CVE-2026-54467
High · 7.0CVSS
7.0
EPSS
0.2%
Published
Aug 26, 2026
CISA due date
—
The record
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87913 A missing S3 bucket ownership verification in the AWS Security Agent MCP server before… CWE-283
- CVE-2026-87912 A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon… CWE-283
- CVE-2026-85781 Unverified ownership of a storage access point in the volume deletion component of the… CWE-283
- CVE-2026-9745 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed… CWE-283
- CVE-2026-15599 Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research… CWE-283
- CVE-2026-44707 Chatwoot is a customer engagement suite. CWE-283
- CVE-2026-44562 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… CWE-283
- CVE-2026-40337 The Sentry kernel is a high security level micro-kernel implementation made for high… CWE-283