CVE-2022-35737

CVE-2022-35737 Integer overflow in SQLite3 sqlite3strvappendf function. CVSS 6.7 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2022-35737 was introduced in SQLite version 1.0.12 and fixed in release 3.39.2, available on July 21, 2022. It is exploitable on 64-bit systems, and exploitability depends on h...

SUSE SLES15 Security Update : aliyun-cli (SUSE-SU-2026:5195-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5195-1 advisory. - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index...

SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:5203-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5203-1 advisory. Security issues fixed: - CVE-2026-14362: HashiCorp memberlist before version 0.6.0 is vulnerable to a...

ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser

A flaw was found in FFmpeg. An attacker could exploit a signed integer overflow vulnerability within the DVB subtitle parser by providing a specially crafted WTV Windows Recorded TV Show file. This overflow can lead to a heap buffer overflow, enabling out-of-bounds memory writes. The consequence ...

ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser

A flaw was found in FFmpeg. An attacker could exploit a signed integer overflow vulnerability within the DVB subtitle parser by providing a specially crafted WTV Windows Recorded TV Show file. This overflow can lead to a heap buffer overflow, enabling out-of-bounds memory writes. The consequence ...

Security update for alloy

This update for alloy fixes the following issues: Security issues fixed: CVE-2026-14362: HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue bsc1271206. CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypa...

SUSE-SU-2026:5202-1 Security update for distribution

This update for distribution fixes the following issues: - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request through the X-HTTP-Method-Override header and bypass established access control bsc1277966. - CVE-2026-41178:...

Security update for aliyun-cli

This update for aliyun-cli fixes the following issues: CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283596. CVE-2026-116591: github.com/klauspost/compress/zstd: crafted 27 KB...

SUSE-SU-2026:5195-1 Security update for aliyun-cli

This update for aliyun-cli fixes the following issues: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283596. - CVE-2026-116591: github.com/klauspost/compress/zstd: crafted 2...

UBUNTU-CVE-2026-125072

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mpdecodeframe in libavcodec/mpegaudiodectemplate.c because initgetbits failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing rea...

CVE-2026-125072

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mpdecodeframe in libavcodec/mpegaudiodectemplate.c because initgetbits failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing rea...

EUVD-2026-120247

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mpdecodeframe in libavcodec/mpegaudiodectemplate.c because initgetbits failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing rea...

CVE-2026-125072

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference within the mp_decode_frame() function in libavcodec/mpegaudiodec_template.c. The root cause is that the init_get_bits() failure is ignored following a signed integer overflow . An attacker can exploit this by providing an ...

PT-2026-140986

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp decode frame in libavcodec/mpegaudiodec template.c because init get bits failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causin...

CentOS Linux 6 [TuxCare] Security Update: expat / expat-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1793922199)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1793922199 advisory. - libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that...

AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1794052458)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1794052458 advisory. - libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that...

AlmaLinux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1794007406)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794007406 advisory. - libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that...

Rocky Linux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1794007406)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794007406 advisory. - libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that...

Security update for helm

This update for helm fixes the following issues: CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283642. CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from...

SUSE-SU-2026:5119-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an attacker to bypass repeat index validation and cause a process crash bsc1283642. - CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption fr...