libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow

A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

Important: Red Hat Security Advisory: libxml2 security update

An update for libxml2 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks

An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...

libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow

A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its...

libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation

A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...

firefox: Integer overflow in the Layout: Text and Fonts component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Layout: Text and Fonts component...

firefox: Integer overflow in the Graphics component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the Graphics component...

CLSA-2026-1792983235 Fix of 56 CVEs

CVE-2026-98706 - wifi: mac80211: drain PS delivery work during station teardown CVE-2026-98706 CVE-2026-98836 - ALSA: line6: reject oversized playback packets CVE-2026-98836 CVE-2026-98548 - sctp: discard the rest of the packet on a stale-cookie error CVE-2026-98548 CVE-2026-98614 - sctp: avoid...

CLSA-2026-1792980237 Fix of 276 CVEs

CVE-2022-49416 - wifi: mac80211: fix use-after-free in chanctx code CVE-2022-49416 CVE-2022-49685 - iio: trigger: sysfs: fix use-after-free on remove CVE-2022-49685 CVE-2021-47670 - can: peakusb: fix use after free bugs CVE-2021-47670 CVE-2026-98706 - wifi: mac80211: drain PS delivery work during...

CLSA-2026-1792979087 kernel: Fix of 118 CVEs

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count CVE-2026-64276 - media: av7110: prevent underflow in writetstodecoder CVE-2023-54284 - usb: usbtmc: check URB actuallength for interrupt-IN notifications CVE-2026-63904 - usb: usbfs: fix use-after-free of usbdevice in...

CLSA-2026-1792977831 kernel: Fix of 118 CVEs

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count CVE-2026-64276 - media: av7110: prevent underflow in writetstodecoder CVE-2023-54284 - usb: usbtmc: check URB actuallength for interrupt-IN notifications CVE-2026-63904 - usb: usbfs: fix use-after-free of usbdevice in...

CVE-2026-106676

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and...

PT-2026-125473

Name of the Vulnerable Software and Affected Versions FLTK versions prior to 1.4.6 Description An integer overflow occurs in the load bmp function. This issue allows an attacker to provide a specially crafted BMP or ICO file with large dimensions, leading to an undersized pixel buffer allocation...

EUVD-2026-110019

qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and...

PT-2026-123304

Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits. Bandit.Headers.parse integer/2 in...

Apple Security Advisory 10-26-2026-7

Apple Security Advisory 10-26-2026-7 - tvOS 27.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, buffer overflow, integer overflow, and information disclosure vulnerabilities...

PT-2026-125249

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption...

UBUNTU-CVE-2026-114645

A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side...

PT-2026-125261

An integer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected system termination...