DEBIAN-CVE-2026-70639

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

CVE-2026-70633

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray...

DEBIAN-CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

CVE-2026-43632

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/counttokens that bypass the task queue and access ctxserver.vocab directly on HTTP...

CVE-2026-19138

Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-11803

A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

GHSA-8HCV-X26H-MCGP node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

Description WrappedRE2::Replace builds the replacement result and hands it to V8 with .ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the string/buffer exceeds its maximum length: lib/replace.cc v1.24.1: cpp // L553 — Buffer return path...

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

Description WrappedRE2::Replace builds the replacement result and hands it to V8 with .ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the string/buffer exceeds its maximum length: lib/replace.cc v1.24.1: cpp // L553 — Buffer return path...

EUVD-2026-54159

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...

CVE-2026-71430

node-re2 provides RE2 bindings for Node.js. Prior to version 1.25.1, WrappedRE2::Replace could build a replacement result that exceeded V8’s maximum string length and call ToLocalChecked without checking the empty MaybeLocal. In such cases, a global replace with an output-amplifying template coul...

CVE-2026-19138

Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-19138

CVE-2026-19138 (Google Chrome) : A heap buffer overflow in the CrashReporting component allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page, affecting Chrome builds prior to 151.0.7922.109. The Chrome update notes indicate th...

CVE-2026-19138

Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-19138

Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

RXSA-2026:50978 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation CVE-2025-54518 Bug Fixes and Enhancements: Kernel crash in bpfforeacharrayelem due to missing backport of...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux SIG Cloud 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux...

CVE-2026-70635

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow...

CVE-2026-70635 TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative Index

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow...

CVE-2026-70633

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray...