trafficserver:fuzz_http: Use-of-uninitialized-value in hdrtoken_hash

Project: https://github.com/apache/trafficserver.git Detailed Report: https://oss-fuzz.com/testcase?key=4669620266270720 Project: trafficserver Fuzzing Engine: libFuzzer Fuzz Target: fuzzhttp Job Type: libfuzzermsantrafficserver Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

USN-8004-2 freerdp2 regression

USN-8004-1 fixed vulnerabilities in FreeRDP. The update for CVE-2026-23533 introduced a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Kim Dong Han discovered that FreeRDP did not correctly validate the size of certain variables, which...

USN-8004-2: FreeRDP regression

USN-8004-1 fixed vulnerabilities in FreeRDP. The update for CVE-2026-23533 introduced a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Kim Dong Han discovered that FreeRDP did not correctly validate the size of certain variables, which...

pcapplusplus:FuzzTargetNg: Crash in pcpp::Packet::destructPacketData

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=5782362540802048 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTargetNg Job Type: libfuzzerubsanpcapplusplus Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

Fedora 42 : phpunit10 (2026-1d1c8f5df2)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1d1c8f5df2 advisory. Version 10.5.63 - 2026-01-27 Fixed Regression introduced in PHPUnit 9.6.33 ---- Version 10.5.62 - 2026-01-27 Changed To prevent Poisoned Pipeline Execution P...

Fedora 42 : phpunit9 (2026-a1cb6b0f95)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a1cb6b0f95 advisory. Version 9.6.34 - 2026-01-27 Fixed Regression introduced in PHPUnit 9.6.33 ---- Version 9.6.33 - 2026-01-27 Changed To prevent Poisoned Pipeline Execution PPE...

Debian dla-4468 : libtomcat9-embed-java - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4468 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4468-1 [email protected]...

Fedora 43 : phpunit9 (2026-8d8a292bba)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8d8a292bba advisory. Version 9.6.34 - 2026-01-27 Fixed Regression introduced in PHPUnit 9.6.33 ---- Version 9.6.33 - 2026-01-27 Changed To prevent Poisoned Pipeline Execution PPE...

Fedora 43 : phpunit10 (2026-ff411cd463)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ff411cd463 advisory. Version 10.5.63 - 2026-01-27 Fixed Regression introduced in PHPUnit 9.6.33 ---- Version 10.5.62 - 2026-01-27 Changed To prevent Poisoned Pipeline Execution P...

CVE-2026-23100

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlbpmdshared Patch series "mm/hugetlb: fixes for PMD table sharing incl. using mmugather", v3. One functional fix, one performance regression fix, and two related comment fixes. I cleaned up my prototype I...

UBUNTU-CVE-2026-23100

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlbpmdshared Patch series "mm/hugetlb: fixes for PMD table sharing incl. using mmugather", v3. One functional fix, one performance regression fix, and two related comment fixes. I cleaned up my prototype I...

EUVD-2026-5442

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlbpmdshared Patch series "mm/hugetlb: fixes for PMD table sharing incl. using mmugather", v3. One functional fix, one performance regression fix, and two related comment fixes. I cleaned up my prototype I...

CVE-2026-23100

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlbpmdshared Patch series "mm/hugetlb: fixes for PMD table sharing incl. using mmugather", v3. One functional fix, one performance regression fix, and two related comment fixes. I cleaned up my prototype I...

OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable

Summary A Command Injection vulnerability existed in Clawdbot’s Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when constructing shell commands. An authenticated user able to control environment variables could influence command execution within the...

GHSA-MC68-Q9JW-2H3V OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable

Summary A Command Injection vulnerability existed in Clawdbot’s Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when constructing shell commands. An authenticated user able to control environment variables could influence command execution within the...

gpsd:FuzzClient: Use-of-uninitialized-value in json_internal_read_object

Project: https://gitlab.com/gpsd/gpsd.git Detailed Report: https://oss-fuzz.com/testcase?key=5621455617589248 Project: gpsd Fuzzing Engine: libFuzzer Fuzz Target: FuzzClient Job Type: libfuzzermsangpsd Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

maven-model:Xpp3ReaderFuzzer: Security exception in java.base/java.util.Arrays.copyOfRange

Detailed Report: https://oss-fuzz.com/testcase?key=5084302608236544 Project: maven-model Fuzzing Engine: libFuzzer Fuzz Target: Xpp3ReaderFuzzer Job Type: libfuzzerasanmaven-model Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.Arrays.copyOfRange...

wamr:wamr_fuzz_llvm_jit: Null-dereference READ in execute_post_instantiate_functions

Project: https://github.com/bytecodealliance/wasm-micro-runtime.git Detailed Report: https://oss-fuzz.com/testcase?key=4578967146528768 Project: wamr Fuzzing Engine: libFuzzer Fuzz Target: wamrfuzzllvmjit Job Type: libfuzzerasanwamr Platform Id: linux Crash Type: Null-dereference READ Crash...

CVE-2026-24850

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard ML-DSA. Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated duplicat...

Stealthy Poisoning Attacks Bypass Defenses in Regression Settings

Regression models are widely used in industrial processes, engineering and in natural and physical sciences, yet their robustness to poisoning has received less attention. When it has, studies often assume unrealistic threat models and are thus less useful in practice. In this paper, we propose a...