EUVD-2026-48646

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - validate firmware size before use Ensure that the firmware file is large enough to contain the expected number of pages and the signature which resides at the end of the firmware blob before accessing them to...

CVE-2026-64237

Summary: CVE-2026-64237 affects the Linux kernel’s elan_i2c firmware handling. The issue arises from insufficient size validation of the firmware blob before use. Vulnerability details (as stated in connected docs): The firmware file must be large enough to contain the expected number of pages an...

CVE-2026-64208 crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

CVE-2026-64208 crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

EUVD-2026-48616

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

EUVD-2026-48613

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal...

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-7007

The CVE-2026-7007 issue affects Zephyr ext2: the on-disk superblock validation did not require non-zero values for s_blocks_per_group and s_inodes_per_group. If either field is zero, get_ngroups() and get_itable_entry() perform divisions using those fields during mount, triggering a divide-by-zer...

CVE-2026-66009

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-46452

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version...

CVE-2026-15243

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-46452

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version...

CVE-2026-46452

CVE-2026-46452 covers an Improper Input Validation vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly path. The issue can cause broken data to be passed toward the application, leading to memory pressure and unstable parsing behavior. Affected software ranges to NimBLE up to version 1.9.0...

EUVD-2026-48567

Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version...

CVE-2026-45813

CVE-2026-45813 covers an out-of-bounds write and integer underflow in the Apache NimBLE BASS service. The issue arises from improper validation when parsing the BASS service “Add Source” and “Modify Source” PDUs, which can cause a stack buffer overflow or arbitrary out-of-bounds read. It is trigg...

EUVD-2026-48581

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-15243 Improper Validation of Certificate in CAS Client

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-15243 Improper Validation of Certificate in CAS Client

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-15243

The CVE-2026-15243 issue affects the Apereo CAS Client where the client accepts any CA-trusted certificate for a hostname that matches the configured allowlist or regex. The underlying risk is a MITM attacker could present a any CA-signed certificate for a permitted hostname, enabling interceptio...