EUVD-2026-63734

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds read...

EUVD-2026-63739

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read...

EUVD-2026-63711

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds read...

EUVD-2026-63702

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to disclose sensitive kernel memory due to an out-of-bounds read...

EUVD-2026-63637

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read...

CVE-2026-18716

IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 contain an out-of-bounds read exploitable by a remote authenticated attacker, enabling sensitive data exposure or denial of service. CVSS 7.9 (High). No patch or workaround details are provided in the documents; see IBM's support page for updates.

CVE-2026-17423

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds read...

CVE-2026-55894

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c shdisassemble function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode function-pointer table. An application using CSARCHSH with...

EUVD-2026-63669

Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c shdisassemble function computes an idx value from a raw 16-bit instruction without ensuring it is within the active mode-specific decode function-pointer table. An application using CSARCHSH with...

EUVD-2026-63654

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat marker at the beginning of a scanline in scanlinereadold and read q-1 before any prior pixel exists. A crafted Radiance...

CVE-2026-53583

libgit2 is a portable C implementation of the Git core methods provide...

CVE-2026-76641

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XMLExternalEntityParserCreate. A struct size mismatch between ELEMENTTYPE members causes storeAtts to read the attIndex...

CVE-2026-63383

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five bytes from evbufferpullup but iterates using the full logical buffer length. A fragmented evbuffer...

CVE-2026-74340

A flaw was found in the Linux kernel's wcn36xx Wi-Fi driver. The driver uses a firmware-controlled count to access a memory buffer without proper validation of the count's value. A malicious or malformed firmware response could provide an excessive count, leading to an out-of-bounds read from the...

CVE-2026-74336

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. An out-of-bounds read vulnerability exists when parsing the S1G Sub-1 GHz TIM Traffic Indication Map Partial Virtual Bitmap PVB element. Due to an incorrect boundary check, the system can read two bytes beyond the allocated memory f...

CVE-2026-63383 Libevent: decode_tag_internal() can lead to out-of-bounds read

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five bytes from evbufferpullup but iterates using the full logical buffer length. A fragmented evbuffer...

CVE-2026-63383

In libevent prior to 2.1.13 and 2.2.2-alpha, decode_tag_internal() in event_tagging.c requests at most five bytes via evbuffer_pullup but iterates over the full logical buffer length. A fragmented evbuffer holding a six-byte malformed tag can advance past the pullup window, causing an out-of-boun...

EUVD-2026-63502

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five bytes from evbufferpullup but iterates using the full logical buffer length. A fragmented evbuffer...

CVE-2026-74333

A flaw was found in the Linux kernel's ASoC AMD ACP SoundWire SDW legacy driver. The createsdwdailinks function incorrectly iterates over an array, causing it to read beyond its allocated memory boundary. This out-of-bounds read can lead to memory corruption, potentially impacting system stabilit...

CVE-2026-74332

A flaw was found in the Linux kernel's ASoC Advanced Linux Sound Architecture System on Chip AMD ACP SoundWire SDW SOF Sound Open Firmware driver. The createsdwdailinks function, responsible for iterating through DAI Digital Audio Interface links, does not properly bound its iteration. This...