CVE-2026-48186 is a vulnerability in the Samsung Semiconductor Exynos 1280 chipset involving improper handling of messages before AS security activation, which can cause unexpected behavior. A fix was released in October 2026.
CVE-2026-69006 is a vulnerability in the Samsung Semiconductor Exynos 850 where insufficient validation of length fields in the GNSS firmware loader can lead to kernel-memory corruption. This flaw was identified and fixed in November 2026.
CVE-2026-69066 is a vulnerability in the Samsung Semiconductor Exynos 2200 GPU driver caused by improper validation of VMID reservation, leading to memory corruption. The issue is classified under CWE-754, which involves improper checks for unusual or exceptional conditions. A fix is available as of November 2026.
CVE-2025-66368 is a vulnerability in the Samsung Semiconductor Exynos 1080 chipset involving improper handling of SDP payloads, which can lead to a denial of service condition. The flaw is categorized under CWE-754, indicating an improper check for unusual or exceptional conditions. A fix was released in October 2026.
CVE-2026-35495 is an improper access control vulnerability in the IMS stack of Samsung Semiconductor's Exynos 1080 chipset. It arises from improper handling of SIP packets, leading to incorrect access control decisions. A fix was released in October 2026.
CVE-2025-66365 is a vulnerability in the Samsung Semiconductor Exynos 1080 chipset caused by improper handling of SIP packets, leading to baseband crashes. The issue is categorized under CWE-754, indicating an improper check for unusual or exceptional conditions. A fix for this vulnerability was released in October 2026.
CVE-2025-66364 is a vulnerability in the Samsung Semiconductor Exynos 850 chipset where continuously sending control-plane messages causes the baseband to crash. This is due to an improper check for unusual or exceptional conditions (CWE-754). A fix was released in October 2026.
Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema regexes with a backtracking budget but calls :re.run/3 without :report_errors, so a match that exhausts the budget returns the same :nomatch as a real non-match. A key that matches a patternProperties regex is then checked against additionalProperties or not at all, and a string that matches a not subschema with a pattern is accepted. Before the budget existed, Regex.match?/2 failed the same way at Erlang's default match limit.
Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget.
This issue affects jsv: from 0.1.0 before 0.26.2.
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-controlled `proofData`, performs a `staticcall` to `address(this)`, and treats a successful call as proof acceptance. If the first four proof bytes match another external selector exposed by the wrapper, dispatch can invoke a successful non-verifier function instead of the generated Halo2 fallback verifier. Applications using the generated Solidity wrapper can consequently accept arbitrary app commitments and public values without checking the proof suffix, accumulator, app commitments or public values. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.
SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed `_sd` array and returns a reduced claim set, reporting success while the Issuer signature remains valid. Both a tampered Disclosure that remains valid JSON and a Disclosure containing invalid UTF-8 bytes reach this silent-drop behavior. In the latter case, the `TextDecoder / Buffer` decoding path substitutes U+FFFD replacement characters, recovering syntactically valid disclosure data instead of rejecting the malformed input. This violates RFC 9901 section 7.1 step 5, which requires rejection of unreferenced Disclosures, and section 7.1 step 3 / section 4.2.1, which require rejection of invalid Disclosures. A malicious holder can exploit this omission primitive, including through `SDJwtInstance.verify()` when key binding is required. An on-path attacker can also tamper with a Disclosure when the relying party does not enforce key binding; enforced key binding rejects on-path tampering because it invalidates the KB-JWT `sd_hash` binding. If the relying party defaults to allowing access when a constraining age, role, or restriction claim is absent, the silent claim reduction can change an authorization decision without an error. This issue is fixed in `@sd-jwt/core` version 0.20.0; no patched version of the standalone `@sd-jwt/decode` package is identified.
Mattermost versions up to 11.9, including 11.1.9, 11.5.8, and 11.10.7.0, contain a vulnerability where the application fails to properly validate the length of Zoom chat lines before processing. This flaw allows an authenticated attacker to crash the Agents plugin by submitting a Zoom chat transcription with short continuation lines. The issue is categorized as CWE-754, an improper check for unusual or exceptional conditions.
Mattermost versions 11.7.0 through 11.7.11 contain a vulnerability in the Playbooks plugin where null elements are not properly validated during the decoding of playbook import conditions. This flaw allows an authenticated attacker to crash the Playbooks plugin instance-wide by submitting a crafted import request with a null condition.
CVE-2026-86412 is a high-severity vulnerability in curl where a remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On subsequent curl invocations using the same cookie and cookie-jar paths, curl fails before connecting and replaces the cookie jar with an empty file, deleting cookies for unrelated domains.
CVE-2026-113380 is a critical vulnerability in the RingRTC library used by Signal before version 2.72.0. It involves an improper check for unusual or exceptional conditions (CWE-754) where a peer can saturate a call's FSM queue, disrupting the local hangup process and preventing proper teardown of the call's audio and possibly video tracks.
A vulnerability in libIEC61850 prior to version 1.6.2 allows remote attackers to cause a denial of service via a NULL pointer dereference. The issue arises from improper validation of an alternate-access sub-array range in the MMS Read service, leading to a crash when handling out-of-range array indices in data models containing arrays.
kin-openapi versions prior to 0.148.0 improperly handle unusual numeric values such as YAML NaN and infinity during OpenAPI 3.1 validation. This flaw allows a remote unauthenticated client to send specially crafted YAML request bodies containing .nan, .inf, or -.inf values, triggering a panic in the dependency jsonschema v6.0.2. The panic occurs due to dereferencing a nil big.Rat during request validation, which can cause process termination in some hosting environments. The issue is fixed in version 0.148.0.
CVE-2026-0317 is a low-severity denial of service (DoS) vulnerability in Palo Alto Networks PAN-OS software affecting certain versions. An authenticated user with a read-only administrator role can cause a DoS by sending a specially crafted API request. The risk is mitigated by restricting management web interface access to trusted internal IP addresses. Cloud NGFW, Panorama, and Prisma Access are not affected by this issue.
CVE-2026-0318 is a medium severity stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS software on Panorama. Exploitation can cause a denial of service (DoS) condition, with repeated attempts forcing Panorama into maintenance mode. Cloud NGFW, Prisma Access, and standalone PAN-OS firewalls are not affected by this issue.
CVE-2026-0319 is an input handling vulnerability in the GlobalProtect gateway component of Palo Alto Networks PAN-OS software. It allows an authenticated user to establish a GlobalProtect session impersonating another user. This issue affects specific versions of PAN-OS but does not impact the Cloud NGFW or Panorama products. The vulnerability has a medium severity rating with a CVSS score of 4.9.