PT-2026-79864

Memory Allocation with Excessive Size Value CWE-789 in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amou...

CVE-2026-62357 DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeofint64t overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the...

CVE-2026-62357

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeofint64t overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the...

AZL-96861 CVE-2026-75032 affecting package bluez for versions less than 5.63-7

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

DEBIAN-CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

EUVD-2026-60941

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-75032

BlueZ's AVRCP implementation lacks packet length validation in parse_media_element() and parse_media_folder(), causing out-of-bounds reads that crash bluetoothd (DoS) and may leak heap memory. Exploitation requires user pairing. Mitigation: disable AVRCP profile or restrict Bluetooth pairing to t...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

UBUNTU-CVE-2026-74969

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-75841 ArcadeDB before 26.8.1 Denial of Service via range()

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or...

EUVD-2026-60605

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or...

CVE-2026-75841

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102129)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102129 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in buildpolexpire buildexpire clears the trailing padding bytes of...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101974)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101974 advisory. In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated R...

CVE-2026-75841: Allocation of Resources Without Limits or Throttling

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or...

CVE-2026-62357: Integer Overflow or Wraparound

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeofint64t overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the...

PT-2026-77138

Name of the Vulnerable Software and Affected Versions BlueZ affected versions not specified Description Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range t...

CVE-2026-74238

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238

TIER IV Nebula through 1.2.0's Vlp32Decoder::unpack() reads past UDP buffer bounds when a short datagram is sent to the Velodyne port, which lacks sender-address restrictions, leaking heap memory into fabricated PointCloud2 messages consumed by Autoware nodes. No in-the-wild exploitation is docum...