EUVD-2026-55260

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

CVE-2026-71391 Off-by-One Error in GNU Emacs for Android

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

The vulnerability in the implementation of the waitid() system call layer of the Linuxulator kernel in FreeBSD allows a attacker to disclose protected information.

The vulnerability in the implementation of the waitid system call layer of the Linuxulator kernel in FreeBSD operating systems is related to the use of an uninitialized variable. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security...

CVE-2026-71391: Off-by-one Error

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

The vulnerability of the compat32 subsystem in FreeBSD’s kernel allows a hacker to disclose protected information.

The vulnerability of the compat32 compatibility layer in the Linuxulator kernel of FreeBSD operating systems is related to the use of uninitialized variables. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by these layers...

PT-2026-69812

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An error handling path in the cfg80211 wext siwscan function contains a flaw where the creq variable leaks if the test against IEEE80211 MAX SSID LEN fails. Recommendations At the moment...

EUVD-2026-54728

A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMappingvarAccessSpecToObjectReference of the file src/iec61850/common/iec61850common.c of the component MMS Protocol Workflow. Such manipulation of the argument...

CVE-2026-19259 MZ Automation libiec61850 MMS Protocol Workflow iec61850_common.c MmsMapping_varAccessSpecToObjectReference heap-based overflow

A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMappingvarAccessSpecToObjectReference of the file src/iec61850/common/iec61850common.c of the component MMS Protocol Workflow. Such manipulation of the argument...

CVE-2026-19259

A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function MmsMappingvarAccessSpecToObjectReference of the file src/iec61850/common/iec61850common.c of the component MMS Protocol Workflow. Such manipulation of the argument...

SUSE-SU-2026:3536-1 Security update for podman

This update for podman fixes the following issues: - CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership modification on the host filesystem bsc1268579. - CVE-2026-57231: specially crafted image can trick podman run into...

CVE-2026-48039 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

CVE-2026-48039 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

CVE-2026-48039

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

EUVD-2026-54616

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

CVE-2026-48039 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

EUVD-2026-54603

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable...

EUVD-2026-54525

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

CVE-2026-19212

CVE-2026-19212 affects WonderTrader up to version 0.9.9. The vulnerability exists in the component TraderATP Cash Trade Conversion, specifically in the file src/Includes/WTSTradeDef.hpp where manipulating the argument m_offsetType can cause an uninitialized variable to be used. The issue can be e...

CVE-2026-19212 WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

CVE-2026-19212 WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...