CVE-2026-116631 is a vulnerability in Firefox for iOS where a malicious web page could open a tel: link in a window displaying a different website, causing the phone-call prompt to appear as if it originated from that site. This spoofing could mislead users about the source of the call request. The issue was fixed in Firefox for iOS version 156.1.
CVE-2026-116632 is a vulnerability in Firefox for iOS where a malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS. This could allow the prompt to display a phishing message inside the system UI. The issue was fixed in Firefox for iOS version 156.1.
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP discovery toward the peer, which links the embedded ag->sdp_param._node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the subsequent bt_rfcomm_dlc_connect() call fails, bt_hfp_ag_connect() cleaned up by memset()-ing the entire AG object while that node was still linked, and while ag->slc_work could still be queued on the system work queue. An in-flight SDP discovery cannot be cancelled — bt_sdp_discover_cancel() is declared in the public header but has no implementation — so the request stays in the list with its func, pool and uuid pointers zeroed.
The RFCOMM channel passed to bt_hfp_ag_connect() is taken from the peer's own SDP Hands-Free service record in the normal AG flow (bt_sdp_get_proto_param() performs no range validation, and samples/bluetooth/classic/handsfree_ag feeds the value straight through), so a remote BR/EDR device in radio range that advertises an RFCOMM channel outside the valid range 0x01..0x1e deterministically forces bt_rfcomm_dlc_connect() to fail and reach the wipe. Reading the peer's SDP record requires no pairing, and the peer can also trigger the failure by dropping the ACL or racing an RFCOMM DLC on the same DLCI at the right moment.
When the SDP client next advances its request list, sdp_client_discover() dereferences the zeroed parameters — net_buf_alloc(param->pool, …) with a NULL pool and param->uuid->type — and the result-notification paths call through the NULL params->func. Zeroing a linked node also truncates the request list behind a stale tail pointer, and re-arming the freed AG slot re-appends the same node and can produce a self-looping list that hangs the Bluetooth RX thread. The impact is a crash or hang of the Bluetooth stack; the written value is a constant zero at a fixed static address, so no attacker-controlled write is available.
Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG that use the Audio Gateway role are affected.
bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which starts an SDP discovery by passing the object's embedded hf->sdp_param to bt_sdp_discover(). That call links the caller-owned parameter block into the SDP client's request list (session->reqs in subsys/bluetooth/host/classic/sdp.c). If the subsequent bt_rfcomm_dlc_connect() then failed, the affected code wiped the entire object with (void)memset(new_hf, 0, sizeof(*new_hf)) while that discovery was still outstanding, zeroing the sys_snode_t _node that is still linked in the SDP client's list along with the request's func, uuid and pool pointers, and zeroing the hf->slc_work work item that may already be queued on the system workqueue. The discovery could not be retracted instead: bt_sdp_discover_cancel() is declared in include/zephyr/bluetooth/classic/sdp.h but has no implementation.
The failing branch is reachable with peer-supplied input. The documented use of bt_hfp_hf_connect() is to pass the RFCOMM channel read out of the remote Audio Gateway's SDP record; neither bt_sdp_get_proto_param() nor bt_hfp_hf_connect() range-checks that value, so a remote device advertising an HFP AG record with an RFCOMM channel outside 1-30 makes bt_rfcomm_dlc_connect() return -EINVAL and drives the local device into the wipe. The same branch is reached without any application misuse when the remote peer controls connection timing, for example when the RFCOMM session is in BT_RFCOMM_STATE_DISCONNECTING or the ACL is dropped between object creation and the RFCOMM call.
Once the object has been wiped, the Bluetooth host continues to use it: sdp_client_alloc_buf() dereferences session->param->pool, which is now NULL, and the SDP receive paths call session->param->func() through a null function pointer, neither of which is NULL-checked. Because the wipe also clears hf->acl, the pool slot is considered free and a retry or an incoming HFP connection re-appends the same still-linked list node, turning session->reqs into a self-referential list that the host's list walkers never leave. The result is a fault or an unrecoverable hang in the Bluetooth host thread; the stray indirect call is through an all-zero pointer whose target the attacker does not control, so the practical impact is denial of service.
The fix keeps the object allocated and marks it with a new BT_HFP_HF_FLAG_RELEASING flag, letting bt_hfp_hf_discover_cb() release it once the discovery completes instead of destroying it under the SDP client. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled are affected.
A vulnerability in the Linux kernel's TEE subsystem allows zero-sized shared memory allocations via tee_dyn_shm_alloc_helper(). This leads to an invalid call to the page allocator, causing allocation failure and potentially a kernel panic during boot on systems with panic_on_warn enabled. The flaw is triggered by TEE_IOC_SHM_ALLOC with a zero size parameter. The issue has been resolved by rejecting zero-sized allocations.
This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.
Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP addresses. A low-privilege authenticated user can supply an image_url pointing to an internal address or use DNS rebinding and open redirects to make the server fetch internal network resources or cloud metadata endpoints, with successful image responses saved to a world-readable /files/ URL enabling data exfiltration or blind probing of internal hosts.
Xiaozhi-esp32-server versions before 0.9.8 have an insecure direct object reference vulnerability in the DeviceController.getAddressBook API. Authenticated users can access other users' device address books by supplying a different device MAC address, exposing contact MACs, aliases, call permissions, and owner user IDs.
This vulnerability involves the removal of a stale rcu_barrier() call in the br_multicast_dev_del() function within the network bridge component. The advisory references Microsoft products but provides no detailed technical or impact information. No CVSS score or exploit details are available.
Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device Credential used throughout the public OpenThread and Thread commissioning documentation, including Zephyr's own samples/net/sockets/echo_client/README.rst, so it is not a secret. A firmware image built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y that never overrode the PSKd therefore shipped with a publicly known joining credential compiled in, with no build-time or run-time warning.
The PSKd is the only value that authenticates Thread commissioning: joiner and commissioner run a DTLS-PSK handshake keyed on it, after which the commissioner supplies the full operational dataset. In ot_configure_instance() (modules/openthread/openthread.c), a device with no stored dataset calls otJoinerStart() with the configured PSKd, and ot_joiner_start_handler() calls otThreadSetEnabled() on success. An unauthenticated attacker within 802.15.4 radio range of an uncommissioned device (factory-fresh, after a factory reset, or after a settings erase) can run any stock Thread commissioner registered with J01NME, complete the handshake, and hand the device an attacker-controlled operational dataset.
The device then joins and enables Thread on the attacker's mesh. The attacker becomes its router, seeing, dropping, injecting and spoofing all of the device's IPv6 traffic and impersonating the peers the application expects, while the device is cut off from the network it was meant to join and stays mis-provisioned until it is reset. Only application-layer security with independently provisioned credentials survives. Exposure is limited to builds that enable joiner autostart and leave the PSKd unset; the option is not enabled by default and no in-tree sample uses the vulnerable combination.
The fix removes the default from CONFIG_OPENTHREAD_JOINER_PSKD and adds a BUILD_ASSERT() in modules/openthread/openthread.c, active only under CONFIG_OPENTHREAD_JOINER_AUTOSTART, that fails the build unless a 6-to-32-character PSKd is configured. Products should provision a per-device PSKd from factory data and call otJoinerStart() from the application rather than relying on a credential compiled identically into every unit.
A vulnerability in the Linux kernel's ibmveth driver involves improper cleanup of the logical LAN resource on failure during the open operation. Specifically, if allocation of RX buffer pools fails after the logical LAN is registered, the driver does not properly free the logical LAN resource, potentially leaving the buffer-list page owned by the hypervisor (PHYP) when it is unmapped. This issue has been addressed by moving the cleanup call to ensure deregistration occurs on all failure paths after registration.
CVE-2026-99018 is a high-severity vulnerability in the Linux kernel's RISC-V architecture support related to the shadow call stack handling during exception entry. The kernel incorrectly determines if a trap came from userspace by comparing a user-writable register (tp) instead of the hardware-controlled sstatus.SPP bit. This flaw allows an unprivileged user to manipulate the shadow call stack pointer, leading to arbitrary kernel memory write and control-flow hijacking. The issue is fixed by using the hardware sstatus.SPP bit to decide the trap origin, preventing user-space forgery.
A memory leak vulnerability in the Linux kernel's power sequencing component for pcie-m2 was fixed. The function of_regulator_bulk_get_all() allocates an array that the caller must free, but pwrseq-pcie-m2.c did not free this array, causing a memory leak. The fix adds an explicit kfree() call to release the allocated memory.
CVE-2026-99006 is a high-severity vulnerability in the Linux kernel's drm/i915/gem subsystem. It involves an out-of-bounds memory free operation where the function eb_relocate_parse_slow() may call kvfree() on entries beyond the original exec array boundary. This occurs due to a mismatch between the buffer count used for cleanup and the actual exec object count, potentially leading to memory corruption.
A vulnerability in the Linux kernel's unshare system call was resolved. The issue involved dropping active namespace references that were never taken, leading to reference count inconsistencies. This could cause namespaces the caller lives in to no longer be listed by listns(). The problem occurred when set_cred_ucounts() failed during ksys_unshare(), causing improper reference decrementing. The fix involved properly freeing nsproxy structures that were prepared but never installed.
A vulnerability in the Linux kernel's RTC device driver allows potential information leakage due to uninitialized padding in the rtc_wkalrm structure. This occurs when the structure is returned to userspace via the RTC_WKALRM_RD ioctl call, exposing kernel stack data. The issue is addressed by zero-initializing the structure at declaration to prevent leakage.
A missing authorization vulnerability exists in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9. This flaw allows a local application without any permissions to execute arbitrary operating system commands as root by passing a caller-supplied string to the root-privileged 'assistant' daemon's system() call without verifying caller identity or permissions.