CVE-2026-102111 is a vulnerability in Kiteworks Core where the software does not enforce the maximum allowed value for a configurable security-policy setting. An authenticated administrator can set this value beyond its intended range, causing the associated security control to never activate. Despite this, the control appears enabled in the administrative interface and audit logs, effectively rendering it silently ineffective.
CVE-2026-86133 is an integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked). A remote attacker who completes the initial IKEv2 handshake can send a specially crafted encrypted IKEv2 message to crash the iked process, causing a denial of service. The vulnerability affects multiple versions of Fireware OS and has been assigned a high severity score of 8.2. Fixed versions are available.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing vulnerabilities in the hdf5 packages. The update includes multiple hdf5-related RPMs for aarch64 and x86_64 architectures. The advisory addresses three CVEs: CVE-2026-19026, CVE-2026-19027, and CVE-2026-19028. No explicit patch version ranges are provided, but updated package versions are listed. The severity is assessed as medium.
CVE-2026-102730 is a high-severity vulnerability in Eclipse Foundation's Eclipse ThreadX NetX Duo involving an out-of-bounds heap write triggered by mounting a malicious NAND flash image. This flaw occurs in LevelX's NAND flash-translation-layer metadata parser and allows overwriting a driver function pointer, enabling control-flow hijacking with an attacker-controlled instruction pointer. The issue has been demonstrated with AddressSanitizer and includes additional out-of-bounds reads. No affected versions or patches are explicitly stated.
CVE-2026-102711 is an out-of-bounds read vulnerability in Eclipse ThreadX versions 6.0.1 through 6.5.2.202603. The vulnerability arises because the Module Manager loaders trust the sizes and offsets declared in a module image preamble without verifying the actual image length. A crafted module image can declare a larger code size than the actual image, allowing reading or accessing memory beyond the intended boundaries and placing entry points outside the legitimate code area.
A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).
This issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0.
CVE-2026-94450 is a high-severity vulnerability in AWS s2n-quic versions 1.88.0 and earlier. It involves improper validation of the Destination Connection ID length, which can allow an unauthenticated remote attacker to cause a denial of service by shutting down a server endpoint with a single crafted UDP datagram. This affects only server endpoints configured to send Retry packets. The issue is fixed in version 1.89.0 and later.
Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charged.
MPP.Session.Actions.accept_voucher/3 in lib/mpp/session/actions.ex treats a voucher whose cumulativeAmount equals the channel's already-accepted cumulative amount as an idempotent success, returning the channel unchanged without calling maybe_spend/2. The credential verifies, the protected resource is served, and spent and units stay where they were. Because the server issues a fresh challenge per request and the credential replay store keys on challenge id and payload, the same signed voucher can be re-presented under every new challenge, so one paid voucher yields an unbounded number of paid units. The path is reachable from any method built on MPP.Session.Method through the Plug, MCP, JSON-RPC and WebSocket transports.
This issue affects mpp: from 0.14.0 before 0.16.2.
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4.
IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.
On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.
CVE-2024-53922 is a medium severity vulnerability in the buffer queue driver of Samsung Automotive Processor Exynos Auto 8890 firmware versions 7, 9, and 920. The flaw is due to improper validation of the specified quantity in input, specifically a lack of length check, which can cause a denial of service (DoS) in the kernel.
CVE-2026-87735 is a medium severity vulnerability in the mirage-crypto-pk package for OCaml that affects versions before 2.3.0. It involves an undocumented exception for small messages during RSA encryption or decryption, related to improper validation of specified quantity in input. The issue does not impact confidentiality or integrity but may cause availability issues. No known exploits are reported, and no official patch information is provided.
Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Input Data Manipulation.
This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.
Eclipse Ankaios versions 0.1.0 through 1.0.1 contain a vulnerability where the agent does not limit the length declared by a workload in a length-delimited protobuf message received via the Control Interface FIFO. This allows a workload with Control Interface access to specify an excessively large message length, causing unbounded memory allocation and potentially aborting the agent process. This results in loss of orchestration services for workloads managed by the affected agent.
CVE-2026-82750 is a high-severity vulnerability in ZenHive mpp versions from 0.2.0 up to but not including 0.16.1. It involves improper validation of the specified quantity in input, allowing unauthenticated remote clients to inflate the gas cost paid by the fee-payer for sponsored payments. Specifically, the vulnerability arises because the server does not validate the aa_authorization_list field, enabling clients to attach multiple delegations that increase the gas cost significantly. This can lead to sponsors paying excessive gas fees and clients upgrading their accounts to delegated code at the sponsor's expense.
CVE-2026-82751 is a vulnerability in ZenHive mpp that allows an unauthenticated remote client to cause a sponsor to pay significantly increased gas fees by exploiting improper validation of input quantities. Specifically, the client can attach a signed key authorization to provision a new access key with token spending limits on their own account, which the sponsor pays for. This leads to inflated gas costs and unauthorized access key creation. The issue affects versions from 0.2.0 up to but not including 0.16.1.
CVE-2026-82752 is a medium severity vulnerability in the ash-project ash framework affecting versions from 0.10.0 up to but not including 3.33.0. It involves improper validation of specified quantity in input, where string length constraints are measured by Unicode graphemes rather than codepoints. This discrepancy allows an attacker to store arbitrarily large values in attributes despite small maximum length constraints, potentially leading to unbounded storage growth. The mismatch between validation and storage length counting can also cause data truncation or rejection at the database layer.