CVE-2026-55266 is a high-severity vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It involves a possible out-of-bounds write in the qsort function of libufdt_sysdeps_vendor.c due to resource exhaustion. This flaw can lead to a denial of service and local privilege escalation without requiring user interaction.
CVE-2026-55265 is a denial of service vulnerability in Google Android affecting multiple versions. It arises from a missing bounds check in several functions of PduParser.java, allowing out-of-bounds reads. Exploitation does not require user interaction or elevated privileges. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-49937 is a high-severity vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It involves an out-of-bounds read in multiple functions of MessageQueueBase.h due to incorrect bounds checking. Exploitation does not require user interaction and could lead to local privilege escalation without additional execution privileges.
CVE-2026-49933 is a high-severity vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It involves a possible control-flow hijack in the privileged Bluetooth process due to an uninitialized pointer dereference in the handle_le_monitor_device_event function. Exploitation does not require user interaction and could lead to local privilege escalation with full confidentiality, integrity, and availability impact.
CVE-2026-49885 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It arises from an integer overflow in the rw_t4t_update_file function of rw_t4t.cc, leading to a possible out-of-bounds write. Exploitation does not require user interaction or additional execution privileges.
CVE-2026-49880 is a high severity elevation of privilege vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It arises from a missing bounds check in multiple functions within the nfa_nfcee_act.cc component, leading to a possible out-of-bounds write. Exploitation does not require user interaction or additional execution privileges.
CVE-2026-45524 is a high-severity information disclosure vulnerability in Google Android version 17. It arises from a missing permission check in the isSystem method of WifiPermissionsUtil.java, potentially allowing a local sandbox escape and escalation of privileges without requiring user interaction.
CVE-2026-28667 is an information disclosure vulnerability in Google Android affecting multiple versions. It arises from a missing bounds check in several functions of rw_t5t.cc, leading to a possible out-of-bounds read. Exploitation does not require user interaction or additional execution privileges. The vulnerability has a medium severity rating with a CVSS score of 5.5.
CVE-2026-93317 is a medium severity vulnerability in moby BuildKit where an unauthenticated attacker controlling a registry or OCI-layout blob source can supply blob contents that do not match the claimed digest. This can cause the snapshot to be cached incorrectly and reused in subsequent builds, compromising the integrity of build inputs. The affected versions are from 0.28.0 up to but not including 0.33.1.
CVE-2026-93316 is a high-severity vulnerability in moby BuildKit where starting the daemon with the --cdi-disabled option can cause a NULL pointer dereference, leading to a daemon panic if builds attempt to use CDI devices. This can occur either accidentally or through malicious actions. The affected versions are all BuildKit versions from 0 up to but not including 0.33.1.
CVE-2026-93320 is a medium severity vulnerability in moby BuildKit where the system may be tricked into performing file operations on special file inodes instead of regular files. This can cause operations to be blocked or, on rootful workers, allow unintended access to host devices. The issue arises from a confused deputy scenario where BuildKit mishandles file types during processing.
CVE-2026-93319 is a medium severity vulnerability in moby BuildKit versions up to 0.33.0. It involves unsynchronized access to shared data in a multi-threaded context, where a malicious external BuildKit frontend can send internal API requests that may cause a data race leading to a daemon panic.
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build. The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.
CVE-2026-93323 is a medium severity vulnerability in moby BuildKit where the Dockerfile frontend loads Dockerfile and .dockerignore files into memory without size limits. This can cause excessive memory allocation if a build context contains an oversized file, potentially exhausting memory and terminating the buildkitd daemon, disrupting other builds. The issue affects versions up to 0.33.0 and is fixed by rejecting files larger than 16 MiB.
Plane, an open-source project management tool, had hard-coded default secrets in certain deployment manifests prior to version 1.4.0. These fixed SECRET_KEY and LIVE_SERVER_SECRET_KEY values were publicly known and remained active if not overridden by operators, allowing attackers to forge Django-signed values and bypass live-service authentication. This vulnerability is fixed in version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has a critical vulnerability (CVE-2026-105639) affecting versions prior to 1.4.0. The signup flow creates a logged-in user record for any submitted email without verifying ownership. This allows an unauthenticated attacker to register with a victim's email, enumerate pending workspace invitations, and accept them, gaining unauthorized access with the invited role. The issue is fixed in version 1.4.0.
CVE-2026-105638 affects Plane, an open-source project management tool, prior to version 1.4.0. The vulnerability involves improper restriction of excessive authentication attempts on the magic-code email login, which uses a six-digit numeric OTP with about 20 bits of entropy. The verification process lacks per-code failed-attempt counters, does not invalidate Redis entries or lock email addresses after incorrect attempts, and is not protected by configured rate limiting middleware. This flaw allows attackers to attempt unlimited OTP guesses without triggering throttling or lockout mechanisms. The issue is fixed in Plane version 1.4.0.
CVE-2026-103349 is a high-severity vulnerability in Rymera Web Co's Product Feed PRO for WooCommerce plugin. It involves deserialization of untrusted data leading to object injection. This affects all versions from initial releases up to 13.5.7. The vulnerability allows an attacker with high privileges to potentially execute arbitrary code or cause denial of service. No patch or vendor advisory is provided in the input data.
CVE-2026-97303 is a Missing Authorization vulnerability in the Apps Mav Scratch & Win – Giveaways and Contests plugin, affecting versions from initial release up to 3.0.2. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized access. The vulnerability has a high severity with a CVSS score of 7.6. No vendor advisory or patch information is provided, so the patch status is not confirmed.