These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
SWUpdate through 2026.05.1 contains a critical vulnerability in crypto/swupdate_cms_verify_openssl.c that allows attackers to bypass CMS signature verification by embedding untrusted X.509 certificates. This issue, with a CVSS score of 9.2, enables malicious updates to be installed by entities holding a signing key from a sibling intermediate under the same root.
CVE-2026-28525 is an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c of SWUpdate. This vulnerability allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing. The vulnerability is triggered when the buffer length falls within a specific range, c [truncated]