389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet()

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the wrapped-record length read from the wire is validated only against an upper bound. A small wire length 0, 1, or 2 produces an encryptedbuffercount below the already-consumed...

EUVD-2026-72533

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

EUVD-2026-72534

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

CVE-2026-77495: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network...

CVE-2026-69860: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network...

CVE-2026-77482: Heap-based Buffer Overflow

Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network...

PT-2026-88013

This Microsoft Patch Tuesday, among with the historical 974 ! bugs patched, I contributed three. - Microsoft Word Remote Code Execution Vulnerability CVE-2026-78510 https://t.co/7UyCIwJTji - Microsoft Office Outlook Remote Code Execution Vulnerability CVE-2026-78509 https://t.co/Nn3oKfDPL4 -...

PT-2026-88014

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

PT-2026-88256

In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-88024

Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

PT-2026-87645

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

PT-2026-87087

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

PT-2026-88036

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

PT-2026-88004

Improper control of generation of code 'code injection' in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

PT-2026-87890

Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network...

PT-2026-87314

Integer overflow or wraparound in Windows DHCP Server allows an unauthorized attacker to execute code over a network...

PT-2026-87085

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

PT-2026-88738

Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...