CVE-2024-14041 ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

CVE-2024-14041 ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

PT-2026-65511

schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the htmlToUTF8 HTML entity decoding function. The function parses attacker-controlled malicious HTML entities and uses memmove and memcpy to rearrange string content without validating buffer remaining size and...

CVE-2026-51270

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Linux Distros Unpatched Vulnerability : CVE-2026-55737

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term...

compat-libtiff3 security update

3.9.4-16 - fix CVE-2026-12912: heap-buffer-overflow in PixarLog ABGR decoding RHEL-189375...

CVE-2026-54890

Integer Underflow Wrap or Wraparound vulnerability in erlang otp erlang/otp erts modules, erlang otp erts erts modules allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BITBINARYEX...

PT-2026-64987

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format ETF binary to binary to term/1 to corrupt the BEAM heap pointer and crash the virtual machine. When decoding a LARGE TUPLE EXT term,...

swift-crypto: swift-crypto: Denial of Service due to double-free during RSA public key initialization

A flaw was found in swift-crypto. When an RSA Rivest-Shamir-Adleman public key is initialized from DER Distinguished Encoding Rules or PEM Privacy-Enhanced Mail formatted bytes, and an error occurs during the decoding process, a double-free vulnerability can be triggered. This issue, occurring wh...

SUSE CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...

Linux Distros Unpatched Vulnerability : CVE-2026-64832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to...

Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

Summary Cloudreve's built-in image processor decodes user-supplied images with Go's standard-library decoders image/png, image/jpeg, image/gif and guards only the compressed file size — never the decoded pixel dimensions. Go's decoders allocate a pixel buffer sized bytesPerPixel × width × height...

EUVD-2026-48614

Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decode...

CVE-2026-58586

CVE-2026-58586 concerns Image::WebP (Perl) versions through 0.2 that bundle libwebp 0.3.0. The module links the vulnerable library inside itself instead of using the system libwebp, so upgrading system libraries does not remediate. The bundled libwebp 0.3.0 contains multiple known issues, includi...

PT-2026-64433

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description Cloudreve contains an issue where the built-in image decoders for PNG, JPEG, and GIF formats limit only the compressed file size but do not restrict the decoded pixel dimensions. An authenticated...

CVE-2026-65703

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdscparsetdsf function fails to unreference the...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

EUVD-2026-47900

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download function — hooked to the unauthenticated WordPress wp action — decoding the...

PT-2026-64154

Name of the Vulnerable Software and Affected Versions FFmpeg versions 2.7 through 8.1.2 Description An out-of-bounds write issue exists in the TDSC video decoder. A remote attacker can cause heap corruption by providing a specially crafted AVI file that alters frame dimensions across TDSF frames...

GHSA-HPCC-26XQ-25FV Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

Summary Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the specified payload length without any limits. The payload length is read directly from the wire and trusted without validation. A bad actor can send a reserved frame with a payload length of up to...