xqq libaribcaption buffer error vulnerability

The xqq libaribcaption version 1.1.0 to 1.1.2 contains a buffer error vulnerability. This vulnerability stems from the global out-of-bounds read in DecoderImpl::HandleGLGR. No upper-bound checks were performed on the kLatinSpecialTable, resulting in reading beyond the boundaries of 78 tables...

Matias Fontanini’s libtins buffer error vulnerability

Matias Fontanini’s libtins 4.6 and earlier versions have a buffer error vulnerability. This vulnerability stems from a heap out-of-bounds read in the DNS::composename function. When parsing specially crafted DNS packets, a one-byte out-of-bounds read can occur, leading to application crashes...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0 through 3.9.2, and 4.0.0 through 4.0.4 have a buffer error vulnerability. This...

Camunda 7 Authorization Vulnerability

In versions of Camunda 7.24.0 through 7.24.14, as well as versions from 7.23.0 through 7.23.17, there is an authorization issue vulnerability. This vulnerability stems from the reversed comparison logic in the AbstractCockpitPluginResource.isPermissionDisabled function within the Cockpit webapp. ...

Matias Fontanini’s libtins buffer error vulnerability

Matias Fontanini’s libtins 4.6 and earlier versions have a buffer overflow vulnerability. This vulnerability stems from an out-of-bounds read in the DNS::soarecord::init function. Attackers can read content beyond the buffer boundary by providing SOA data that lacks a NUL terminator. This allows...

Emergence libdisplay-info buffer error vulnerability

The emersion libdisplay-info 0.4.0 version contains a buffer error vulnerability. This vulnerability stems from the DisplayID v2 parser in displayid2.c, where a stack out-of-bounds read occurs. Attackers can read data that exceeds the EDID buffer by using an excessively large data block size...

IBM MQ Operator buffer error vulnerability

IBM MQ Operator versions 2.0.0 through 2.0.29, 3.2.0 through 3.2.29, 3.3.0 through 3.4.0 excluding versions prior to 3.4.1, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, 3.6.0 through 3.6.4, 3.7.0 through 3.7.2, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 4.0.0, 4.0.1, 4.0.2, 4.0.3, and 4.0.4 have a buffer error...

Apache Camel path traversal vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a path traversal vulnerability. This vulnerability arises due to the Azure Files component failing to normalize the construction of absolute paths by concatenating configuration directories with lists of server...

Pillow buffer error vulnerability

Pillow versions from 8.1.0 to 13.0.0 contain a buffer error vulnerability. This vulnerability arises due to inconsistencies in the interpretation of identical tags such as PhotometricInterpretation or BitsPerSample during TIFF tile and RGBA decoding processes. Pillow and libtiff do not verify...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation. This vulnerability arises when the FopProducer creates a TransformerFactory by enabling only FEATURESECUREPROCESSING, without restricting access to external resources...

VideoLAN LibBluray buffer error vulnerability

VideoLAN libbluray 1.5.1 and earlier versions have a buffer error vulnerability. This vulnerability stems from an out-of-bounds read in the clpiaccesspoint function. Attackers can trigger this issue by providing a ClipInfo file containing an empty EP-map fine table with numepfine set to zero and...

NetPBM buffer error vulnerability

NetPBM versions 11.16.00 and earlier have a buffer error vulnerability. This vulnerability stems from RastTopNM’s handling of Sun raster files with short color mappings, where there is a risk of heap out-of-bound reading. An attacker can create color mapping raster files whose pixel bytes exceed...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.7.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation errors. This vulnerability stems from improper restrictions on external entities by the camel-smooks component. The default XML parser allows for the parsing of external...

Docling Project: "docling-core" input validation error vulnerability

The Docling Project’s docling-core 2.102.0 and earlier versions have a vulnerability in input validation. This vulnerability stems from the fact that the ImageRef URI accepts pure file system paths and bypasses the allowimagefileuri restriction. Attackers can exploit this vulnerability by...

Apache Camel path traversal vulnerability

Versions of Apache Camel Mina SFTP from 4.18.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a path traversal vulnerability. This vulnerability arises when the remote file consumer concatenates the configuration directory with the filenames in the server directory list without proper normalization ...

CVE-2026-98843

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

EUVD-2026-103783

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

CVE-2026-98839 vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

CVE-2026-98839

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

CVE-2026-98839 vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...