high · CVSS v3 7.8

CVE-2026-55261

In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing per…

Description

In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Scores

Severity
high
CVSS v2
4.6
CVSS v3
7.8
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-119301

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

View analysis

high

CVE-2026-106805

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts can therefore exhaust the UE IP address pool, preventing new UEs from establishing PDU sessions and resulting in denial of service.

View analysis

high

CVE-2026-106807

A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, but the failure is not handled properly and leads to an ogs_assert(new) failure in ogs_pfcp_xact_receive(). An attacker able to send PFCP messages to the affected SMF/UPF can exhaust transaction resources and cause the network function process to terminate with SIGABRT, resulting in service disruption and preventing further session establishment until the affected component is restarted.

View analysis

high

CVE-2026-120596

A high-severity denial-of-service flaw exists in the TCP options parser of Nut/Net TCP/IP stack used in Nut/OS up to 5.1. An unauthenticated attacker can send a crafted TCP segment that triggers an infinite loop, blocking all TCP services on the device until reboot. This impacts any device running Nut/OS with open TCP ports.

View analysis