CVE-2026-80709

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

PT-2026-86712

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

Linux Distros Unpatched Vulnerability : CVE-2026-80709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for...

CVE-2026-80709: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

CVE-2026-82328: Out-of-bounds Read

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs palette count parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue c...

CVE-2026-71402 wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length

An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. nicaptureinspectudpheader in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client wickedd-dhcp4 rea...

CVE-2026-71402

CVE-2026-71402 is an out-of-bounds read in the DHCPv4 packet capture code of wicked (the openSUSE/SUSE network daemon), specifically in ni_capture_inspect_udp_header() in src/capture.c. The function reports the IP total length as the payload length instead of the remaining UDP payload length, cau...

CVE-2026-59274

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration...

CVE-2026-59274: Improper Handling of Highly Compressed Data (Data Amplification)

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration...

CVE-2026-71402: Out-of-bounds Read

An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. nicaptureinspectudpheader in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP option walker in the DHCPv4 client wickedd-dhcp4 rea...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098981)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098981 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in buildpolexpire buildexpire clears the trailing padding bytes of...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-104814)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104814 advisory. FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allo...

AZL-97631 CVE-2026-59981 affecting package OpenEXR 2.3.0-6

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::ro...

CVE-2026-77219

A flaw was found in GNU Emacs. An integer overflow in the PBM/PPM/PGM image loader allows a remote attacker to leak heap memory contents. By supplying a specially crafted image with large dimensions and an elevated maximum color index, the image loader's internal calculations can wrap to a negati...

Apache Struts 2 vulnerable to resource exhaustion

Overview Apache Struts 2 provided by The Apache Software Foundation contains the following vulnerability: Allocation of resources without limits or throttling CWE-770 - CVE-2026-73635 KuniyoshiNoguchi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

SUSE CVE-2026-77219

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signe...

Denial Of Service

Jackson Core is vulnerable to Denial Of Service. The vulnerability is due to NonBlockingUtf8JsonParserBase failing to enforce maxNumberLength when a non-blocking JSON number remains in MINORNUMBERINTEGERDIGITS across input chunks, allowing an attacker to exhaust JVM heap memory through repeated o...

CVE-2026-56135

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function buildinheritedid in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-77219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafte...

Fedora 44 : bluez (2026-1bbec06c4d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1bbec06c4d advisory. An out-of-bounds read flaw was found in BlueZ in the AVRCP profile implementation. The vulnerability exists in the parsemediaelement and parsemediafolder...