71889 matches found
CVE-2026-107820 x64dbg-MCP Server vulnerable to pre-authentication denial of service through Content-Length integer overflow
x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcpserver.zig parses an unbounded Content-Length value in parseContentLength and uses it in unchecked usize addition in wsRecv before token...
CVE-2026-83632
A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS or memory corruption by sending specially crafted network requests to services utilizing the C++ HTTP transport layer. Due to improper input validation and resource handling, these requests trigger an integer...
Security Bulletin: Security vulnerability in Java affects IBM Robotic Process Automation
Summary A security vulnerability in Java affects IBM Robotic Process Automation. Java is used by IBM Robotic Process Automation as part of its deployment. This bulletin identifies the fixes required to resolve the vulnerabilities. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS...
CVE-2026-96396
The Affinity by Canva application for macOS before 3.3.1 October 2026 release did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could...
CVE-2026-98222
A flaw was found in the Linux kernel's encrypted keys subsystem. An integer overflow occurs during memory size calculations for key data, resulting in an undersized buffer allocation. A local user can exploit this issue by supplying crafted key data to trigger an out-of-bounds write to kernel...
EUVD-2026-95751
The Affinity by Canva application for macOS before 3.3.1 October 2026 release did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could...
CVE-2026-96396
The Affinity by Canva application for macOS before 3.3.1 October 2026 release did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could...
CVE-2026-96396
The Affinity by Canva application for macOS versions prior to 3.3.1 (October 2026 release) is vulnerable to an integer overflow leading to a heap-based buffer overflow . The flaw occurs because the application does not safely calculate the size of an image buffer when generating QuickLook thumbna...
BIT-THRIFT-2026-66837 Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length
Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
SUSE-SU-2026:24131-1 Security update for google-osconfig-agent
This update for google-osconfig-agent fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283672. Changes for google-osconfig-agent: - Update to version...
CVE-2026-19569 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap
dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...
EUVD-2026-95529
dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...
CVE-2026-19569
An integer overflow vulnerability exists in the Zephyr RTOS kernel's dynamic_object_create() function within kernel/userspace/userspace.c. The system fails to check for unsigned wrap-around when computing backing allocations for dynamically allocated kernel objects and thread stack elements. An u...
CVE-2026-19569 Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap
dynamicobjectcreate in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as objsizegetotype + size, and for thread stack elements as STACKELEMENTDATASIZEsize a round-up plus fixed overhead, without checking either expression for unsigned...
OPENSUSE-SU-2026:22041-1 Security update for chromium
This update for chromium fixes the following issues: Changes in chromium: - Chromium 155 promoted to stable - 155.0.8059.39 boo1284354: CVE-2026-106382: Use after free in Chromecast CVE-2026-106197: Use after free in Browser CVE-2026-106358: Use after free in Navigation CVE-2026-106347: Use after...
CVE-2026-106332
An integer overflow flaw was found in the Compositing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553454734...
SUSE CVE-2024-43091
In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...
CLEANSTART-2026-UC87477 If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes
Security vulnerability affects the apache2 package. If LimitXMLRequestBody is set to allow request bodies larger than 350MB defaults to 1M on 32 bit systems an integer overflow happens which later causes out of bounds writes...
CLEANSTART-2026-ZN45327 phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check
Security vulnerability affects the php package. phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check...
CLEANSTART-2026-WW44198 SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger
Security vulnerability affects the php package. The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger...