SUSE CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

SUSE CVE-2026-81886

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loo...

CVE-2026-19888

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...

CVE-2026-19888

A NULL pointer dereference in PgBouncer (through version 1.25.2 ) allows an unauthenticated remote attacker to crash the process. The vulnerability exists because the SCRAM client-final-message parser fails to validate a mandatory attribute, allowing a malformed message to leave a required value ...

EUVD-2026-85365

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...

CVE-2026-77396

A flaw was found in PJSIP. A heap buffer overflow vulnerability exists in the AVI Audio Video Interleave parser. A remote attacker could exploit this by providing a specially crafted AVI file. When an application processes this file, it can lead to memory corruption, potentially allowing the...

php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser

A flaw was found in PHP. The MySQL Native Driver mysqlnd wire protocol parser fails to verify that an incoming packet contains enough bytes before reading its fields. A malicious or compromised database server can send a truncated packet, causing the client application to read past the buffer...

php: PHP: Archive entry injection via integer overflow in TAR parser

A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causin...

php: php: Denial of Service via unbounded recursion in SOAP parser

A flaw was found in PHP. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted request to an affected Simple Object Access Protocol SOAP server endpoint. Due to a lack of recursion depth limits when parsing deeply nested XML elements, processing suc...

CVE-2026-81882

A flaw was found in radare2. The binary property-list Unicode parser did not properly terminate strings, leading to an underallocation of memory. A local attacker could exploit this by providing specially crafted binary property-list data and executing specific commands pFB or pFBj. This could...

CVE-2026-81884

A flaw was found in radare2. A remote attacker could exploit a heap out-of-bounds read vulnerability in the Mach-O LCDATAINCODE parser. This occurs when opening a specially crafted Mach-O file with the non-default bin.verbose option enabled, leading to a read beyond the allocated buffer. This...

CVE-2026-81885

A flaw was found in radare2, a reverse engineering framework. By opening a specially crafted NE executable file, an attacker could trigger an an infinite loop within the application's relocation parser. This continuous processing would consume excessive CPU and memory, leading to a denial of...

CVE-2026-81878

A flaw was found in radare2, a UNIX-like reverse engineering framework. The CPython bytecode .pyc marshal parser is vulnerable to an integer overflow. By opening or inspecting a specially crafted .pyc file, an attacker can trigger a heap out-of-bounds write. This can lead to heap memory corruptio...

CVE-2026-81879

A flaw was found in radare2, a UNIX-like reverse engineering framework. The ELF parser incorrectly handles program-header array allocation and iteration. When processing a specially crafted ELF file, the parser may iterate beyond the allocated program-header array due to a mismatch between the...

CVE-2026-81881

A flaw was found in radare2, a reverse engineering framework. Its Mach-O Swift metadata parser contains a heap out-of-bounds read vulnerability. By processing a specially crafted Mach-O file, a local user could trigger an error that causes the application to terminate. This leads to a denial of...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview org.apache.sling:org.apache.sling.xss is a package for providing XSS protection based on the OWASP AntiSamy and OWASP Java Encoder libraries. Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' due to...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in postcss-selector-parser (CVE-2026-9358)

Summary A Regular Expression Denial of Service ReDoS vulnerability in the postcss-selector-parser library CVE-2026-9358 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 7.1.4. Vulnerability Details CVEID:CVE-2026-9358 DESCRIPTION: A vulnerabilit...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-24486, CVE-2026-40347, CVE-2026-42561)

Summary Multiple vulnerabilities including path traversal and Denial of Service in the python-multipart streaming parser library CVE-2026-24486, CVE-2026-40347, CVE-2026-42561 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.0.32. Vulnerabili...

CVE-2026-63449

A flaw was found in Suricata, a network Intrusion Detection System IDS and Intrusion Prevention System IPS. The Session Initiation Protocol SIP parser incorrectly handles large SIP message bodies. When a SIP message body exceeds 65,536 bytes, the parser truncates its length, preventing the full...

CVE-2026-63450

A flaw was found in Suricata, a network Intrusion Detection System IDS and Intrusion Prevention System IPS. A remote attacker can exploit a vulnerability in the FTP parser where sending a RETR or STOR command before PORT or PASV negotiation is incorrectly treated as a fatal error. This error...