chromium-browser: angle: Google Chrome (ANGLE): Arbitrary Code Execution vulnerability

A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds write vulnerability allows a remote attacker to potentially execute arbitrary code. By tricking a user into visiting a specially crafted HTML page, an attacker could bypass the browser's security sandbox and execute...

CVE-2026-111441 HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写

在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLLHEADSIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpys 拷贝输入，既未校验 lenTotal = lenUsed，也将 memcpys 目标大小写成 lenUsed 而非实际分配的...

EUVD-2026-104052

在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLLHEADSIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpys 拷贝输入，既未校验 lenTotal = lenUsed，也将 memcpys 目标大小写成 lenUsed 而非实际分配的...

CVE-2026-111441

The openGauss-server software contains a heap-based buffer overflow vulnerability in the src/gausskernel/cbb/utils/hll/hll.cpp file. The root cause is a validation flaw within the HllObjectUnpack() function, which fails to verify that lenTotal is greater than or equal to lenUsed when unpacking us...

CVE-2026-111441 HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写

在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLLHEADSIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpys 拷贝输入，既未校验 lenTotal = lenUsed，也将 memcpys 目标大小写成 lenUsed 而非实际分配的...

CVE-2021-41160

CVE-2021-41160 FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client...

Linux Distros Unpatched Vulnerability : CVE-2026-112062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdnshandleresponse that allows adjacent attackers to corrupt stack memory by sending mD...

PT-2026-117419

Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr load image in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past md...

Linux Distros Unpatched Vulnerability : CVE-2026-112060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode...

RHEL 10 : openexr (RHSA-2026:84796)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84796 advisory. OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document...

UBUNTU-CVE-2026-98635

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

UBUNTU-CVE-2026-98703

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

UBUNTU-CVE-2026-98545

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

UBUNTU-CVE-2026-98532

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

UBUNTU-CVE-2026-98456

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

UBUNTU-CVE-2026-98570

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dstdevoverhead The seg6, ioam6 and rpl lwtunnels size their skbcowhead request as the length they are about to push plus dstdevoverhead, then push the new headers and rebuild the mac...

RHEL 10 : mariadb11.8 (RHSA-2026:84799)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84799 advisory. MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation...

CVE-2026-98568

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

RHEL 9 : xorg-x11-server (RHSA-2026:84574)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84574 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical us...

UBUNTU-CVE-2026-98568

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...