Security Bulletin: This Power System update is being released to address CVE-2026-17093

Summary Power Systems Firmware is affected by a vulnerability in host firmware configuration parsing. An attacker with service-level access to the BMC/FSP can supply specially crafted configuration data, compromising the host firmware boot stage and everything subsequently loaded by it, resulting...

Security Bulletin: This Power System update is being released to address CVE-2026-16938

Summary Power Systems Firmware is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain...

Security Bulletin: This Power System update is being released to address CVE-2026-17097

Summary Power Systems Firmware is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL ...

Security Bulletin: This Power System update is being released to address CVE-2026-17091

Summary Power Systems Firmware is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a...

Linux Distros Unpatched Vulnerability : CVE-2026-72501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/bnxtre: Initialize dpi variable to zero dpi is initialized only for BNXTREALLOCWCPAGE, but copied for all the cases. So initialize the dpi to 0...

Numeric Truncation Error

Overview Affected versions of this package are vulnerable to Numeric Truncation Error in readbrtable in arch/WASM/WASMDisassembler.c. An attacker can cause no-progress disassembly or parser desynchronization by supplying a large, well-formed brtable instruction through csdisasm or csdisasmiter. T...

AZL-96746 CVE-2026-49282 affecting package rust for versions less than 1.90.0-10

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49263

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...

CVE-2026-49282

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49263

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...

UBUNTU-CVE-2026-49282

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49263

Summary: CVE-2026-49263 affects Capstone’s WebAssembly backend prior to 6.0.0-Alpha9. The WASM decoder in cs_disasm() and cs_disasm_iter() can be fed attacker-controlled raw instruction bytes, and for large but well-formed br_table encodings it can mis-handle lengths (exactly 65,536), causing the...

CVE-2026-49263

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...

EUVD-2026-58747

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...

EUVD-2026-58744

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49282 Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49282

Capstone (disassembly framework) vulnerability CVE-2026-49282 affects builds prior to 6.0.0-Alpha9: the cs_insn_name() API forwards caller-provided instruction IDs to architecture backends, with M68K and RISCV backends lacking sufficient bounds checks. A caller-controlled invalid instruction ID o...

CVE-2026-49282

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49282

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...

CVE-2026-49282 Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public csinsnname API forwards caller-supplied instruction IDs directly to the selected architecture backend. Most backends validate the ID before indexing instruction-name tables, but the M68K and RISCV backends have...