A vulnerability identified as CVE-2026-20553 involves a possible out-of-bounds write in DA due to a missing bounds check. This flaw could allow local escalation of privilege if an attacker has physical access to the device. Exploitation does not require additional execution privileges or user interaction. No patch information is currently available.
A vulnerability in the modem component allows an out of bounds write due to a missing bounds check. This flaw could enable remote escalation of privilege if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require user interaction or additional execution privileges.
CVE-2026-20552 is a vulnerability in the ccci component involving a possible out of bounds write caused by a missing bounds check. Exploitation requires user interaction and could result in a remote denial of service without additional execution privileges.
A vulnerability in the modem component allows an out of bounds write due to a missing bounds check. This flaw can be exploited remotely by an attacker controlling a rogue base station to cause a denial of service on the affected device without requiring user interaction or additional privileges.
A vulnerability in the modem component allows a possible system crash due to a missing bounds check. This flaw could enable remote escalation of privilege if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation requires user interaction. A patch identified as MOLY01911177 addresses this issue.
A vulnerability in the modem component allows a possible out-of-bounds write due to a missing bounds check. This flaw could enable remote escalation of privilege if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require user interaction or additional execution privileges.
A vulnerability in the Modem component allows an out of bounds write due to an integer overflow. This flaw could enable remote escalation of privilege if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require user interaction or additional execution privileges. Patches identified as MOLY01872867 and MOLY01774038 address the issue.
A vulnerability in the GNSS component allows an out of bounds write due to a missing bounds check. Exploitation requires user interaction and could result in a local denial of service without additional privileges.
A use-after-free vulnerability in the GPU pdma component can lead to local escalation of privilege without requiring additional execution privileges or user interaction.
A vulnerability in the modem component allows an out-of-bounds write due to a missing bounds check. This flaw could enable remote escalation of privilege if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require user interaction or additional execution privileges.
A vulnerability in the GNSS component allows a possible out-of-bounds write due to a missing bounds check. Exploitation requires user interaction and could result in a local denial of service without additional privileges.
A vulnerability in a modem component allows a possible out-of-bounds write due to a missing bounds check. This flaw could enable remote escalation of privilege if a user equipment (UE) connects to a malicious base station controlled by an attacker. Exploitation does not require additional execution privileges or user interaction. A patch has been identified (Patch ID: MOLY01857954), but no public exploit or detailed CVSS score is available.
A path traversal vulnerability exists in deepset-ai farm up to version 0.8.0 in the WordEmbedding_LM.load function within the Model Package Loader component. This vulnerability allows local attackers to manipulate the embeddings_filename argument to access unauthorized file paths. The vulnerability has been publicly disclosed with exploit details available. The affected versions are no longer supported by the maintainer.
A path traversal vulnerability exists in deepset-ai farm versions up to 0.8.0 in the EmbeddingTokenizer.from_pretrained function within farm/modeling/tokenization.py. This flaw allows remote attackers to manipulate the vocab_filename argument to perform path traversal. The vulnerability affects unsupported versions of the product. Exploit code has been published, but no vendor response or patch is available.
A vulnerability in Modem software allows an out of bounds write due to a missing bounds check. This flaw can be exploited remotely by an attacker controlling a rogue base station to escalate privileges on the affected device without requiring user interaction.
A vulnerability in the modem component allows an out of bounds write due to an incorrect bounds check. This flaw can be exploited remotely by an attacker controlling a rogue base station to escalate privileges on the affected device without requiring user interaction.
A path traversal vulnerability exists in Webpro-nl Knip up to version 6.44.0 in the writeFile function of the Workspace Handler component. This flaw allows remote attackers to manipulate the workspaces argument to perform unauthorized file system access. The vulnerability has a medium severity with a CVSS score of 6.3. Public exploit details have been disclosed, but no vendor response or patch is currently available.
A vulnerability in http4k versions from 4.9.10.0 up to but not including 6.60.0.0 allows on-path attackers on non-TLS channels to modify the body of authenticated requests without invalidating the Authorization header. This occurs because the DigestEncoder component does not hash the request entity body when computing the auth-int digest, resulting in a missing integrity check.
A path traversal vulnerability exists in Aklivity Zilla up to versions 1.3.4, 2.4.7, and 2.5.0-rc2 in the Path.resolve function of the FileSystemServerFactory component within the http-filesystem binding. This flaw allows remote attackers to manipulate path parameters to access unauthorized files. Public exploit code is available. Upgrading to version 2.5.0-rc3 addresses this issue.
Network-AI versions from 5.14.0 up to but not including 5.15.5 contain a missing authentication vulnerability in the A2AServer class. This flaw allows unauthenticated attackers to perform task operations such as executing tasks, reading results, and canceling tasks by sending JSON-RPC requests without requiring a Bearer token when no secret is configured.