Integer Truncation

io.netty, netty-codec-stomp is vulnerable to an integer truncation. The vulnerability is due to improper handling of a content-length header exceeding the maximum integer value, which allows a remote attacker to send a specially crafted STOMP frame, triggering an infinite decoding loop and...

CLSA-2026-1792566014 jasper: Fix of CVE-2022-2963

CVE-2022-2963: fix memory leak in cmdoptsparse — add cmdoptsdestroy before badusage in the default case and the missing-output-format check...

CLSA-2026-1783355084 kernel: Fix of 60 CVEs

net/sched: fix pedit partial COW leading to page cache corruption CVE-2026-46331 - unshare: fix unsharefs handling CVE-2026-43472 - net/sched: schhfsc: fix divide-by-zero in rtscmin CVE-2026-31423 - net/sched: clsflow: fix NULL pointer dereference on shared blocks CVE-2026-31422 - net/sched:...

Security Bulletin: Multiple vulnerabilities affect IBM Guardium External S-TAP

Summary Multiple vulnerabilities have been addressed in IBM Guardium External S-TAP Vulnerability Details CVEID:CVE-2026-4111 DESCRIPTION: A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archivereaddata processing path. When a...

CLSA-2026-1779987841 kernel: Fix of 110 CVEs

smb: client: reject userspace cifs.spnego descriptions - mlxsw: spectrumacltcam: Fix possible use-after-free during rehash CVE-2024-35854 - cifs: Fix memory leak when build ntlmssp negotiate blob failed CVE-2022-50372 - scsi: lpfc: Check kzalloc in lpfcsli4cgnparamsread CVE-2023-53038 -...

CLSA-2026-1792547230 ImageMagick: Fix of 3 CVEs

CVE-2026-109259: fix uninitialized memory read in the TGA decoder - CVE-2026-106578: fix invalid memory free in the MVG decoder on undersized primitive extent...

DEBIAN-CVE-2026-92823

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause...

dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

CVE-2026-92823

A flaw exists in libmodulemd affecting builds with rpmio support enabled. The vulnerability occurs because a custom read handler fails to enforce a cumulative decompressed-size limit when parsing compressed modulemd YAML files. This allows an attacker to provide a highly compressible file, trigge...

CVE-2026-92823 Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via MossAudioProcessingInfo.gethfprocessor in MOSS-Audio model serving, which caches a...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unvalidated per-request mmprocessorkwargs forwarded through the multimodal processing...

CLSA-2026-1792547456 ImageMagick: Fix of 3 CVEs

CVE-2026-109259: fix uninitialized memory read in the TGA decoder - CVE-2026-106578: fix invalid memory free in the MVG decoder on undersized primitive extent...

CVE-2026-98696

A flaw was found in the Linux kernel's USB serial subsystem. A local user with administrative privileges could exploit this flaw to cause a Denial of Service DoS or memory corruption. During the unloading of a USB serial driver module, drivers are deregistered in an incorrect sequence, allowing...

CVE-2026-98639

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for the RISC-V architecture. During nested virtualization acceleration, control flags are written before the target page parameters are properly committed to shared memory. Consequently, the supervisor interface or...

CVE-2026-98840

A flaw was found in the Linux kernel's virtual console screen driver. A race condition between virtual console write operations and console deallocation can cause the kernel to access previously freed memory, resulting in a use-after-free vulnerability. A local user could exploit this flaw to cau...

CVE-2026-98830

A flaw was found in the Linux kernel's Silicon Labs WFx Wi-Fi driver. The driver fails to validate the length of firmware responses during Management Information Base MIB queries before copying the data into memory buffers. A compromised or malicious wireless device could supply an oversized...

CVE-2026-98800

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When a BPF program attached to a trampoline is detached, the kernel may release the program's memory prematurely before preempted tasks have safely completed execution. A local user can exploit this race condition to...

CVE-2026-114103

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...

CVE-2026-114052

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mmprocessorkwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized melconfig values to...