PT-2026-62052

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si idx find. The attach-time validator si validate header is thorough about the header and layout magic, version, section offsets, total size, count and arena used but...

PT-2026-61828

Name of the Vulnerable Software and Affected Versions kronosnet versions prior to 1.35 Description An issue exists in the cryptographic configuration management where the framework fails to zero-out or wipe sensitive memory segments after executing changes. This results in raw encryption keys...

Oracle Linux 10 : rsync (ELSA-2026-19152)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19152 advisory. - Resolves: RHEL-174929 - TOCTOU symlink race condition CVE-2026-29518 - Resolves: RHEL-174949 - Memory disclosure via int overflow CVE-2026-43618 Tenable has...

EUVD-2026-43735

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path McIdas AREA files...

GHSA-62P4-GMF7-7G93 Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

Summary When Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image.MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImagingMapBuffer src/map.c. The per-row spacing stride ...

BIT-NGINX-GATEWAY-2026-60005 NGINX ngx_http_slice_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX...

BIT-NGINX-2026-60005 NGINX ngx_http_slice_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX...

webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory handling, leading to disclosure of process memory...

webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory handling, leading to disclosure of process memory...

CVE-2026-55639

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation...

CVE-2026-55639

CVE-2026-55639 affects xrdp up to version 0.10.6, where the parser for Client Security Data in GCC Conference Create Request within the Client MCS Connect Initial PDU lacks proper length validation during initial capability/security negotiation. A remote, unauthenticated attacker could send a cra...

CVE-2026-55639

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation...

CVE-2026-55639 xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY)

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation...

CVE-2026-55639 xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY)

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation...

CVE-2026-55639

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation...

EUVD-2026-46042

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation...

CVE-2026-55639

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation...

CVE-2026-41521

xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer siz...

CVE-2026-53402

A flaw was found in the Linux kernel's framebuffer console fbcon component. When the fbcondosetfont function fails, the system's error handling does not correctly restore the font state, leading to a desynchronized terminal. A local user can exploit this by providing character indices that cause ...

CVE-2026-64127

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A paired Bluetooth device could exploit this vulnerability by sending a specially crafted reconfiguration request. This would cause the kernel to inadvertently disclose a portion of its...