EUVD-2026-79243

A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16...

CVE-2026-92176 pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability

pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must...

Linux Distros Unpatched Vulnerability : CVE-2026-80985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys read the part of a v2 message that does not fit...

NewStart CGSL MAIN 7.02 : curl Vulnerability (NS-SA-2026-0092)

The remote NewStart CGSL host, running version MAIN 7.02, has curl packages installed that are affected by a vulnerability: - 1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target same hostname, but using clear text...

Linux Distros Unpatched Vulnerability : CVE-2026-85769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state for example during a virtual machine's power-on or...

The vulnerability of the library for working with X Pixmap (XPM) files, LibXpm, arises from reading data beyond the buffer’s acceptable limits. This allows an attacker to cause a service failure.

The vulnerability of the library for working with X Pixmap XPM files in LibXpm involves reading data beyond the allowable buffer size. Exploiting this vulnerability can allow an attacker to cause a service failure...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X.Org X server. This integer underflow vulnerability, specifically related to the handling of the XKB compatibility map, allows an attacker with local or remote X11 server access to trigger a buffer read overflow. This can lead to memory safety violations and...

CVE-2026-70653 libvips: Possible heap-based buffer read overflow when decoding a well-crafted RLE Radiance image

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat marker at the beginning of a scanline in scanlinereadold and read q-1 before any prior pixel exists. A crafted Radiance...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100119 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLANULSTRING These attributes are evaluated as c-string passed to strcmp, but...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100131)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100131 advisory. In the Linux kernel, the following vulnerability has been resolved: netlabel: validate unlabeled address and mask attribute lengths netlblunlabeladdrinfoget used the...

Linux Distros Unpatched Vulnerability : CVE-2026-68385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/checksum: Fix csumpartial without vector facility Currently csumpartial calls csumcopy with copy=false and dst=NULL. On machines without the vector facilit...

CVE-2026-68351

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170cmdcallback logs the mismatch and calls carl9170restart but then falls through to...

UBUNTU-CVE-2026-68388

In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3simplefallocaterange can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled,...

CVE-2026-20346

Summary: CVE-2026-20346 affects the PDF file format parser in ClamAV. The vulnerability arises from improper boundary checks during PDF content processing, leading to an out-of-bounds buffer read and memory corruption. Impact as described: An unauthenticated, remote attacker can submit a crafted ...

CVE-2026-71498

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated incomplete multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final,...

gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causi...

CVE-2026-66759

A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icnsdecompres...

Siemens SIMATIC S7-1500 CPU 1518 MFP Use After Free (CVE-2025-39691)

"In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bhread helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in endbufferreadsync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Com...

EUVD-2026-48947

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

CVE-2026-45812

Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...