29737 matches found
kernel: i40e: fix idx validation in config queues msg
A flaw was found in the Linux kernel in the Intel i40e network driver such that in the function i40evcconfigqueuesmsg, when iterating over vf-chidx, the idx value is not properly validated against the range of active/initialized traffic classes TCs. An attacker with local privileges could supply ...
PT-2026-5212
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0 Description Discourse is an open source discussion platform. Non-admin moderators can view...
CVE-2025-69182
creationtimestamp| type| source ---|---|--- 2026-01-27 23:30:22+00:00| seen| Telegram/TRIf-qFMud8bc2hSsixwYtPQsp3y1pwQn1vbtgHRyBZM...
CVE-2026-24881
CVE-2026-24881 affects GnuPG before 2.5.17. A crafted CMS (S/MIME) EnvelopedData message with an oversized wrapped session key can trigger a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This may lead to denial of service, and memory corruption could enable remote c...
EUVD-2026-4768
In GnuPG before 2.5.17, a crafted CMS S/MIME EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that...
CVE-2026-24881
In GnuPG before 2.5.17, a crafted CMS S/MIME EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that...
CVE-2026-24881
In GnuPG before 2.5.17, a crafted CMS S/MIME EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that...
CVE-2026-22258
CVE-2026-22258 affects Suricata (IDS/IPS/NSM). Before versions 8.0.3 and 7.0.14, crafted DCERPC traffic can trigger unbounded buffering, causing memory exhaustion and process termination. While initially observed over UDP, TCP and SMB are also considered vulnerable; however, DCERPC/TCP defaults l...
CVE-2025-66199 TLS 1.3 CompressedCertificate excessive memory allocation
Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and...
EUVD-2025-206398
Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and...
EUVD-2025-206379
Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData...
SUSE CVE-2025-68383
Improper Validation of Specified Index, Position, or Offset in Input CWE-1285 in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow CAPEC-100 and cause a denial of service panic/crash of the Filebeat process via either a malformed Syslog message...
SUSE CVE-2026-22862
go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8...
SUSE CVE-2026-22868
go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.16.8...
CVE-2025-15467
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS...
UBUNTU-CVE-2026-22796
Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS7 data where an ASN1TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS7 data. Impact summary: An application...
📄 MikroTik RouterOS 6.40.10 Denial of Service
This exploit targets a vulnerability in the MikroTik RouterOS SMB service, allowing remote attackers to crash the SMB process and render services unavailable. Specially crafted SMB packets trigger an abnormal condition, leading to a denial of service, requiring manual restart or reboot of the...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005198)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005198 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for nextbuffer in receiveencryptedstandard Add check for the return value ...
CVE-2026-24003
CVE-2026-24003 (EvseV2G) affects the EV charging software stack EVerest up to version 2025.12.1 . The issue is a bypass of the sequence/state verification, including authentication, allowing requests to transition to forbidden states and update the current context with illegitimate data. The inte...