136641 matches found
CVE-2026-45538
OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when siptojson is called in the routing script. Function siptojson modules/sipmsgops/sipmsgops.c copie...
CVE-2026-45538
OpenSIPS prior to 4.0.0 is vulnerable to a stack buffer overflow in sip_to_json() when processing a SIP header name longer than 255 bytes. The function copies header names into a fixed 255-byte stack buffer without bounds checking, even though header names can be ~65,000 bytes. A routing script t...
CVE-2026-70485
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...
Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a denial of service vulnerability with HTTP/2 (CVE-2026-11897)
Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a denial of service vulnerability with HTTP/2 when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details Refer to the security...
UBUNTU-CVE-2026-68743
A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...
CVE-2026-68743
SSSD's extract_authtok_v1() in the PAM responder skips validation of auth_token_length against the buffer, allowing a local attacker to trigger an out-of-bounds read and crash via a crafted protocol v1 request. Nessus flags unpatched distros; no in-the-wild exploitation is reported. Apply vendor ...
CVE-2026-68743 Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1
A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...
CVE-2026-68743 Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1
A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when nghttp2sessionmemsend is called re-entrantly during the execution of nghttp2sessionmemrecv. An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant...
ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching
A flaw was found in ldns. When applications use ldns as a resolver over User Datagram Protocol UDP, it fails to properly match the query's destination address and port with the response's source address and port. Additionally, the query ID and question are not matched with the response. This...
CVE-2026-24078
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...
CVE-2026-10032
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
CVE-2026-61515
Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit...
CVE-2026-11368
The Bluetooth host ATT layer subsys/bluetooth/host/att.c associates each in-flight ATT TX buffer with its owning channel via the static txmetadatastorage array data-attchan = chan. When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system...
EUVD-2026-52731
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...
CVE-2026-24078 Exposure of Private Personal Information to an Unauthorized Actor in Data Modem
Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling...
CLSA-2026-1785468077 TuxCare security update for protobufjs (7 CVEs)
TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2...
CLSA-2026-1774657398 TuxCare security update for ip (1 CVE)
TuxCare rebuilt ip to address 1 CVE. Fixed in 1.1.5-tuxcare.1...
CVE-2026-11368 Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer
The Bluetooth host ATT layer subsys/bluetooth/host/att.c associates each in-flight ATT TX buffer with its owning channel via the static txmetadatastorage array data-attchan = chan. When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system...
CVE-2026-11368
Summary of CVE-2026-11368 details: The Bluetooth host ATT layer (att.c) ties in-flight ATT TX buffers to channels via tx_meta_data_storage[]. When a buffer is freed, completion handling defers to a workqueue path (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_...