CVE-2026-33965

MediumCVSS 5.3/10Last modified Nov 10, 2026

Description

An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Nov 5, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-339662.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information LeakCVE-2026-339672.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driveCVE-2026-339682.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driveCVE-2026-339697.5In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of ServCVE-2026-339703.5An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330CVE-2026-339719.8In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condCVE-2026-339729.8In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.CVE-2026-339758.3Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpCCVE-2026-339769.6Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering CVE-2026-339776.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP clienCVE-2026-339786.1Notesnook is a note-taking app focused on user privacy & ease of use. Prior to version 3.3.17, a stored XSS vulnerability exists in the mobiCVE-2026-339798.2Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params)
CVE-2026-33965: Medium severity, CVSS 5.3 | Vulnix