IServ Schoolserver User Enumeration

IServ Schoolserver suffers from a user enumeration vulnerability. The vendor does not feel this is an issue...

EUVD-2026-52153

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...

EUVD-2026-52152

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mmsmapping/mmsmapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds read. The attack can be initiated...

CVE-2026-13586 PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-13586

CVE-2026-13586 affects Bouncy Castle for Java: in versions prior to 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound introduces DoS risk; this also impacts Java LTS before 2.73.12 and BC-FJA before bc-fips 1.0.2.7 (1.0.x), 2.0.2 (2.0.x), and 2.1.3 (2.1.x). The available documents de...

CVE-2026-58059 Quadratic-time escaping when stringifying X.500 distinguished names

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-58061 CCM-family modes write plaintext to caller buffer before tag check

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

EUVD-2026-52084

In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10960006 / BORA00155314, BORA00155001,...

CVE-2026-20494

CVE-2026-20494 affects a wifi component with an out-of-bounds read due to a missing bounds check, enabling local information disclosure when the attacker already has System privileges. No user interaction required. Affected patch IDs include ALPS10960006 and BORA00155314, BORA00155001, BORA001549...

CVE-2026-20493

CVE-2026-20493 affects the wifi component. The issue is an out-of-bounds write caused by a missing bounds check, enabling local denial of service when an attacker already has System privileges; no user interaction is required. The available references note Patch ID BORA00154903 and Issue ID MSV-7...

CVE-2026-20490

CVE-2026-20490 affects the MediaTek ccci component. The issue is a missing bounds check that can cause an out-of-bounds read, potentially enabling local denial of service when an attacker already has System privileges. Exploitation details are not provided in the documents; user interaction is no...

CVE-2026-20485

CVE-2026-20485 affects HFRP. The issue is an out-of-bounds write caused by a missing bounds check, enabling local privilege escalation for an attacker who already has System privileges. Exploitation requires no user interaction. Patch ID ALPS11049569 (Issue MSV-7931) is available. The connected d...

CVE-2026-20484

CVE-2026-20484 in TFA describes information disclosure due to a missing permission check. A malicious actor who already has System privilege can exploit it locally without user interaction. The vulnerability affects the TFA component as described across multiple sources; exploitation status is no...

CVE-2026-20482

In WLAN STA FW, a vulnerability arises where excessive logging can make the system unresponsive, enabling remote (proximal/adjacent) denial of service without requiring user interaction or additional privileges. The issue is identified with Patch ID: WCNCR00486814 and Issue ID: MSV-6824. The avai...

EUVD-2026-52070

In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965550 / ALPS11393405; Issue ID:...

CVE-2026-20479

In the Modem component, CVE-2026-20479 describes a vulnerability where an out-of-bounds read occurs due to a missing bounds check. This could permit remote denial of service when a UE connects to a rogue base station controlled by an attacker; exploitation requires no user interaction. The issue ...

EUVD-2026-52068

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20474

CVE-2026-20474 describes a race-condition in display that can lead to local privilege escalation if an attacker already has System privileges. No user interaction is required. The vulnerability details come from multiple sources (NVD/CVE records and related bulletins); exploitation status is not ...