mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()

A flaw was found in MariaDB server. An application processing non-validated user input, which then uses mysqlrealescapestring and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL...

libssh2: Fix of 3 CVEs

CVE-2019-3860: bounds-check SFTP packet sizes in sftppacketrequire/v and sftpbin2attr - CVE-2019-3861: bounds-check paddinglength in libssh2transportread...

mariadb: mariadb: Arbitrary code execution via insecure service account home directory

A flaw was found in MariaDB. The dedicated database service account was configured using the database data directory as its home directory. An authenticated database user with file-writing privileges could place malicious startup scripts into this directory. This could result in arbitrary code...

mariadb: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write

A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the allocated stack buffer. This flaw could lead to arbitrary code execution or cause the database server to...

mariadb: mariadb: Arbitrary code execution via crafted FRM metadata

A flaw was found in MariaDB. An attacker able to place a crafted table format FRM metadata file into the database data directory can exploit insufficient validation of metadata boundaries and field counts when the server opens the file. This could lead to out-of-bounds memory operations,...

CVE-2026-63626

Mongoose is an embedded web server and network library. Prior to 7.23, ppphandleipv6cp in src/l2ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MGENABLETCPIP and MGENABLEIPV6, an unauthenticated adjacent peer can complet...

CVE-2026-73261

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MGENABLETCPIP in src/netbuiltin.c does not reject a TCP option whose declared opts1 length exceeds the remaining option bytes. In handleopt, a NOP followed by a truncated MSS option causes...

CVE-2026-73260

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...

CVE-2026-73252

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MGTLSBUILTIN in src/tlsbuiltin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mgtlsrecvrecord, the msgsz...

CVE-2026-72131 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-72131 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-97966 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-97966 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-80521 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-80521 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-97904 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-97904 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-98025 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-98025 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-97608 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-97608 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-98186 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-98186 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-97524 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-97524 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-97523 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-97523 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-97522 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-97522 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-97556 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-97556 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...