CVE-2026-55192

In FreeRDP prior to 3.27.0, H.264 decoder backends return YUV planes sized from the bitstream without comparing decoded dimensions to the RDPGFX surface size. A malicious RDP server can supply a smaller AVC420/AVC444 frame, causing out-of-bounds reads in yuv420_context_decode/avc420_yuv_to_rgb pa...

CVE-2026-72466

A flaw was found in the Linux kernel's xprtrdma component. A remote attacker could exploit this vulnerability by sending a specially crafted, malformed reply. This could lead to a leak of the receive buffer and drain the Receive queue, potentially causing a Denial of Service DoS where the system...

CVE-2026-72455

A flaw was found in the AppArmor security module of the Linux kernel. A bug in the pathname function, related to handling aanull files, may cause an uninitialized pointer to be passed to aaauditfile. This can lead to a kernel page fault, resulting in a system crash and a Denial of Service DoS for...

CVE-2026-55648

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdpimagecopyfromicondata in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixelformat in 32-bit arithmetic. A malicious RDP server can send a RAIL TSICONINFO...

CVE-2026-72448

A flaw was found in the octeontx2-pf driver in the Linux kernel. When a network interface utilizing this driver is shut down or the device is removed, a memory leak occurs because the send-queue timestamp buffer is not properly deallocated. This continuous memory accumulation can lead to system...

CVE-2026-55191

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious R...

CVE-2026-53792

A flaw was found in rsync. A malicious receiver can exploit an out-of-bounds read vulnerability in the sender-side block matching logic. By sending a specially crafted checksum block with a length of zero, an attacker can trigger memory access before the start of an allocated buffer. This can lea...

CVE-2026-72394

A flaw was found in the Linux kernel's aspeed-g6-pwm-tach driver. This vulnerability arises when the system attempts to calculate fan rotations per minute RPM using a tachometer value of zero, which can occur due to hardware glitches or specific conditions. Without proper validation, this zero...

CVE-2026-74472

A flaw was found in the Linux kernel's ublk driver. This vulnerability arises from improper initialization of kernel-owned device information fields when a new ublk device is added. A local attacker could exploit this by providing malformed device information, which may lead to a kernel panic,...

CVE-2026-72351

A flaw was found in the Linux kernel's Generic UDP Encapsulation GUE implementation. A remote attacker could exploit a missing length validation for the remote checksum offload REMCSUM private option. By sending a specially crafted GUE packet, an attacker can cause the kernel to read beyond the...

GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering

A denial-of-service and resource exhaustion vulnerability exists within the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input...

CVE-2026-73541 Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposure, allowing concurrent sponsor-wallet drain

Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent sponsored payments, denying service to legitimate payers once it is empty. MPP.Methods.Tempo.FeePayerPolicy enforces its ceilings maxgas,...

CVE-2025-14603 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

EUVD-2025-210741

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

MINI-W36V-XMHV-RWCG

Bulletin has no description...

CVE-2026-75147

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer libavformat/rtpencav1.c. The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first...

CVE-2026-75145

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer libavformat/rtpencav1.c. The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU si...

CVE-2026-75143

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

CVE-2026-75142

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

CVE-2026-75142 FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...