EUVD-2026-76335

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...

CVE-2026-81012

CVE-2026-81012 is an off-by-one write in the Linux kernel's platform/x86: hp-bioscfg driver. The function hp_get_string_from_buffer() uses a strict greater-than (>) comparison when clamping the converted string length against the destination buffer size. When the converted length is exactly eq...

CVE-2026-81012 platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hpgetstringfrombuffer hpgetstringfrombuffer clamps the converted string length against the destination buffer size with "size dstsize", so when the converted length is exactly equ...

OPENSUSE-SU-2026:21833-1 Security update for jq

This update for jq fixes the following issues: - CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure bsc1265071. - CVE-2026-47770: stack overflow in deep structural equality bsc1269221...

PT-2026-90291

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description A buffer overflow exists in the dm raid1 component within the build constructor string function. The issue occurs because the system fails to reserve space for the NUL-terminator after the...

PT-2026-90142

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An off-by-one write exists in the hp get string from buffer function within the platform/x86: hp-bioscfg component. The function clamps the converted string length against the destination...

GHSA-65FR-J4P9-VC33 mongodb: Reject "." and NUL bytes in database and collection names

Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. Patches Fixed in PHP library 1.21.4 and 2.4.1. Workarounds Validate database and collection names prior to passing into APIs...

mongodb: Reject "." and NUL bytes in database and collection names

Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified. Patches Fixed in PHP library 1.21.4 and 2.4.1. Workarounds Validate database and collection names prior to passing into APIs...

CVE-2026-85454 MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handling

MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram that writes a NUL terminator one byte past the serial telegram stack buffer. Attackers controlling the serial line can send a full-length telegram to trigger the off-by-one write, corrupting the...

libevent: Libevent: HTTP header handling bugs create risk of access control bypass.

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

CVE-2026-84966 BSON element injection via NUL-embedded document keys in builder append

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intende...

CVE-2026-84966

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application passes an extremely large, non-terminated field name to the builder, the library may read memory outside the intended ...

BSON element injection via NUL-embedded document keys in builder append

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intende...

CVE-2026-63385

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

CVE-2026-42395

A flaw was found in Dovecot. A remote attacker, if able to send forwarding information from a host configured as a trusted proxy, could send a NUL byte that crashes the login process. This termination of the login process can lead to a denial of service for user logins. Mitigation To mitigate thi...

CVE-2026-14368

The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...

CVE-2026-14368 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...

CVE-2026-14368 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...

CVE-2026-14368 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...

PT-2026-83953

The LwM2M JSON content formatter's get string in subsys/net/lib/lwm2m/lwm2m rw json.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if string length buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...