CVE-2026-64217

The CVE concerns the Linux kernel’s netfs code: a fix in netfs_extract_user_iter() addresses an overrun in iov_iter_extract_pages() where pages[] could be overfilled, causing the final iterator to include pages that should not be present. If an overfill occurred, memory corruption may have alread...

EUVD-2026-48625

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfsextractuseriter Fix netfsextractuseriter so that if ioviterextractpages overfills pages, then those pages don't get included in the iterator constructed at the end of the function. If there was an...

Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun

Netgear RAX43 version 1.0.3.96 contains a command injection and authentication bypass vulnerability. The readycloudcontrol.cgi CGI application is vulnerable to command injection in the name parameter. Additionally, the URL parsing functionality in the cgi-bin endpoint of the router containers a...

PT-2026-64332

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfs extract user iter Fix netfs extract user iter so that if iov iter extract pages overfills pages, then those pages don't get included in the iterator constructed at the end of the function. If the...

EUVD-2026-46447

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctpi2cgpiotarget.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctpi2cgpiotargetwritereceived without validating the order or the receive buffer. In the affected versions the MCTPI2CGPIORXMSGADDR data...

CVE-2026-63887

A flaw was found in the Linux kernel's iSCSI Internet Small Computer System Interface target functionality. This vulnerability, a heap overrun, occurs because the iscsiencodetextoutput function does not properly check buffer capacity when processing login requests. A remote attacker could exploit...

PT-2026-62125

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctp i2c gpio target.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctp i2c gpio target write received without validating the order or the receive buffer. In the affected versions the MCTP I2C GPIO RX MSG...

The vulnerability of the linker.exe executable of Rockwell Automation Arena’s discrete event simulation and automation software allows a attacker to execute arbitrary code.

The vulnerability of the linker.exe executable of Rockwell Automation Arena’s event simulation and automation software is related to the execution of operations beyond the buffer boundaries in memory, resulting from incorrect validation of input data. Exploiting this vulnerability allows an...

The vulnerability of the Active Directory Federation Services (ADFS) allows a perpetrator to trigger a service failure.

The vulnerability of Active Directory Federation Services AD FS is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

CVE-2026-63958

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: validate connector number in ucsiconnectorchange The connector number in a UCSI CCI notification is a 7-bit field supplied by the PPM. ucsiconnectorchange uses it to index the ucsi-connector array without checki...

CVE-2026-64051 accel/qaic: Add overflow check to remap_pfn_range during mmap

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

PT-2026-61204

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap overrun occurs in the iscsi encode text output function when concatenating records into the rsp buf buffer. The function uses sprintf to append key-value pairs without verifying t...

CVE-2026-44452 h2o is vulnerable to heap overrun

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it ...

CVE-2026-44452 h2o is vulnerable to heap overrun

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it ...

CVE-2026-44452

CVE-2026-44452 affects the h2o HTTP server (supports HTTP/1.x, 2, 3). Affected behavior occurs when a TLS/QUIC ClientHello contains a zero-length SNI extension; h2o can attempt to copy the hostname assuming NULL-termination, causing a heap/segmentation fault that may enable a denial-of-service. T...

CVE-2026-44436 Quicly is vulnerable to connection state corruption

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service attack through connection state corruption. In QUIC Invariants, the maximum length of a Connection ID is 255 bytes, while QUIC...

EUVD-2026-44840

A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpuphysicalmemorymap returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in...

Security update for glibc

This update for glibc fixes the following issues CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write bsc1263656. CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure bsc1263658. Patch...

kernel: crypto: ccp - copy IV using skcipher ivsize

A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...

USN-8540-1: OpenVPN vulnerabilities

It was discovered that OpenVPN had a 1-byte buffer overrun when handling NTLMv2 proxy responses. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. CVE-2026-11771 It was discovered that...