CVE-2026-106064

A heap-based buffer overflow exists in the GIMP GIF export plug-in . The vulnerability is rooted in an integer overflow occurring during the calculation of the pixel buffer size when processing images with very large dimensions. Specifically, the plug-in allocates a buffer based on a wrapped 32-b...

CVE-2026-106064 Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit overflow when computing the pixel buffer size. The plug-in allocates a buffer based on the wrapped value while GEGL writes using the true image extent, rooted ...

CVE-2026-106064

A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit overflow when computing the pixel buffer size. The plug-in allocates a buffer based on the wrapped value while GEGL writes using the true image extent, rooted ...

USN-8894-1: poppler vulnerabilities

It was discovered that Poppler had an integer overflow in FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-102620 It was discovered that Poppler had an integer overflow in...

nginx: Fix of 5 CVEs

CVE-2026-27651: properly clear s-passwd in mail auth http requests to fix a null pointer dereference on CRAM-MD5/APOP retry - CVE-2026-27654: validate the Destination length for Dav COPY and MOVE to prevent an integer underflow and heap buffer overwrite when alias is used - CVE-2026-27654: also...

CVE-2026-105839

A flaw was found in libmikmod. An integer overflow in the Oktalyzer music module loader can result in a heap-based buffer overflow when parsing manipulated track counts. By tricking a user or application into processing a specially crafted audio file, an attacker could achieve arbitrary code...

CVE-2026-105837

A flaw was found in libmikmod. A local attacker can cause arbitrary code execution or a Denial of Service DoS by enticing a user to open a specially crafted DSM audio module. An integer overflow during track count processing in the DSM file loader leads to a heap-based buffer overflow that corrup...

CVE-2013-2028_Checker

CVE-2013-2028 - Débordement de tampon dans la pile lié à l'encodage par fragments dans Nginx HTTP Server 1.3.9-1.4.0 Description La fonction ngxhttpparsechunked dans http/ngxhttpparse.c dans nginx 1.3.9 à 1.4.0 permet à des attaquants distants de provoquer un déni de service plantage et d'exécute...

CVE-2026-19186

An integer underflow vulnerability exists in the ieee802154_decipher_data_frame() function within subsys/net/l2/ieee802154/ieee802154_frame.c . The software fails to verify if a received frame is long enough before subtracting header and authentication tag lengths from the total length. Because t...

CVE-2026-19186 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

CVE-2026-19186 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

CVE-2026-19186 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

bouncer-overflow

PgBouncer Crash PoC Ce dépôt contient une preuve de concept locale d'un crash de PgBouncer provoqué par un dépassement d'entier dans les versions vulnérables de PgBouncer. Le dispositif Docker inclus construit PgBouncer 1.25.1, démarre un backend PostgreSQL, active l'authentification SCRAM-SHA-25...

kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

A flaw was found in the Linux kernel's RDMA/rxe component. The rxercv function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forg...

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issue: CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283672. Changes for google-osconfig-agent: Update to version...

SUSE-SU-2026:4554-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283672. Changes for google-osconfig-agent: Update to version...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were found in openSSL used by IBM OS Image for Red Hat Enterprise Linux Systems shipped with IBM Cloud Pak System. Vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-34181 DESCRIPTION: Issue Summary: The...

kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks RPL segment routing header SRH decompression function, ipv6rplsrhdecompress. An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate...

kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

A flaw was found in the Linux kernel's RDMA/rxe component. The rxercv function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forg...

CVE-2026-59346

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 fixed i...