30470 matches found
CVE-2026-18497
A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font files. The vulnerability exists in the stbttGetGlyphShapeTT function within the nothings stbtruetype.h library when parsing malformed TTF TrueType Font file...
Security update for python310
This update for python310 fixes the following issues: Security issues fixed: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-3276: quadratic complexity in unicodedata.normalize can lead t...
Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issue: CVE-2026-52718: byte count instead of a bit count in gstav1parserparsetilelistobu can cause parser desynchronization and an application crash bsc1268394. Patch Instructions: To install this SUSE update use the SUSE recommended...
SUSE-SU-2026:3527-1 Security update for gstreamer-plugins-bad
This update for gstreamer-plugins-bad fixes the following issue: - CVE-2026-52718: byte count instead of a bit count in gstav1parserparsetilelistobu can cause parser desynchronization and an application crash bsc1268394...
JLSEC-2026-1188 FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow...
FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...
Security Bulletin: Jackson-Core Async JSON Parser Bypasses Number Length Constraint Leading to Denial of Service
Summary Jackson-core's non-blocking async JSON parser fails to enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters, unlike the synchronous parser which correctly applies the limit. An attacker can submit JSON containing arbitrarily long numbers through...
Security Bulletin: Eclipse Parsson JSON Parser Denial of Service via Unbounded Input
Summary Eclipse Parsson versions before 1.1.8 are vulnerable to uncontrolled resource consumption CWE-400, CVSS 7.5, High. The JSON parser imposed no default limit on the number of characters consumed per document, allowing an attacker to supply a crafted oversized JSON payload — including large...
AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
PortSwigger says HTTP Terminator, an artificial intelligence AI-assisted research system built by James Kettle , generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate desync vectors. PortSwigger said a separate human-guided discovery cascade also exposed a...
OESA-2026-3307 bison security update
Bison is a general-purpose parser generator that converts an annotated context-free grammar into a deterministic LR or generalized LR GLR parser employing LALR1 parser tables. As an experimental feature, Bison can also generate IELR1 or canonical LR1 parser tables. Once you are proficient with...
Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (July 2026 - Part 2 of 2)
Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-33814 DESCRIPTION: When processing HTTP/2 SETTINGS frames, transport wi...
EUVD-2026-54160
FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...
EUVD-2026-54221
Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...
CVE-2026-20338: Double Free
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this...
CVE-2026-20346: Out-of-bounds Read
A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...
aiohttp < 3.14.3 Out-of-bounds Read DoS
The version of aiohttp installed on the remote host is prior to 3.14.3. It is, therefore, affected by a denial of service vulnerability: - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response pars...
Linux Distros Unpatched Vulnerability : CVE-2026-70628
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c...
PT-2026-69074
Name of the Vulnerable Software and Affected Versions ClamAV affected versions not specified Description A flaw in the PDF file format parser allows an unauthenticated remote attacker to cause a Denial of Service DoS or other impacts via memory corruption. The issue stems from improper boundary...
CVE-2026-20337: Buffer Copy without Checking Size of Input
A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition...
PT-2026-69075
Name of the Vulnerable Software and Affected Versions ClamAV affected versions not specified Description An issue exists in the Mach-O file format parser where improper boundary checks for content during scanning can lead to an out-of-bounds buffer read. A remote, unauthenticated attacker can...
CVE-2026-20347: Out-of-bounds Read
A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-...