CVE-2026-96418: Loop with Unreachable Exit Condition

TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-100244: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-102726: Out-of-bounds Read

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read...

CVE-2026-101267: Missing Authorization

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue...

CVE-2026-102729: Incorrect Calculation of Buffer Size

gxbinresthemeload sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes...

CVE-2026-95509: Out-of-bounds Read

Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg formatting by an incorrect buffer size calculation, causing out-of-bounds reading...

CVE-2026-22101: Exposure of Sensitive Information to an Unauthorized Actor

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...

CVE-2026-102719: Use of Insufficiently Random Values

Predictable DTLS HelloVerifyRequest Cookie in NetX Secure...

CVE-2026-81842: Incorrect Authorization

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...

CVE-2026-102723: NULL Pointer Dereference

NULL Pointer Dereference on MSRP Attribute Table Exhaustion...

CVE-2026-102727: Improper Restriction of Communication Channel to Intended Endpoints

FTP Passive Data Connection Not Bound to the Authenticated Control Peer...

CVE-2026-84409: Improper Neutralization of Input During Web Page Generation

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update...

CVE-2026-96421: Improperly Controlled Sequential Memory Allocation

USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-96419: Improper Limitation of a Pathname to a Restricted Directory

Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution...

CVE-2026-102724: NULL Pointer Dereference

NULL Pointer Dereference When Evicting the Sole MSRP Attribute...

CVE-2026-102710: Improper Privilege Management

Attacker model / Preconditions: a loaded TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION module issuing kernel dispatch calls, on a build with TXENABLEEVENTTRACE. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it...

CVE-2026-102712: Out-of-bounds Read

On the first DTLS ClientHello, the parser copies a device-claimed sessionid length and validates the ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim in...

CVE-2026-71302: Session Fixation

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover...

CVE-2026-101266: Improper Input Validation

A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps...

CVE-2026-102725: Out-of-bounds Read

Out-of-bounds Read from Unvalidated MSRP Attribute List Length...