CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457 rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457 rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

EUVD-2026-58047

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

CVE-2026-70457: Incorrect Calculation of Buffer Size

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parsesizearg where the return value of snprintf is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that woul...

EUVD-2026-57047

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925mcubsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68307

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925vifconnectiter replays firmware state for links tracked in mvif-validlinks. After MLO link changes or MCU timeout recovery, the driver bitmap can...

CVE-2026-68307

The CVE concerns the Linux kernel wifi driver mt76 (mt7925) where a reset/replay path replays firmware state for links tracked in mvif-&gt;valid_links. After MLO link changes or MCU timeout recovery, the driver bitmap can temporarily include a link whose mac80211 bss_conf has already gone away, l...

CVE-2026-68307 wifi: mt76: mt7925: fix crash in reset link replay

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925vifconnectiter replays firmware state for links tracked in mvif-validlinks. After MLO link changes or MCU timeout recovery, the driver bitmap can...

PT-2026-67890

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.6 OpenSIPS versions prior to 4.0.0-rc1 Description The construct uri function concatenates URI components including protocol, username, domain, port, and params into a fixed 1024-byte global BSS buffer without...

kernel: wifi: brcmfmac: validate bsscfg indices in IF events

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. This vulnerability occurs because the driver fails to properly validate bsscfg indices in interface IF events. An attacker could exploit this by sending a specially crafted IF event with an invalid bsscfg index, which could lead to an...

kernel: wifi: brcmfmac: validate bsscfg indices in IF events

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. This vulnerability occurs because the driver fails to properly validate bsscfg indices in interface IF events. An attacker could exploit this by sending a specially crafted IF event with an invalid bsscfg index, which could lead to an...

Astra Linux – Vulnerability in Linux 5.10

The Linux kernel before version 5.18.13 lacked a clear mechanism for handling the block starting symbol .bss. This allowed Xen PV guest OS users to cause a denial of service or gain privileges...

CVE-2026-43225

A flaw was found in the Linux kernel's rtl8723bs component. This memory leak vulnerability occurs when the cfg80211informbssframe function returns a NULL value on a failure path, preventing the allocated buffer from being properly freed. This can lead to a potential memory leak within the system...

CVE-2026-43225

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix memory leak on failure path cfg80211informbssframe may return NULL on failure. In that case, the allocated buffer 'buf' is not freed and the function returns early, leading to potential memory leak. Fix th...

CVE-2026-43225

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix memory leak on failure path cfg80211informbssframe may return NULL on failure. In that case, the allocated buffer 'buf' is not freed and the function returns early, leading to potential memory leak. Fix th...

CVE-2026-43225 staging: rtl8723bs: fix memory leak on failure path

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix memory leak on failure path cfg80211informbssframe may return NULL on failure. In that case, the allocated buffer 'buf' is not freed and the function returns early, leading to potential memory leak. Fix th...