CVE-2026-71226

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...

zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader

A flaw was found in zlib, a Ruby interface for the zlib compression/decompression library. The Zlib::GzipReader component contains a buffer overflow vulnerability. This occurs because the zstreambufferungets function does not ensure sufficient memory capacity before moving existing data, which ca...

Important: Red Hat Security Advisory: ruby security, bug fix, and enhancement update

An update for ruby is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

EUVD-2026-53351

tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer linebuf via memcpylinebuf, p, plen, guarded only by assertplen 4095. Because assert compiles to a no-op under -DNDEBUG standard for release builds, a crafted...

CVE-2026-71266 tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing

tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpylinebuf, p, plen, guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file...

CVE-2026-71267

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy...

CVE-2026-71265 Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()

Domoticz's MochadTCP::MatchLine handler for MOCHADRFSEC messages hardware/MochadTCP.cpp copies network-received data from the up-to-1028-byte mmochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches DS10A/KR10A/MS10A devic...

CVE-2026-71265

Domoticz's MochadTCP::MatchLine handler for MOCHADRFSEC messages hardware/MochadTCP.cpp copies network-received data from the up-to-1028-byte mmochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches DS10A/KR10A/MS10A devic...

CVE-2026-71265 Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()

Domoticz's MochadTCP::MatchLine handler for MOCHADRFSEC messages hardware/MochadTCP.cpp copies network-received data from the up-to-1028-byte mmochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches DS10A/KR10A/MS10A devic...

CVE-2026-71265

CVE-2026-71265: Domoticz MochadTCP::MatchLine() for MOCHAD_RFSEC messages copies up to 1028 bytes from m_mochadbuffer into a fixed 50-byte tempRFSECbuf using strcpy() without length checks, across three device branches (DS10A/KR10A/MS10A). An attacker on the local network that can reach the Mocha...

EUVD-2026-53350

Domoticz's MochadTCP::MatchLine handler for MOCHADRFSEC messages hardware/MochadTCP.cpp copies network-received data from the up-to-1028-byte mmochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches DS10A/KR10A/MS10A devic...

EUVD-2026-53348

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check if usTCPFrameBytesLeft MBTCPBUFSIZE uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit. An MBAP frame with a...

CVE-2026-71263 FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...

CVE-2026-71263 FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...

CVE-2026-71263

The FreeModbus LINUXTCP port has a concrete defect in xMBPortTCPPool(): the code uses a strict greater-than check (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE) against a 263-byte MB_TCP_BUF_SIZE limit. When an MBAP frame with Length 264 is processed, usTCPFrameBytesLeft becomes 263, the check passes...

CVE-2026-71261 dr_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buffer Overflow on 32-bit Builds

drlibs drwav.h all versions through current master contains an integer overflow in W64 CUE chunk metadata parsing. In drwavmetadataprocesschunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to sizet before dividing by DRWAVCUEPOINTBYTES; on 32-bit builds this truncation...

CVE-2026-71254

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handlereadfilerecord function FC 0x14, Read File Record in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's recordlength is at most 124, but i...

Important: Red Hat Security Advisory: ruby4.0 security, bug fix, and enhancement update

An update for ruby4.0 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader

A flaw was found in zlib, a Ruby interface for the zlib compression/decompression library. The Zlib::GzipReader component contains a buffer overflow vulnerability. This occurs because the zstreambufferungets function does not ensure sufficient memory capacity before moving existing data, which ca...

freeipmi: buffer overflows on response messages via ipmi-oem

A flaw was found in FreeIPMI. The ipmi-oem program is used to send Intelligent Platform Management Interface IPMI OEM commands for specific hardware vendors to retrieve specific information from the hardware. A malicious server can reply with crafted response messages and cause buffer overflows...