CVE-2026-18414 Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation

The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffersize field of struct adcsequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must return an error if the...

Improper Validation of Specified Type of Input

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via isHostInSubnet and isInSubnet which delegates to it, which compares masked binary strings...

Improper Validation of Specified Type of Input

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via isHostInSubnet and isInSubnet which delegates to it, which compares masked...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

Improper Validation of Specified Quantity in Input

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are...

Improper Input Validation

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Input Validation via insufficient hardening of runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merge...

Improper Input Validation

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Input Validation via insufficient hardening of runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into the...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

CVE-2026-49994

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

EUVD-2026-88401

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when authenabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/ handlers settings, devices, groups, per-device endpoints including /api/device/mac/notes called no auth check at all. A netwo...

CVE-2026-85644

A flaw was found in perl-XS-Parse-Keyword. This vulnerability allows an attacker to cause a Denial of Service DoS or potentially execute arbitrary code by supplying crafted input to an affected application. The issue occurs because the module improperly validates arguments for list-associative...

GO-2026-6521 Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule

Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic in github.com/projectcapsule/capsule...

GO-2026-6484 Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server

Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server...

GO-2026-6519 Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule

Capsule: hostnameRegexHandler.OnUpdate validates stale old Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation in github.com/projectcapsule/capsule...

New Remote DoS Attacks Against GraphQL Java

Executive Summary Imperva Threat Research identified a series of remote denial‑of‑service vulnerabilities in GraphQL Java, one of the most widely used libraries for GraphQL in the Java ecosystem. In this blog, we’ll deep dive into these vulnerabilities, analyze their impact, and provide...

CVE-2026-12342

This vulnerability affects all versions of SailPoint IdentityIQ . It allows an unauthenticated user to achieve remote code execution (RCE) on the IdentityIQ server. The root cause is identified as improper input validation of submitted web service API content. No specific exploit links or patch v...

CVE-2026-12342 SailPoint IdentityIQ Improper Form Validation Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

CVE-2026-12342 SailPoint IdentityIQ Improper Form Validation Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...