39540 matches found
EUVD-2026-59692
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...
CVE-2026-74499 ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...
CVE-2026-74457 can: peak_usb: add bounds check for USB channel index
In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...
CVE-2026-74457
The CVE-2026-74457 entry describes a Linux kernel issue in the can: peak_usb driver where ctrl_idx is derived from rx->len (USB payload). The mask 0x0f allows 0–15, but usb_if->dev[] is only size 2, causing heap out-of-bounds read and kernel panic in IRQ context. The fix adds bounds checks ...
EUVD-2026-59645
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthorfwloadsectionentry, the data size to copy is calculated without validating it against the allocated sectionsize: section-data.size = hdr.data.end - hdr.data.star...
EUVD-2026-59745
DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with atoisrc an...
CVE-2026-73194
Perl DBI (versions before 1.652) has an integer-overflow flaw in its preparse function: the :N branch parses a placeholder number via atoi with no range check. A value like :2147483648 wraps to negative, bypassing the 99,999 limit added in 1.650, causing subsequent ? expansions to write 14 bytes ...
CVE-2026-73194
DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with atoisrc an...
CVE-2026-73193 DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse
DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with newSVstrlenstatement 7 + 16, budgeting seven output bytes per input byte for the longest ':p99999'...
CVE-2026-73193 DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse
DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with newSVstrlenstatement 7 + 16, budgeting seven output bytes per input byte for the longest ':p99999'...
CVE-2026-73193
In DBI's preparse function, buffer size is computed as strlen(statement) * 7 + 16 in a 32-bit STRLEN, wrapping at ~613 MB input to reserve only 19 bytes; a raw pointer copy then writes the entire input past the allocation. Affected: DBI
CVE-2026-73193 DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse
DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with newSVstrlenstatement 7 + 16, budgeting seven output bytes per input byte for the longest ':p99999'...
CVE-2026-73193
DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with newSVstrlenstatement 7 + 16, budgeting seven output bytes per input byte for the longest ':p99999'...
MINI-7W3Q-W4XJ-P8XG
Bulletin has no description...
MINI-3V5J-PMP3-J7JQ
Bulletin has no description...
MINI-G32J-RP5Q-W8VX
Bulletin has no description...
MINI-R752-4RP6-V4C4
Bulletin has no description...
MINI-WR45-38WX-2W9Q
Bulletin has no description...