CVE-2026-79610

XSA-501 was about issues with v1 - v2 and v2 - v1 changes racing certain other grant table operations. Sadly a v2 - v1 - v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence...

CVE-2026-79610 grant-table: double version change race

XSA-501 was about issues with v1 - v2 and v2 - v1 changes racing certain other grant table operations. Sadly a v2 - v1 - v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence...

ROS-20261013-73-0369

The vulnerability in the kernel-lt is related to unvalidated array indexing. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2026-111666

Name of the Vulnerable Software and Affected Versions xen versions prior to 4.22.0 06-1.1 Description A race condition occurs during grant table operations when transitioning between v1 and v2. Specifically, a sequence of v2 to v1 and then back to v2 changes can cause status pages to be freed and...

ROS-20261013-73-0449

The vulnerability in the kernel-lt is related to unvalidated array indexing. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

glibc: Fix out-of-bounds array write in tdelete

A flaw was found in glibc. An out-of-bounds array write vulnerability exists within the tdelete function. This issue occurs due to incorrect management of array sizes, which can lead to memory corruption. A local attacker with low privileges could potentially exploit this to cause a denial of...

CVE-2026-84286

The exllamav3_ext CUDA extension contains an out-of-bounds (OOB) memory access vulnerability in its kernel-table dispatch process. The root cause is a lack of bounds checking where the checkpoint-derived block index (cbi ) is used to access a fixed 24-entry array. If a crafted input sets the kern...

CVE-2026-84286 OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table

ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions...

CVE-2026-84286 OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table

ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions...

PT-2026-121323

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs zdr bytes, libnfs zdr string, and libnfs zdr array. The caller-supplied maxsize value is not honored...

PT-2026-110434

Name of the Vulnerable Software and Affected Versions libnfs versions prior to 7613236 Description ZDR decoding in libnfs contains an out-of-bounds write issue within the file lib/libnfs-zdr.c. This occurs because the maxsize value provided by the caller is not honored during the execution of the...

PT-2026-120384

Уязвимость функции collect keys RDP-клиента FreeRDP связана с неверным индексированием массива. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код...

EulerOS 2.0 SP11 : perl-DBI (EulerOS-SA-2026-4359)

According to the versions of the perl-DBI packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in...

Linux Distros Unpatched Vulnerability : CVE-2013-10076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call avextend av, len-1 . On an empt...

glibc security, bug fix, and enhancement update

An update is available for glibc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The glibc packages provide the standard C libraries libc, POSIX thread librarie...

RLSA-2026:79281 Moderate: glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name service cache daemon nscd used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fixes: glibc:...

Denial-of-service (DoS)

github.com/luskaner/agelanserver/server is vulnerable to a denial-of-service DoS. The vulnerability is due to the lack of request body size limits and validation of the attacker-controlled JSON array length, which allows a remote unauthenticated attacker to trigger excessive memory allocation by...

RockyLinux 9 : glibc (RLSA-2026:79281)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:79281 advisory. glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion CVE-2026-6791 glibc: glibc: Process abort due to invalid memory in wordexp...

GHSA-4JFQ-PMQ9-257H ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

Summary The AoE3 POST /game/cloud/getFileURL handler in luskaner/ageLANServer's bundled game server decodes an attacker-controlled names JSON array and immediately allocates response storage sized directly from the array's length makei.A, lenreq.Names.Data, with no request body size limit and no...