CVE-2026-33069 PJSIP has an Out-of-bounds Read in SIP multipart parsing

PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsipmultipartparse. After boundary string matching, curptr is advanced past the delimiter without verifying it has not reached the buffer end. This...

PT-2026-26586

PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a cascading out-of-bounds heap read in pjsip multipart parse. After boundary string matching, curptr is advanced past the delimiter without verifying it has not reached the buffer end. This...

GHSA-434X-W66G-QW3R vulnerabilities

Vulnerabilities for packages: helix, rustup, mdbook, parseable, linkerd-extension-init, atuin, netavark, tealdeer, yazi, zola, berg, linkerd-network-validator, linkerd2, qdrant, zellij, zed, buck2, wash, oranda, topgrade, zizmor, cargo-c, wizer, wasmcloud, linkerd-await, ntpd-rs, pgcat,...

CVE-2026-25541 vulnerabilities

Vulnerabilities for packages: helix, rustup, mdbook, parseable, linkerd-extension-init, atuin, netavark, tealdeer, yazi, zola, berg, linkerd-network-validator, linkerd2, qdrant, zellij, zed, buck2, wash, oranda, topgrade, zizmor, cargo-c, wizer, wasmcloud, linkerd-await, ntpd-rs, pgcat,...

CVE-2026-25541 vulnerabilities

Vulnerabilities for packages: deno, linkerd-await, asciinema, pixi, zed, oranda, bootc, geckodriver, linkerd2, linkerd2-proxy, helix, efs-utils, tealdeer, yazi, zola, jujutsu, netavark, ztunnel-fips, valkey-ldap, mountpoint-s3, buck2, sentry-cli, samply, guestproxyagent, kdash, wash, cargo-c,...

GHSA-434X-W66G-QW3R vulnerabilities

Vulnerabilities for packages: deno, linkerd-await, asciinema, pixi, zed, oranda, bootc, geckodriver, linkerd2, linkerd2-proxy, helix, efs-utils, tealdeer, yazi, zola, jujutsu, netavark, ztunnel-fips, valkey-ldap, mountpoint-s3, buck2, sentry-cli, samply, guestproxyagent, kdash, wash, cargo-c,...

CVE-2025-68137

EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in SdpPacket::parseheader allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtract...

CVE-2025-68136

EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like Session, IConnection which open new TCP socket for the ISO15118-20 communications and registers callbacks for the created file descriptor, witho...

CVE-2025-68137

EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in SdpPacket::parseheader allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtract...

CVE-2025-68137

EVerest before version 2025.10.0 is affected by an integer overflow in SdpPacket::parse_header(). After reading an 8-byte header, the remaining length can be set to 7, and the calculation of the remaining length yields a negative value that is interpreted as SIZE_MAX. This can cause an infinite l...

CVE-2025-68137 EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop

EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in SdpPacket::parseheader allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtract...

CVE-2025-68135 EVerest's inadequate exception handling leads to denial of service

EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by the TbdController loop, leading to its caller and itself to silently terminates. Thus, this leads to a denial of service as it is responsible of SDP and ISO15118-20 servers...

CVE-2025-68136: Allocation of Resources Without Limits or Throttling

EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like Session, IConnection which open new TCP socket for the ISO15118-20 communications and registers callbacks for the created file descriptor, witho...

PT-2026-3850

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2025.10.0 Description EVerest is an EV charging software stack. An integer overflow in the SdpPacket::parse header function can occur when processing data. Specifically, the current buffer length can be set to 7 after...

Everest-core security vulnerabilities

Everest-core is a major component of the open-source electric vehicle charging software stack developed by EVerest. Versions of everest-core prior to 2025.10.0 contained security vulnerabilities. These vulnerabilities were caused by integer overflows in the SdpPacket::parseheader function, which...

CVE-2025-68135: Improper Check or Handling of Exceptional Conditions

EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by the TbdController loop, leading to its caller and itself to silently terminates. Thus, this leads to a denial of service as it is responsible of SDP and ISO15118-20 servers...

MiracleLinux 8 : bluez-5.56-3.el8 (AXSA:2022-3444:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3444:01 advisory. bluez: memory leak in the SDP protocol CVE-2021-41229 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory...

MiracleLinux 4 : wireshark-1.8.10-8.AXS4 (AXSA:2014-616:03)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-616:03 advisory. Description : Wireshark is a network traffic analyzer for Unix-ish operating systems. This package lays base for libpcap, a packet capture and...

MiracleLinux 3 : wireshark-1.0.15-7.0.1.AXS3 (AXSA:2014-725:02)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-725:02 advisory. Description : Wireshark is a network traffic analyzer for Unix-ish operating systems. This package lays base for libpcap, a packet capture and...

CVE-2018-9449

In processservicesearchattrrsp of sdpdiscovery.cc, there is a possible out of bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...