CVE-2025-55640

A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

SUSE-SU-2026:4703-1 Security update for libsoup2

This update for libsoup2 fixes the following issues: - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

CVE-2026-105959

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

RLSA-2026:83384 Important: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion CVE-2026-102556 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly CVE-2026-102557 libsoup: libsoup:...

libsoup security update

An update is available for libsoup. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libsoup packages provide an HTTP client and server library for GNOME...

CVE-2026-105959 Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

CVE-2026-105959 Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

CVE-2026-105959

A flaw in spice-server allows an authenticated SPICE client to trigger a massive heap buffer overflow during a VM live migration. The root cause is an integer truncation where a size_t allocation size is truncated to int when calling the malloc callback during the GLZ encoder dictionary restore p...

EUVD-2026-102846

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

CVE-2026-105959

A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a sizet allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted maxencoders...

CVE-2026-27654-PoC

CVE-2026-27654 – nginx ngxhttpdavmodule DAV Alias Path Handling PoC This repository provides a proof‑of‑concept exploit for CVE‑2026‑27654 , a heap‑overflow vulnerability in the ngxhttpdavmodule of nginx. The bug arises from a size‑t underflow when handling MOVE/COPY requests with specially craft...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711:...

SUSE-SU-2026:4690-1 Security update for libsoup

This update for libsoup fixes the following issues: - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-15711:...

one-multiply-too-many-cve-2026-70638-llama-cpp-android-jni-integer-overflow

CVE-2026-70638 - llama.cpp LLaMA-Android JNI Integer Overflow Companion PoC for the Hunt-Benito article "One Multiply Too Many: CVE-2026-70638 — Integer Overflow in llama.cpp's Android JNI Heap Allocation" →...

CVE-2026-42533-POC

CVE-2026-42533 Pre-auth heap buffer overflow and heap information leak in nginx, caused by missing save/restore of PCRE capture state across the two passes of the script engine. A regex map variable evaluated between two capture references overwrites r-captures, so the LEN pass and the VALUE pass...

nginx-cve-2026-42945-poc

CVE-2026-42945 — NGINX Rewrite Module Heap Buffer Overflow → RCE RCE confirmed successful — via heap overflow + GDB process injection, execute arbitrary commands in NGINX / OpenResty worker processes. Quick Start One-click build NGINX image + execute RCE test ./run.sh nginx One-click build...

CVE-2026-111458 ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting

The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...

CVE-2026-111458 ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting

The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...

CVE-2026-111458

The ssldump tool contains a heap-based buffer overflow in the fanx_fingerprint function within ssl/sslxprint.c. The flaw stems from a calculation error where the heap buffer is allocated with 31 fixed characters instead of the 34 required to accommodate the format string used for FAN/1 X.509 cert...