kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

CVE-2026-19082

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

CVE-2026-19082

The Perl Imager module (versions 0.45_02 before 1.034 ) is vulnerable to a heap over-read in the copy_string_tags() function. The root cause is that a zero-count ASCII EXIF entry sets entry->size to 0, resulting in a length of -1; this causes i_tags_add() to invoke strlen(), which scans past t...

Broken Authentication & Session Management org.bouncycastle:bcpkix-lts8on Dependency in Confluence Data Center

This High severity Broken Authentication & Session Management vulnerability was introduced in versions 9.2.8, 9.5.4, 10.0.3, 10.1.0, and 10.2.0 of Confluence Data Center. This Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

OSEC-2026-15 EC public key out of bounds read

The internal Point.ofoctets function is missing a length check for compressed points, and thus is raising an exception when a short buffer is provided. This affects all NIST curves P-256, P-384, P-521 and both Dsa.pubofoctets and Dh.keyexchange functions. Fix The fix is to check the length of the...

Security Bulletin: Jackson-Core Async JSON Parser Bypasses Number Length Constraint Leading to Denial of Service

Summary Jackson-core's non-blocking async JSON parser fails to enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters, unlike the synchronous parser which correctly applies the limit. An attacker can submit JSON containing arbitrarily long numbers through...

AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

PortSwigger says HTTP Terminator, an artificial intelligence AI-assisted research system built by James Kettle , generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate desync vectors. PortSwigger said a separate human-guided discovery cascade also exposed a...

CVE-2026-18938 P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to...

CVE-2026-18938

CVE-2026-18938 affects p11-kit: an integer overflow in RPC attribute-array length calculation on 32‑bit systems can under‑allocate nested attribute storage, causing a heap out‑of‑bounds write and DoS by crashing the p11-kit RPC parser. Affected component: p11-kit RPC decoding of nested attributes...

wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

...

Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass

...

net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

...

OESA-2026-3242 glib2 security update

GLib is a bundle of three formerly five low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fixes: A denial-of-service and resource...

EUVD-2026-54226

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...

EUVD-2026-54221

Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...

EUVD-2026-54283

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

Vulnerability of the websocket_read_wstream() function in the libfreerdp/core/gateway/websocket.c file of the RDP client FreeRDP, which allows a hacker to disclose sensitive information or cause service failure.

The vulnerability of the websocketreadwstream function in the libfreerdp/core/gateway/websocket.c file of the RDP client FreeRDP is related to improper handling of invalid length parameters. Exploiting this vulnerability could allow an attacker to disclose sensitive information or cause service...

Node.js Module axios 1.13.0 < 1.18.0 maxBodyLength Bypass (CVE-2026-67318)

The version of the axios Node.js module installed on the remote host is 1.13.0 prior to 1.18.0. It is, therefore, affected by a vulnerability: - axios fails to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2...

Node.js Module axios 1.7.0 < 1.18.0 maxBodyLength Bypass (CVE-2026-67317)

The version of the axios Node.js module installed on the remote host is 1.7.0 prior to 1.18.0. It is, therefore, affected by a vulnerability: - axios fails to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers ca...

SUSE CVE-2026-68742

A flaw was found in SSSD. The sssnssprotocolparseaddr function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and...