CVE-2026-97400 jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...

CVE-2026-97400 jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...

CLSA-2026-1791337488 php: Fix of 10 CVEs

CVE-2025-14181: fix heap buffer overflow in the SOAP HTTP client chunked response handling GHSA-cj93-vc83-wgqv - CVE-2026-92842: fix heap over-read in convert stream filters with NUL in line-break-chars GHSA-88hq-2827-7pg6 - CVE-2026-93682: fix out-of-bounds read on an empty Location header in...

CVE-2026-103119

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...

CVE-2026-103119

A buffer under-read vulnerability in Apache Tomcat (versions 11.0.0-M25 through 11.0.26) allows a large non-blocking write to split a response body between the current and subsequent requests on the same connection. This can lead to the failure of the second request and the potential leakage of d...

CVE-2026-103119

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...

CVE-2026-103119 Apache Tomcat: AJP response mix-up

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...

CVE-2026-103119 Apache Tomcat: AJP response mix-up

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...

EUVD-2026-105012

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...

Security update for ntfs-3g_ntfsprogs

This update for ntfs-3gntfsprogs fixes the following issues: Denial-of-service in ntfsinodeattachallextents bsc1281758. Heap buffer overflow in ntfsaclowner bsc1281756. Heap buffer overflow in ntfscheckrestartarea bsc1281759. Heap buffer overflow in ntfseacheckwsldev bsc1281760. Heap buffer...

SUSE-SU-2026:4764-1 Security update for ntfs-3g_ntfsprogs

This update for ntfs-3gntfsprogs fixes the following issues: - Denial-of-service in ntfsinodeattachallextents bsc1281758. - Heap buffer overflow in ntfsaclowner bsc1281756. - Heap buffer overflow in ntfscheckrestartarea bsc1281759. - Heap buffer overflow in ntfseacheckwsldev bsc1281760. - Heap...

Security update for busybox

This update for busybox fixes the following issues: CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message bsc1282575. CVE-2026-88831: httpd silently fails open when IP deny...

SUSE-SU-2026:4760-1 Security update for busybox

This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message bsc1282575. - CVE-2026-88831: httpd silently fails open when IP...

CLSA-2026-1792502776 php: Fix of CVE-2025-1218

CVE-2025-1218: fix packet over-reads in the mysqlnd wire protocol parser GHSA-r6x9-5r99-36j7...

expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer

A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist ...

CVE-2026-93120

A flaw was found in the Linux kernel's USB gadget configfs component. This out-of-bounds read vulnerability occurs when the osdescqwsignshow function incorrectly handles string length during conversion. A local attacker could potentially exploit this to read sensitive information from memory,...

CVE-2026-93179

A flaw was found in the drm/amd/powerplay component of the Linux kernel. This vulnerability occurs when the VBIOS Video Basic Input/Output System provides a malformed VoltageObjectInfo table, which can lead to an infinite loop or an out-of-bounds OOB read in the system's memory. This could...

CVE-2026-93178

A flaw was found in the Linux kernel's drm/amdgpu/pm/powerplay component. This vulnerability arises because the vddInd and vddcInd fields, derived from VBIOS-parsed tables, are used to index into voltage lookup tables without proper boundary checks. A local attacker could exploit this by providin...

CVE-2026-93177

A flaw was found in the Linux kernel's AMD GPU powerplay module. This vulnerability arises from missing bounds checks when processing voltage indices from VBIOS-parsed tables. An attacker could potentially exploit this by providing specially crafted VBIOS data, leading to an out-of-bounds read...

CVE-2026-93165

A flaw was found in the Linux kernel's sensorhub component. This vulnerability occurs when a specialized piece of hardware, the Embedded Controller EC firmware, provides incorrect information about data size. This error causes the kernel to read beyond the intended memory area, which could lead t...