CVE-2026-59632

Memory Exhaustion via Undrained Message Queue in Android Messaging Controller

In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via an undrained message queue due to a type confusion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-59635

Android AVC Decoder Non-Heap Buffer Overflow Leading to Local Privilege Escalation

In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-59636

Premature Anti‑Rollback Fuse Update Enables Permanent Local Denial of Service on Android Devices

In has_booted_successfully of sys_state_setup_otp_ta.c, there is a possible way to trigger a permanent denial of service via premature anti-rollback fuse updates due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-124726

Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare

Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Apache Apisix Apisix Apache Apisix

CVE-2026-124719

Apache APISIX: identity spoofing in openapi-to-mcp

Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Apache Apisix Apisix Apache Apisix

CVE-2026-124680

Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding

Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse encoded dot segments. This issue affects Apache APISIX: from 0.9 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 7 High EPSS n/a KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Apache Apisix Apisix Apache Apisix

CVE-2026-124666

Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers

Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator. This issue affects Apache APISIX: from 3.8.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 6.4 Medium EPSS n/a KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Apache Apisix Apisix Apache Apisix

CVE-2026-107398

Indico: Local file disclosure through offline-copy path traversal

Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Indico

Products

Indico

CVE-2026-124716

Apache APISIX: authz-keycloak authorization scope mismatch

Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue affects Apache APISIX: from 1.4.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 6.4 Medium EPSS n/a KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Apache Apisix Apisix Apache Apisix

CVE-2026-128080

OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing spans. Services receiving signed URLs or other credentials in query parameters can therefore export still-valid secrets to tracing backends, where observability infrastructure and users with span-read access may read them. The redactedQueryParams option does not protect incoming spans in affected versions. This issue is fixed in version 0.222.0.

CVSS 3.1 · 5.8 Medium EPSS n/a KEV · Not listed

Vendors

Opentelemetry

Products

Opentelemetry-js

CVE-2026-128081

AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth

AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper can recurse without an effective MaxDepth limit when mapping polymorphic graphs through Include or IncludeBase, runtime-typed object or interface members, nested Dictionary<string, object> or ExpandoObject sources, or recursive ConvertUsing type converters. Deep attacker-influenced graphs on these paths can throw an uncatchable StackOverflowException and terminate the process. This issue is fixed in versions 15.1.4 and 16.3.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Luckypennysoftware

Products

Automapper

CVE-2026-62975

BACnet Stack: Replacing a RAMFS record with a shorter one via `AtomicWriteFile(record-access)` can trigger a heap out-of-bounds read

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE implementation accepts AtomicWriteFile(record-access) requests that replace existing records with caller-controlled content. If a client replaces a record with shorter data, the backend can shrink the heap allocation and then continue processing with a trailing-copy length derived from the old layout. During that replace path, the RAMFS backend computes the trailing-copy length from the old file layout, then shrinks the heap allocation, and finally uses the stale length in memmove(). As a result, the source range of that memmove() can extend beyond the end of the reallocated heap buffer, producing a heap out-of-bounds read. This issue has been patched in versions 1.5.1 and 1.6.0.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-62976

BACnet Stack: Consecutive AtomicWriteFile(record-access) appends can trigger a heap out-of-bounds read in the RAMFS file backend

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-62977

BACnet Stack: `WriteProperty(File_Size)` can bypass read-only protection and expose uninitialized RAMFS tail bytes through `AtomicReadFile`

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-82414

BACnet Stack: MS/TP COBS decode overflow

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same fixed input buffer, but passes the full input-buffer size as the decode capacity. A long valid COBS payload can therefore write past the end of the actual remaining buffer. This issue has been patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-100403

BACnet Stack: BACnet/SC hub grows its WebSocket reassembly buffer without limit, so a peer can exhaust its memory

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC hub's Linux WebSocket server reassembles fragmented WebSocket messages into a per-connection fragment_buffer. It grows that buffer with realloc() on every non-final frame, with no upper bound. A peer that streams binary continuation fragments and never sets FIN keeps the hub reallocating until the box runs out of memory or the process is OOM-killed. The buffer starts at the maximum legal BVLC-SC NPDU size, but nothing after that ties its growth back to that limit. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-102537

bacnet-stack BACnet/SC node always accepts a self-signed hub cert, so an attacker can MITM it

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_cli_connect() in ports/linux/websocket-cli.c loads the trusted CA cert into the libwebsockets context, then always sets LCCSCF_ALLOW_SELFSIGNED in the connection flags. So lws accepts any self-signed hub certificate, whether or not it chains to the loaded CA. A BACnet/SC node finishes the TLS handshake to a rogue hub that presents a self-signed cert. It then hands the attacker its identity (VMAC, UUID) and all later BACnet traffic. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.

CVSS 4.0 · 7.7 High EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-97692

BACnet Stack: pre-auth out-of-bounds read that escalates to an out-of-bounds write into global memory

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC message decoder walks the header-option list by following each option's MORE bit. Nothing rejects a list whose last option still has the MORE bit set, and the decode walk has no upper bound on how many options it processes. A single crafted BVLC-SC frame makes the walk advance one option past the end of the message and read message[message_len], one byte out of bounds. When the bytes after the message carry more MORE-set option markers, the walk keeps going: it runs past the fixed 4-entry option array and writes decoded option fields out of bounds. On the server that decode array is the static global bsc_dm, so the out-of-bounds write lands in adjacent BSS. Both faults are reachable before authentication, from the first frame a peer sends on a BACnet/SC connection, and the bytes that follow the message are the same peer's prior-frame data. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.

CVSS 3.1 · 7.7 High EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-102612

BACnet Stack: BACnet/SC hub never requires a client cert, so any host joins the mesh unauthenticated

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, bws_srv_start() in ports/linux/websocket-srv.c builds the libwebsockets server context with a CA certificate loaded but never sets LWS_SERVER_OPTION_REQUIRE_VALID_OPENSSL_CLIENT_CERT, so the hub accepts TLS connections from clients presenting no certificate at all. Any network-reachable host can join the BACnet/SC mesh without credentials. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-104204

BACnet Stack: Structured View subordinate-list[0] WriteProperty allows unbounded synchronous resize and remote unauthenticated DoS

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.6.1, there is a server-side denial-of-service issue affecting the Structured View object implementation. This issue has been patched in versions 1.6.1 and 1.7.0.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack