CVE-2026-28662

A critical heap-based buffer overflow (CWE-122) exists in the p2p_process_prov_disc_bootstrap_req function of p2p_pd.c within the Android WiFi subcomponent. This memory corruption vulnerability could allow an attacker to achieve remote code execution (RCE) without requiring additional privileges ...

EUVD-2026-73991

In p2pprocessprovdiscbootstrapreq of p2ppd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28662

In p2pprocessprovdiscbootstrapreq of p2ppd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28618

In decfrmprepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73967

In decfrmprepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28618

In decfrmprepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28618

A heap buffer overflow in the dec_frm_prepare function of oapv.c within the OpenAPV codec allows for an out-of-bounds write. This vulnerability exists in the Media Codecs component and affects Android versions 13, 14, 15, and 16 . Exploitation can lead to remote code execution (RCE) or local priv...

EUVD-2026-73960

In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28609

In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28609

In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28609

CVE-2026-28609 is a high-severity Remote Code Execution (RCE) vulnerability in the Android Media Framework (specifically within MatroskaExtractor.cpp). The root cause is an out-of-bounds write triggered by improper casting: a frame data pointer is cast to uint16_t * before applying a range_offset...

EUVD-2026-73957

In multiple locations, there is a possible use after free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28604

In multiple locations, there is a possible use after free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28604

CVE-2026-28604 identifies a use-after-free vulnerability caused by a race condition within the Android Debug Bridge Daemon (adbd) . This flaw allows a local attacker to elevate their context to the shell user. The vulnerability impacts Android 13, 14, 15, and 16 . Exploitation does not require ad...

CVE-2026-28604

In multiple locations, there is a possible use after free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

GHSA-XP7J-H7JC-4W8P Semaphore U: OS Command Injection

Summary An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project the normal project-collaborator roles achieve remote code execution on the Semaphore server host. Using git's --upload-pack= option, an attacker runs arbitrary commands. Th...

Semaphore U: OS Command Injection

Summary An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project the normal project-collaborator roles achieve remote code execution on the Semaphore server host. Using git's --upload-pack= option, an attacker runs arbitrary commands. Th...

EUVD-2026-66708

Gitea: Remote Code Execution via diffpatch Git Hook Installation...

Gitea: Remote Code Execution via diffpatch Git Hook Installation

Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...

GHSA-RCR6-4JQH-J84M Gitea: Remote Code Execution via diffpatch Git Hook Installation

Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...