CVE-2026-115919 ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...

CVE-2026-115919 ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...

CVE-2026-115919 ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2, Apple iPadOS versions prior to 26.7.2, Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2 and 27.2, Apple iPadOS versions prior to 26.7.2 and 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe versions prior to 26.7.2, Apple tvOS versions prior to...

Apple iOS Resource Management Vulnerability

Apple iOS versions prior to 26.7, Apple iPadOS versions prior to 26.7, Apple iOS versions prior to 27, Apple iPadOS versions prior to 27, Apple macOS Golden Gate versions prior to 27, Apple macOS Sequoia 15.8 versions prior to 27, Apple macOS Tahoe versions prior to 26.7, Apple tvOS versions prio...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the DateTime Hebrew-number parsing process. An attacker can cause the application to terminate unexpectedly by providing specially crafted input that leads to reading outside the expected stack bounds. Remediation...

CVE-2026-107738

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

CVE-2026-107738

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

EUVD-2026-95413

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

CVE-2026-107738 SumatraPDF: Untrusted binary record offset used without lower-bound validation

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ narrows file-controlled unsigned string offsets from /WINDOWS and /IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /STRINGS buffer,...

CVE-2026-107730 SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation...

CVE-2026-107730

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation...

CVE-2026-107730

The multi-format reader SumatraPDF (version 3.7.0.22298 ) contains a signed integer overflow vulnerability in the LitParseHeader() function located in src/LitDoc.cpp . The issue occurs because the software uses signed 32-bit arithmetic to compute the section offset (hdrLen + nPieces * 16) without...

EUVD-2026-95402

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation...

DEBIAN-CVE-2026-106428

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...

CVE-2026-106428

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...

UBUNTU-CVE-2026-106428

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...

CVE-2026-106433

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

CVE-2026-106428

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...