CVE-2026-110758 Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...

CVE-2026-110758

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...

CVE-2026-110758 Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...

CVE-2026-110758

The Text::CSV_XS Perl module (versions before 1.65 ) is vulnerable to a buffer under-read when parsing unquoted fields containing only blank spaces while allow_whitespace is enabled. The strip_trail_whitespace function fails to stop at the start of the field, potentially reading the byte before t...

CVE-2021-3156

CVE-2021-3156 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via sudoedit -s and a command-line argument that ends with a single backslash character. Credit to: Advisory by Baron Samedit of Qualys How to...

CVE-2025-55640

A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

SUSE-SU-2026:4703-1 Security update for libsoup2

This update for libsoup2 fixes the following issues: - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

CVE-2026-105959

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

RLSA-2026:83384 Important: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion CVE-2026-102556 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly CVE-2026-102557 libsoup: libsoup:...

libsoup security update

An update is available for libsoup. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libsoup packages provide an HTTP client and server library for GNOME...

OESA-2026-4383 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2026-4381 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2026-4382 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

OESA-2026-4380 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

CVE-2026-105959 Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

CVE-2026-105959

A flaw in spice-server allows an authenticated SPICE client to trigger a massive heap buffer overflow during a VM live migration. The root cause is an integer truncation where a size_t allocation size is truncated to int when calling the malloc callback during the GLZ encoder dictionary restore p...

EUVD-2026-102846

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

CVE-2026-105959 Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

CVE-2026-105959

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...