DTLS Retransmits Handshake Messages From a Stale Buffer Offset

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly...

PT-2026-102844

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 154.0.8037.92 Description An uninitialized resource in the GPU allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a specially crafted...

CVE-2026-102318: Out-of-bounds Read

Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

Important: libheif

Issue Overview: Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an out-of-bounds read NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-hh47-fhqr-cj2r CVE-2026-84450 Incomplete fix for GHSA-73p7-m7gg-w2jv leaves libheif 1.23.1 vulnerable to an...

Amazon Linux 2 : thunderbird (ALAS-2026-3952)

The version of thunderbird installed on the remote host is prior to 140.16.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3952 advisory. Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerabilit...

RHEL 8 : kernel (RHSA-2026:72468)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72468 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fbcon: Set fbdisplayi-mode to...

CVE-2026-102555: Out-of-bounds Read

A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling gbase64decodeinplace. If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the si...

PT-2026-102752

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists in the soup uri decode data uri function, which incorrectly treats base64 data-URI payloads as NUL-terminated strings when calling g base64 decode inplace. If the percent-decode...

CVE-2026-102558: Out-of-bounds Read

A flaw was found in libsoup. When max-incoming-payload-size is unlimited 0, SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95308): chromium -- security fixes

Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. Chromium security severity: Low...

Medium: libxml2

Issue Overview: A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX...

CVE-2026-102559: Out-of-bounds Read

A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow...

CVE-2026-102718: Out-of-bounds Read

hey, nxsnmputilityobjectidget in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer,...

FreeBSD-SA-26:68.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:68.openssl Security Advisory The FreeBSD Project Topic: Out-of-bounds read in OpenSSL DTLS retransmission Category: contrib Module: openssl Announced:...

RHEL 9 : resteasy (RHSA-2026:72424)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72424 advisory. RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified...

CVE-2026-84782: Out-of-bounds Read

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly...

FreeBSD -- Memory safety bugs in kqueue copy-on-fork implementation

Problem Description: When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes used internally to track list traversal position before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was droppe...

CVE-2026-102307: Use of Uninitialized Resource

Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95332): chromium -- security fixes

Use of uninitialized variable in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-102758: Buffer Over-read

The nxsecurex509asn1tlvblockparse function parses ASN.1 TLV tag-length-value blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates supplied by a remote peer during the TLS handshake. The function reads the...