libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption.

...

Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.

...

PT-2025-40430

Name of the Vulnerable Software and Affected Versions Stalwart versions 0.13.3 and below Description Stalwart, a mail and collaboration server, has an issue where the IMAP protocol parser can allocate an unlimited amount of memory. This can allow a remote attacker to exhaust server memory,...

CVE-2025-59149 Suricata: Stack buffer overflow in rule parser when processing long keywords with transforms

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attributetype which is long with transforms can lead to a stack buffer overflow during Suricata startup or duri...

CVE-2025-59149

Suricata (Open Information Security Foundation) 8.0.0 is affected by a vulnerability in rules that use ldap.responses.attribute_type with transforms, causing a stack buffer overflow during startup or rule reload. The issue is fixed in version 8.0.1. Workarounds include disabling rules that use ld...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a lack of locks for serializing concurrent pl-phydev writes with the parser, which could lead to a race...

ROS-20251001-08

Vulnerability of cJSON parser is related to boundary conditions in decodearrayindexfrompointer function in cJSONUtils.c. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to potentially sensitive information...

Apple fixes critical font processing bug. Update now!

Apple has released important security updates to address a critical vulnerability in FontParser —the part of MacOS/iOS/iPadOS that processes fonts. Identified as CVE-2025-43400, the flaw was discovered internally by Apple and allows an attacker to craft a malicious font that can cause apps to cra...

MAL-2025-47832 Malicious code in react-content-parser (npm)

The package react-content-parser was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed262514ac58c1f13a4761aa92199769727342ebbd70431d112061e34da94a00 Any computer that has this package installed or running should be considered fully...

Malicious code in react-content-parser (npm)

The package react-content-parser was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed262514ac58c1f13a4761aa92199769727342ebbd70431d112061e34da94a00 Any computer that has this package installed or running should be considered fully...

mysql: Parser unspecified vulnerability (CPU Apr 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL...

mysql: Parser unspecified vulnerability (CPU Apr 2025)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL...

AlmaLinux 8 : php:8.2 (ALSA-2025:15687)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:15687 advisory. php: Leak partial content of the heap through heap buffer over-read in mysqlnd CVE-2024-8929 php: Single byte overread with convert.quoted-printable-deco...

ALSA-2025:16861 Moderate: mysql:8.0 security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. Security Fixes: mysql: mysqldump unspecified vulnerability CPU Apr 2025 CVE-2025-30722 mysql: Optimizer unspecified vulnerability CPU Apr 2025...

Moderate: mysql:8.0 security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. Security Fixes: mysql: mysqldump unspecified vulnerability CPU Apr 2025 CVE-2025-30722 mysql: Optimizer unspecified vulnerability CPU Apr 2025...

About the security content of iOS 26.0.1 and iPadOS 26.0.1

About the security content of iOS 26.0.1 and iPadOS 26.0.1 This document describes the security content of iOS 26.0.1 and iPadOS 26.0.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...

The vulnerability of the raptor_ntriples_parse_term_internal() function in the RAPtor library, which allows a hacker to cause a service failure.

The vulnerability of the raptorntriplesparseterminternal function in the RAPtor library is related to reading data beyond the allowable buffer size. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-11013

A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xmlparsing.cpp of the component XML Parser. The manipulation leads to null pointer dereference. The attack can only be performed from a local...

SUSE CVE-2025-10996

A vulnerability was detected in Open Babel up to 3.1.1. This issue affects the function OBSmilesParser::ParseSmiles of the file /src/formats/smilesformat.cpp. Performing manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit is now public and ma...

SUSE CVE-2025-59830

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its paramslimit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters...