CVE-2026-93159

A flaw was found in the atmel-sha204a cryptographic hardware random number generator HWRNG driver in the Linux kernel. When an Inter-Integrated Circuit I2C transfer fails, the driver does not properly clear a pointer to allocated work data. This oversight can lead to subsequent read attempts...

OPENSUSE-SU-2026:21927-1 Security update for apptainer

This update for apptainer fixes the following issues: Changes in apptainer: - Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0. CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 bsc1278666 - Fix a potential DoS via crash due to...

Denial-Of-Service (DoS)

Http4s is vulnerable to a denial-of-service DoS. The vulnerability is due to improper enforcement of HTTP/2 concurrent stream limits, which allows an unauthenticated attacker to create an unbounded number of streams and consume heap memory until exhaustion...

Denial-of-Service (DoS)

Http4s is vulnerable to a Denial-of-Service DoS. The vulnerability is due to HTTP/2 flow-control windows being replenished based on network-received bytes while DATA is stored in an unbounded channel, which allows an attacker to send HTTP/2 request bodies faster than the application consumes them...

SUSE SLED15 / SLES15 Security Update : emacs (SUSE-SU-2026:4083-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4083-1 advisory. - Arbitrary code execution when opening a specially crafted file bsc1275941. - CVE-2026-77219: integer overflo...

OPENSUSE-SU-2026:21886-1 Security update for mcphost

This update for mcphost fixes the following issues: - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches bsc1279274. - CVE-2026-84304: google.golang.org/grpc: heap memory...

OPENSUSE-SU-2026:21882-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276722. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on...

SUSE CVE-2026-93572

A flaw was found in Netty's RedisArrayAggregator component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis RESP array headers. This can cause the RedisArrayAggregator to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustio...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the aresdnsparse function. An attacker can cause excessive heap memory allocation and degrade or deny name resolution services by sending specially crafted DNS responses with...

AZL-104994 CVE-2026-55556 affecting package rsyslog 8.2308.0-7

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...

CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

OPENSUSE-SU-2026:21879-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272118. - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ss...

UBUNTU-CVE-2026-93452

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compressByteBuffer, ByteBuffer that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and...

CVE-2026-93018: Use of Uninitialized Resource

Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...

PT-2026-95395

Name of the Vulnerable Software and Affected Versions Imager for Perl versions prior to 1.036 Description Reading a paletted image with pixel indexes that exceed its colour map in the i gpix p and i glin p functions leads to the disclosure of uninitialised heap memory. The TGA reader stores pixel...

PT-2026-95356

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw exists in the RedisArrayAggregator component of Netty. A remote attacker can cause heap memory exhaustion and a Denial of Service DoS by sending specially crafted nested Redis RESP array...

CVE-2026-93451: Out-of-bounds Write

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompressArray methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned lengt...

CVE-2026-63419: Out-of-bounds Write

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel...

CVE-2026-93572: Allocation of Resources Without Limits or Throttling

A flaw was found in Netty's RedisArrayAggregator component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis RESP array headers. This can cause the RedisArrayAggregator to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustio...