In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption

Out-of-bounds memory access in a device driver due to improper resource state tracking.

In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading to denial of service or privilege escalation.

Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.

Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.

In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service.

Integer overflow in NPU driver parameter processing due to insufficient bounds checking.

A double free vulnerability in NPU driver due to improper pointer management (941)

A double free vulnerability in NPU driver due to improper pointer management (940)

Improper handling of messages before AS security activation can cause unexpected behavior

In the baseband, memory corruption during NAS packet processing can cause a denial of service.

In the NAS message handler, improper validation of the length field in NAS message causes memory corruption

API keys, credentials, and configuration parameters embedded in the MatchPoint APK

API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account

In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid

CVE-2026-84473

Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.

CVE-2026-90975

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mode read and write access, which can be leveraged for local privilege escalation and arbitrary kernel code execution.

CVE-2026-122113

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and causes a system crash (bugcheck), resulting in a denial of service. No authenticated user session is required.

Hickory DNS before 0.26.2 Denial of Service via Missing DNS-over-QUIC Request Read Timeout

The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely, consuming server resources and causing a denial of service.

Give - Peer-to-Peer <= 2.9.5 - Authorization Bypass to Team Modification and Media Upload

The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers who know or discover an existing campaign and team ID to modify the team's name, story, goal, access and notification settings, set its profile image URL, and upload WordPress-allowed media files as parentless attachments. This vulnerability can be combined with CVE-2026-82568 to achieve unauthenticated remote code execution.