2508 matches found
ANT-2026-B615AQ9E Ā· exim Ā· off-by-one
off-by-one medium CVE-2026-40685 Severity Claude high Ā· Security research firm high Ā· Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-B615AQ9E: Exim dewrap Off-By-One OOB Read ā Co...
EUVD-2026-60464
Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions DSOP values to ServerProxy::setOptions in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons...
ANT-2026-QA1CT79B Ā· Ghostscript Ā· heap-buffer-overflow
heap-buffer-overflow high Severity Claude high Ā· Security research firm high Ā· Maintainer - Discovered by Claude Mythos Preview SECURITY RESEARCH FIRM ANALYSIS Triage and disclosure were performed by Trail of Bits. The writeup below is the document the firm sent to the maintainer. Verdict: true...
ANT-2026-87DJGDRB Ā· wolfssl Ā· Heap-buffer-overflow
heap-buffer-overflow low CVE-2026-12340 GHSA-q349-x427-xg3w Severity Claude high Ā· Security research firm high Ā· Maintainer low Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-87DJGDRB: Heap-buffer-overflow in sha.c:733 When...
ANT-2026-MAPZGQDY Ā· jsoncons Ā· Heap-buffer-overflow
heap-buffer-overflow high Severity Claude high Ā· Security research firm high Ā· Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-MAPZGQDY: Heap-buffer-overflow in bigint.hpp:260 Duri...
EUVD-2026-60269
The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in oncmdsocknotifyev drivers/modem/vendorstandalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via netbuflinearize, which caps the copy at 39 bytes and returns outlen = 39. The two...
XML External Entity (XXE) Injection
Apache CXF is vulnerable to an XML External Entity XXE injection. The vulnerability is due to insufficient JAXP hardening of SAXParserFactory configurations, which allows an attacker to exploit external entity resolution to perform out-of-band OOB requests and potentially access sensitive resourc...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099729)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099729 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix OOB read in compatmtwfromuser Luxiao Xu says: The function...
Important: qemu
Issue Overview: In QEMU's VNC server implementation ui/vnc.c, the setpixelformat function does not properly validate the redmax, greenmax, and bluemax fields from a client's SetPixelFormat message. These fields are received as 16-bit values but are stored internally as uint8t. A malicious VNC...
CVE-2026-67868
A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to execute arbitrary code...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099731)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099731 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrmstatemtu Leo Lin reported OOB write issue in esp component:...
Nmap 7.99 - Extension Header Integer Underflow
Exploit Title: Nmap 7.99 - Extension Header Integer Underflow CVE: CVE-2026-58058 Date: 2026-06-29 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author GitHub: https://github.com/mbanyamer Author Blog : https://banyamersecurity.com/blog/ Vendor...
SUSE CVE-2026-74457
In the Linux kernel, the following vulnerability has been resolved: can: peakusb: add bounds check for USB channel index The channel control index ctrlidx is derived from rx-len which comes directly from a device USB payload. The mask 0x0f allows values 0-15, but the array size of usbif-dev is on...
SUSE CVE-2026-74470
In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloclen up with ALIGN before deriving the descriptor count: repmaxzones =...
Exploit for Out-of-bounds Write in Php
CVE-2026-17544 ā PHP bcmath OOB write ā universal memory-only...
CVE-2026-74499
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...
AZL-96240 CVE-2026-74488 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex11ndispatchamsdupkt splits an A-MSDU with ieee80211amsduto8023s and walks the resulting subframes. For each subframe it passes the subframe data pointe...
CVE-2026-74470
In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloclen up with ALIGN before deriving the descriptor count: repmaxzones =...
AZL-96270 CVE-2026-74470 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloclen up with ALIGN before deriving the descriptor count: repmaxzones =...
AZL-96701 CVE-2026-73193 affecting package perl-DBI for versions less than 1.652-1
DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with newSVstrlenstatement 7 + 16, budgeting seven output bytes per input byte for the longest ':p99999'...