Low Severity Threats

CVE-2026-14286 is a vulnerability record that has been rejected and contains no technical details or description. There is no information about affected versions, impact, or remediation.

Six vulnerabilities have been identified in the widely used U-Boot bootloader that could allow attackers to execute malicious code during device boot. These flaws may enable stealthy firmware attacks that bypass security protections and install persistent malware. No specific affected versions or patches have been disclosed. There are no known exploits in the wild at this time. The severity is assessed as low based on available information.

CVE-2026-6872 is a vulnerability record that has been rejected and contains no detailed information about the nature of the vulnerability, affected versions, or impact. There is no CVSS score or technical details available to assess the threat.

CVE-2026-53780 is a reserved identifier for a vulnerability that has been rejected and contains no public technical details or impact information.

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's seven in-house IInArchive handlers in NanaZip.Codecs unconditionally dereference the caller-supplied Indices array inside Extract when the archive engine signals extract everything by passing Indices as NULL and NumItems as 0xFFFFFFFF. This causes a NULL pointer dereference in the standard Test archive or Extract all code path for WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile archives, resulting in a process crash. This issue is fixed in version 6.5.1749.0.

NanaZip versions prior to 6.5.1749.0 contain a vulnerability in the WebAssembly archive handler that allows an attacker to cause uncontrolled memory allocation by crafting archive files with maliciously large name and size fields. This can lead to memory exhaustion or process termination during archive listing or extraction. The issue is fixed in version 6.5.1749.0.

NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1749.0, NanaZip's UFS and FFS image handler in NanaZip.Codecs.Archive.Ufs.cpp validates the superblock block size only against the MINBSIZE lower bound and does not validate the fs_fsize fragment size, allowing attacker-controlled 32-bit fields to flow into indirect-block, directory, and extraction buffer allocations. A tiny crafted UFS image can force multi-gigabyte allocations during open or extraction, causing memory exhaustion or process termination. This issue is fixed in version 6.5.1749.0.

NanaZip versions prior to 6.5.1749.0 contain a vulnerability in the .NET single-file bundle handler where the extraction buffer size is derived from an unvalidated Size field. This can lead to uncaught exceptions such as std::bad_alloc or std::length_error escaping across COM boundaries and crashing the process. The issue is fixed in version 6.5.1749.0. The vulnerability has a low severity score and does not have known exploits in the wild.

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py follow HTTP redirects by default and resend user-configured auth headers and query parameters on the redirected request, allowing a compromised trusted destination or on-path attacker to receive secrets such as Authorization headers, bearer tokens, custom headers, and service keys. This issue is fixed in version 1.11.0.

In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible