CVE-2026-20558 is a use-after-free vulnerability in the GPU pdma component of MediaTek chipsets MT6993 and MT8910. This flaw allows local escalation of privilege without requiring additional execution privileges or user interaction. A patch has been identified (Patch ID: ALPS11365070), but no explicit patch availability status is provided in the input data.
CVE-2026-20557 is an out-of-bounds write vulnerability in MediaTek chipsets' modem component caused by a missing bounds check. This flaw allows remote escalation of privilege if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require user interaction or additional execution privileges.
CVE-2026-20556 is an out-of-bounds write vulnerability in MediaTek chipsets' modem component caused by a missing bounds check. Exploitation can lead to remote escalation of privilege without requiring user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker.
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876664; Issue ID: MSV-9834.
CVE-2026-20554 is an out-of-bounds write vulnerability in MediaTek chipsets' modem component caused by a missing bounds check. Exploitation requires the user equipment (UE) to connect to a rogue base station controlled by an attacker and involves user interaction. Successful exploitation could lead to remote escalation of privilege and potentially cause a system crash.
CVE-2026-20553 is an out-of-bounds write vulnerability in MediaTek chipsets due to a missing bounds check. It allows local escalation of privilege if an attacker has physical access to the device. Exploitation does not require user interaction or additional execution privileges.
CVE-2026-20552 is an out-of-bounds write vulnerability in MediaTek chipsets caused by a missing bounds check in the ccci component. Exploitation requires user interaction and can lead to remote denial of service without additional execution privileges. Multiple MediaTek chipset models are affected, and patches have been identified for these issues.
CVE-2026-20551 is an out-of-bounds write vulnerability in MediaTek chipsets affecting specific models. The flaw arises from a missing bounds check in the GNSS component, potentially allowing a local denial of service. Exploitation requires user interaction and does not grant additional execution privileges. A patch identified as ALPS11309305 addresses this issue.
CVE-2026-20550 is an out-of-bounds write vulnerability in the GNSS component of MediaTek chipsets. The flaw arises from a missing bounds check, which can lead to a local denial of service. Exploitation requires user interaction and does not grant additional execution privileges. A patch identified as ALPS11309816 addresses this issue.
CVE-2026-20549 is an out-of-bounds write vulnerability in MediaTek chipsets' modem component caused by improper input validation. This flaw can be exploited remotely by an attacker controlling a rogue base station to escalate privileges on the affected device without requiring user interaction or additional execution privileges. Multiple MediaTek chipset models are affected. A patch is identified by Patch ID MOLY01775865.
CVE-2026-20548 is an out-of-bounds write vulnerability in MediaTek chipsets caused by an integer overflow in the modem component. Exploitation can lead to remote escalation of privilege without requiring user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker. Multiple MediaTek chipset models are affected. A patch has been identified by MediaTek under Patch IDs MOLY01872867 and MOLY01774038.
CVE-2026-20547 is an out-of-bounds write vulnerability in MediaTek chipsets' modem component caused by a missing bounds check. This flaw allows remote escalation of privilege if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require user interaction or additional execution privileges. Multiple MediaTek chipset models are affected.
CVE-2026-20546 is an out-of-bounds write vulnerability in MediaTek chipsets' modem component caused by an incorrect bounds check. This flaw allows remote escalation of privilege if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require additional execution privileges or user interaction. Multiple MediaTek chipset models are affected.
CVE-2026-20545 is an out-of-bounds write vulnerability in MediaTek chipsets' modem component caused by a missing bounds check. This flaw allows remote escalation of privilege if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require user interaction or additional execution privileges. Multiple MediaTek chipset models are affected. A patch has been identified by MediaTek under Patch IDs MOLY01879158 and MOLY01774038.
CVE-2026-20499 is an out-of-bounds write vulnerability in MediaTek chipsets' modem component caused by a missing bounds check. This flaw allows remote escalation of privilege if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require additional execution privileges or user interaction. Multiple MediaTek chipset models are affected.
The npm package 'contracts-upgradeable' is a malicious package impersonating '@openzeppelin/contracts-upgradeable'. It contains no functional code but executes a preinstall script that sends the machine's hostname, OS username, and local time to a Discord webhook, potentially leaking sensitive environment information. The package was published on 2026-11-02 by the npm account 'bigdevin55', which also published another package with the same malicious behavior. Another account 'cutekitten05' used the same webhook in packages published the day before.
Multiple heap buffer overflow vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME, affecting WebSocket handling and permessage-deflate buffer growth. These vulnerabilities can lead to memory corruption. Red Hat has issued security updates addressing these issues in Red Hat Enterprise Linux 9.4 variants.
CVE-2026-120325 is a path traversal vulnerability in Webpro-nl Knip versions up to 6.44.0. It affects the writeFile function in the Workspace Handler component, allowing remote attackers to manipulate file paths via the workspaces argument. Public exploit code is available, but no vendor response or patch has been issued. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.
A security vulnerability (CVE-2026-94286) has been identified in the X.Org X11 libXtst runtime library affecting Red Hat Enterprise Linux 10.0 Extended Update Support and related variants. The flaw is a denial of service caused by an out-of-bounds read in the RECORD reply parser. Red Hat has issued an important security update to address this issue.
CVE-2026-120324 is a path traversal vulnerability in Aklivity Zilla affecting versions up to 1.3.4, 2.4.7, and 2.5.0-rc2. The flaw exists in the Path.resolve function of the FileSystemServerFactory component within the http-filesystem binding. This vulnerability allows remote attackers to manipulate path parameters to access unauthorized file system locations. Public exploit code is available. Upgrading to version 2.5.0-rc3 resolves the issue.