CVE-2026-13361

IBM Informix oninit sqsgkprepare RCE via unchecked SQL Interface length field...

EUVD-2026-57533

IBM Informix oninit sqsgkprepare RCE via unchecked SQL Interface length field...

CVE-2026-13361

IBM Informix oninit sqsgkprepare RCE via unchecked SQL Interface length field...

PT-2026-71267

Name of the Vulnerable Software and Affected Versions IBM Informix affected versions not specified Description Remote code execution is possible in the sq sgkprepare function due to an unchecked length field within the SQL Interface. Recommendations At the moment, there is no information about a...

CVE-2026-15567

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

EUVD-2026-55157

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. Thi...

Memory Allocation with Excessive Size Value

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the BcKeyStoreSpi.engineLoad method, which sizes buffers for the certificate chain array, encoded...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the processRecord method of DTLSReliableHandshake, where the DTLSReassembler constructor allocates a bytelength buffer directly from the 24-bit handshake length field without checking it...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the processRecord method of DTLSReliableHandshake, where the DTLSReassembler constructor allocates a bytelength buffer directly from the 24-bit handshake length field without checking it...

CVE-2026-66360

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This...

CVE-2026-66360

The CVE-2026-66360 entry describes a flaw in the ISO Presentation layer where a missing length check during normal-mode negotiation allows a zero-length field in encoded presentation data to trigger a bounded heap read before MMS session establishment. A crafted TCP/102 connection can trigger thi...

CVE-2026-64531 net: openvswitch: reject oversized nested action attrs

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving actions length check" allowed the...

CVE-2026-64531

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving actions length check" allowed the...

PT-2026-64726

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check for header Add a length check for the rndis header in rndis rm hdr, to ensure that MessageType, MessageLength, DataOffset, and DataLength fields are present before they are accessed...

SUSE CVE-2026-63941

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which does not trap. KVM handles both in different way: - on ZCREL2 trap,...

GHSA-JJJ6-MW9F-P565 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Summary PdfParser.PdfStream.decode in Pillow's PdfParser.py calls zlib.decompress with the bufsize parameter set to the value of the PDF stream's Length field, without any upper bound on the actual decompressed output size. Python's zlib.decompress bufsize argument is an initial output buffer hin...

CVE-2026-54538

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sendin...

CVE-2026-63941

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which does not trap. KVM handles both in different way: - on ZCREL2 trap,...

CVE-2026-64102

CVE-2026-64102 affects the Linux kernel RDMA/siw path. A malicious siw peer can send an iWARP FPDU whose MPA length (mpa_len) is smaller than the fixed DDP/RDMAP header for the announced opcode, triggering an underflow in fpdu_part_rem during siw_tcp_rx_data and leading to a potential out-of-boun...

EUVD-2026-45714

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCREL2 provided by a guest hypervisor ZCREL2 can be updated by a VHE guest hypervisor either using ZCREL2 which traps or ZCREL1 which does not trap. KVM handles both in different way: - on ZCREL2 trap,...