at /cgi-bin/mbox-config?method=SET&section=ptest_sn. Remote attackers with low privileges can manipulate the sn argument to execute arbitrary commands; a proof-of-concept exploit has been published. No patch...

EUVD-2026-63401

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function addgrade of the file /index.php. Performing a manipulation of the argument studentid results in improper authorization. The attack can be initiated remotely...

CVE-2026-76999 SourceCodester CET Automated Grading System with AI Predictive Analytics index.php add_grade improper authorization

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function addgrade of the file /index.php. Performing a manipulation of the argument studentid results in improper authorization. The attack can be initiated remotely...

CVE-2026-76999 SourceCodester CET Automated Grading System with AI Predictive Analytics index.php add_grade improper authorization

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function addgrade of the file /index.php. Performing a manipulation of the argument studentid results in improper authorization. The attack can be initiated remotely...