Subnet Solutions PowerSYSTEM Center Incorrect Authorization

Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

Improper Permission Handling in Buffer Operations Enables Unauthorized Memory Mappings

Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions

Denial of Service Vulnerability in Exynos Modem IMS Stack Due to SDP Payload Handling

In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service

Out-of-Bounds Race Condition in PPC of Exynos Processors

Out of bound access in PPC due to race condition in global variable access

Improper Message Validation Leads to Memory Corruption in Samsung Exynos SoCs

A memory corruption vulnerability caused by improper validation of messages

NR RRC Message Handling Vulnerability Causes Denial of Service in Samsung Exynos Processors

In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.

Buffer Overwrite via NAS Message Length Validation Flaw in Samsung Exynos Processors

In the NAS message handler, improper validation of the length field in NAS message causes memory corruption

Improper SIP Packet Handling Causing Access Control Bypass in Samsung Exynos IMS Stack

In IMS stack, improper handling of SIP packets leads to Incorrect_Access_Control vulnerability

Baseband Memory Corruption Leading to Denial of Service in Samsung Exynos Modems

In the baseband, memory corruption during NAS packet processing can cause a denial of service.

In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.

In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.

NAS Authentication Request Decoding Infinite Loop Causes Denial of Service on Exynos Processors

In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.

Malicious IMS Message Leading to Information Exposure via SIP Flow

An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.

DoS via Malformed RRC Reconfiguration Message in Samsung Exynos Modems

Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process. The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().

XML External Entity Processing Enables Remote Local File Disclosure in Wowza Streaming Engine

Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.

OS Command Injection in OPNsense os‑acme‑client Allows Root Execution via Google Cloud DNS Validation

An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.

Untrusted Peer ID Claim Enables Privilege Escalation in GodotSteam

GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged.

Argument Injection via x-man-page URL Handler in iTerm2

iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.

Unsigned x‑amz‑* Headers Enable Cross‑Bucket Read via Presigned PUT URL in MinIO

MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalated into a cross-bucket read.