PT-2026-93739

Name of the Vulnerable Software and Affected Versions ag-ui-protocol ag-ui version 1.0 Description A flaw in the JSON Parser component, specifically within the file src/stream/sse parser.cpp, allows a remote attacker to cause resource consumption through manipulation. Recommendations Apply patch...

CVE-2026-20242: Deserialization of Untrusted Data

A vulnerability in the External Database Access feature of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to execute arbitrary commands as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Jav...

CVE-2026-92363: Uncontrolled Resource Consumption

A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sseparser.cpp of the component JSON Parser. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. This patch is called...

Linux Distros Unpatched Vulnerability : CVE-2026-89875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: ti: vpe: quiesce overflow recovery before freeing streams The VIP overflow recovery worker is armed from the hardirq handler when a FIFO overflow is...

PT-2026-93370

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.22.0 through 1.26.1 Description A use-after-free issue occurs when the software is compiled for DNS-over-QUIC DoQ support using the --with-libngtcp2 flag. In this configuration, each DoQ stream utilizes an output...

PT-2026-93801

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A stream desynchronization issue exists in the AMQP wire-protocol parser. When the readLongstr function in read.go encounters a declared AMQP longstr length exceeding 0x7FFFFFFF the...

PT-2026-93822

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description The SSE client-to-server POST endpoints are marked as @csrf exempt and the SSE GET stream endpoint lacks an Origin check. This allows a cross-origin page to manipulate a session authenticated by victim...

SUSE CVE-2026-91752

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

CVE-2026-19774

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in...

AZL-103122 CVE-2026-19774 affecting package bluez 5.63-7

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in...

DEBIAN-CVE-2026-19774

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in...

EUVD-2026-79131

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in...

CVE-2026-19774 BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in...

CVE-2026-19774 BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in...

CVE-2026-19774

BlueZ A2DP Stack-based Buffer Overflow allows remote code execution as root on affected installations of the Linux Bluetooth protocol stack. The flaw resides in the handling of stream endpoints , where user-supplied data is copied to a fixed-length stack-based buffer without proper length validat...

CVE-2026-19774

BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in...

CVE-2026-91965

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct H...

UBUNTU-CVE-2026-91960

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

CVE-2026-91960

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

CVE-2026-91965 WWBN AVideo through 29.0 Broken Access Control via Live Endpoints

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct H...