CVE-2026-16515 ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack

neticmpv6senderror in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules do not answer an ICMPv6 error with an ICMPv6 error. It did not check whether the triggering packet's source address identifies a single node rule e.6 or whether the packet was sen...

CVE-2026-16515 ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stack

neticmpv6senderror in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules do not answer an ICMPv6 error with an ICMPv6 error. It did not check whether the triggering packet's source address identifies a single node rule e.6 or whether the packet was sen...

Security update for nodejs18

This update for nodejs18 fixes the following issues: CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request bsc1236258. CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218...

Signal-iOS v8.29.0.1866

Signal iOS Signal is a free and open source messaging app for simple private communication with friends. Also available on Android and Desktop. Questions? For troubleshooting and questions, please visit our support center or unofficial community forum. Contributing Bug Reports The best way to...

SUSE CVE-2026-93167

In the Linux kernel, the following vulnerability has been resolved: csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from ptregs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments...

ROS-20260918-73-0120

The vulnerability of the scarlett2usbgetconfig function in the sound/usb/mixerscarlett2.c module, which supports USB audio devices in Linux operating systems, is related to incorrect calculation of the buffer size. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2026-69184: Inefficient Algorithmic Complexity

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

CVE-2026-69186: Uncontrolled Resource Consumption

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsparse trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because processanswer invokes parsing before transaction ID and...

PT-2026-95510

Name of the Vulnerable Software and Affected Versions Forget-C Jellyfish AI Short Drama Studio versions 0.1.0-alpha through 0.3.2 Description An issue exists within the FastAPI component, specifically in the backend/app/dependencies.py file. Remote manipulation of an unknown function in this file...

Linux Distros Unpatched Vulnerability : CVE-2026-93393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that...

Linux Distros Unpatched Vulnerability : CVE-2026-93167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from ptregs before calling the syscall handler. On C-SKY ABIv...

PT-2026-95410

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The net icmpv6 send error function in subsys/net/ip/icmpv6.c fails to implement all RFC 4443 section 2.4 suppression rules, which dictate that an ICMPv6 error should not be answered with anoth...

CVE-2026-16515: Insufficient Control of Network Message Volume (Network Amplification)

neticmpv6senderror in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules do not answer an ICMPv6 error with an ICMPv6 error. It did not check whether the triggering packet's source address identifies a single node rule e.6 or whether the packet was sen...

CVE-2026-93559: Missing Authentication for Critical Function

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependencies.py of the component FastAPI. The manipulation leads to missing authentication. It is possible to initiate the attac...

ROS-20260918-73-0032

The vulnerability of the tiadcreadmeasurement function in the drivers/iio/adc/ti-adc161s626.c driver for various types of embedded sensors in the Linux operating system is related to copying buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this...

PT-2026-95615

Name of the Vulnerable Software and Affected Versions IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 Description The IBM MQ C client fails to properly validate responses from the queue manager when requesting AMS Application Managed Service policy data. This flaw could allow a remote...

Linux Distros Unpatched Vulnerability : CVE-2026-8674

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200...

Integer Underflow (Wrap or Wraparound)

Overview Affected versions of this package are vulnerable to Integer Underflow Wrap or Wraparound via the bsonnewfrombuffer function. An attacker can cause a crash by supplying crafted BSON data with a zero-length prefix, leading to a heap out-of-bounds read when the function fails to validate th...

CVE-2026-54633

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...

CVE-2026-53534

JabRef , a desktop BibTeX/BibLaTeX manager, is affected by an operating-system command injection in its CAYW (Cite-As-You-Write) Sublime Text integration prior to 6.0-alpha.6 . When JabRef's built-in HTTP server or jabsrv is enabled, the GET /better-bibtex/cayw endpoint accepts an external comman...