EUVD-2026-46449

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...

EUVD-2026-46444

The NXP LPUART serial driver drivers/serial/uartmcuxlpuart.c, when CONFIGUARTUSERUNTIMECONFIGURE is enabled, called LPUARTDeinit at the start of mcuxlpuartconfigure, which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards in mcuxlpuartconfigurebasic,...

CVE-2026-16317

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the internal API HTTP client hardcoding InsecureSkipVerify to true in the TLS configuration, which disables certificate validation for outbound HTTPS connections. An attacker can intercept internal...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the internal API HTTP client hardcoding InsecureSkipVerify to true in the TLS configuration, which disables certificate validation for outbound HTTPS connections. An attacker can intercept internal...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the UpdatePullRequest function. An attacker can cause unauthorized modifications to private repository branches by exploiting a logic flaw in token scope validation during pull request updates from a publ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the UpdatePullRequest function. An attacker can cause unauthorized modifications to private repository branches by exploiting a logic flaw in token scope validation during pull request updates from a publ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the UpdatePullRequest function. An attacker can cause unauthorized modifications to private repository branches by exploiting a logic flaw in token scope validation during pull request updates from a publ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the UpdatePullRequest function. An attacker can cause unauthorized modifications to private repository branches by exploiting a logic flaw in token scope validation during pull request updates from a publ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the UpdatePullRequest function. An attacker can cause unauthorized modifications to private repository branches by exploiting a logic flaw in token scope validation during pull request updates from a publ...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

CVE-2026-65054 MediaCMS Private Media Metadata Disclosure via Playlist Ownership Loophole

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary media tokens to their own playlist without access control checks. Attackers can issue a PUT request to the playlist API...

GHSA-6C6R-5XR4-CR5M Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or...

AZL-93078 CVE-2026-56852 affecting package buildah 1.43.1-2

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-64881 Command Injection

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...

FileGator privilege escalation

RISK EVALUATION FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their...

EUVD-2026-42321

linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text...

CVE-2026-59147 Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find

Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsufind. The attach-time validator dsuvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents it then...

CVE-2026-59146

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sphwalkcell and sphallocslot. The attach-time validator sphvalidateheader checks the header scalars and region layout against the file size, but does...

CVE-2026-59145

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in siidxfind. The attach-time validator sivalidateheader is thorough about the header and layout magic, version, section offsets, totalsize, count and arenaused but does...