CVE-2026-59601

Heap Buffer Overflow in cldma_alcedo Causing Remote Information Disclosure

In CalculateSampleRate of cldma_alcedo.cc, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-59630

Android Security Policy Downgrade Enables Local Privilege Escalation

In check_constraint_monotonicity of lib.rs, there is a possible way to downgrade stored security policies and bypass rollback protection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-59636

Premature Anti‑Rollback Fuse Update Enables Permanent Local Denial of Service on Android Devices

In has_booted_successfully of sys_state_setup_otp_ta.c, there is a possible way to trigger a permanent denial of service via premature anti-rollback fuse updates due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128081

AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth

AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper can recurse without an effective MaxDepth limit when mapping polymorphic graphs through Include or IncludeBase, runtime-typed object or interface members, nested Dictionary<string, object> or ExpandoObject sources, or recursive ConvertUsing type converters. Deep attacker-influenced graphs on these paths can throw an uncatchable StackOverflowException and terminate the process. This issue is fixed in versions 15.1.4 and 16.3.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Luckypennysoftware

Products

Automapper

CVE-2026-97683

IBM Cyber Fraud includes components with multiple known vulnerabilities

IBM Cyber Fraud 1.0.0 through 1.1.0 could allow a local attacker to bypass security restrictions due to a missing or misconfigured security context.

CVSS 3.1 · 2.5 Low EPSS n/a KEV · Not listed

Vendors

Ibm

Products

Cyber Fraud

CVE-2026-58779

Android Permission Bypass Leading to Local Privilege Escalation

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-128118

SvelteKit: Build-time server-only module import guard could fail, resulting in server secrets being statically replaced in client bundle

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build-time server-only module guard did not treat src/params.js as a client entry point even though parameter matchers can run in the browser. Server-only modules imported through src/params.js could consequently enter the client bundle, where statically replaced private environment values or other server secrets could be exposed. This issue is fixed in 3.1.1.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-56946

Local Privilege Escalation in ARM SMMU v3 Driver

In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-56956

Heap Buffer Overflow in Android TextRtpPayloadEncoderNode Enables Remote Code Execution

In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-57009

Logic Error in Android AVC Decoder Allows Local Privilege Escalation

In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-58811

Logic flaw in smmu_get_mair_idx leads to local information disclosure via DMA memory attributes

In smmu_get_mair_idx of smmu.c, there is a possible way to apply incorrect memory attributes to direct memory access mappings due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 4.0 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-49341

BACnet Stack: Uncontrolled recursion in Timer object writeback path leads to remote server stack overflow

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, there is a remotely reachable denial-of-service vulnerability in bacnet-stack affecting the default demo server built from the unmodified apps/server/main.c. This issue has been patched in version 1.5.1.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-129134

MRBS before 1.13.0 Password Reset Poisoning via Host Header Injection

MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $url_base is unset. Attackers can request a reset for a victim so AuthDb::notifyUser() emails a link pointing to their host, capturing the reset key when opened to take over accounts including administrators.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed

Vendors

Meeting-room-booking-system

Products

Mrbs-code

CVE-2026-57010

Out‑of‑Bounds Write in Android Data Manager Enables Remote Privilege Escalation

In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-57036

Logic Error in send_vdu_directive Enables Local Privilege Escalation on Android

In send_vdu_directive of gdmc/gsp/dev/bmsm/plat/lga/vdu.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-57048

Android Signature Verification Bypass Leading to Local Privilege Escalation

In authenticate of verify_image, there is a possible Signature verification logic bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-58677

Fault Injection Bypass of Secure Boot Signature Verification

In get_secure_boot_mode of auth.rs, there is a possible way to bypass root signature verification via fault injection due to a logic error. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-58684

Permission Bypass in Android SMMU leading to Local Privilege Escalation

In smmu_config_l3tt of smmu.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-58722

Heap Buffer Overflow in Android chpp Leads to Remote Privilege Escalation

In chppProcessDiscoverAllResponse of system/chre/chpp/clients/discovery.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-63164

Omnispace Agora Project 26.10.0 IDOR via reloadMailTypeId Parameter

Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project