CVE-2026-24889 soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64

soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the Bytes::slice, Vec::slice, and Prng::genrange for u64 methods in the soroban-sdk in versions up to and including 25.0.1, 23.5.1, and 25.0.2. Contracts that pass user-controlled or computed range bounds to...

CVE-2026-24889 soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64

soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the Bytes::slice, Vec::slice, and Prng::genrange for u64 methods in the soroban-sdk in versions up to and including 25.0.1, 23.5.1, and 25.0.2. Contracts that pass user-controlled or computed range bounds to...

CVE-2026-24889: Integer Overflow or Wraparound

soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic overflow can be triggered in the Bytes::slice, Vec::slice, and Prng::genrange for u64 methods in the soroban-sdk in versions up to and including 25.0.1, 23.5.1, and 25.0.2. Contracts that pass user-controlled or computed range bounds to...

rs-soroban-sdk input validation vulnerability

rs-soroban-sdk is a Rust development toolkit open source by Stellar. Versions of rs-soroban-sdk 25.0.1 and earlier, as well as 23.5.1 and earlier, and 25.0.2 and earlier, have a vulnerability related to input validation errors. This vulnerability stems from arithmetic overflow in the Bytes::slice...

PT-2026-5233

Name of the Vulnerable Software and Affected Versions soroban-sdk versions 22.0.9 through 25.0.1 soroban-sdk version 23.5.1 soroban-sdk version 25.0.2 Description The soroban-sdk contains an arithmetic overflow issue in the Bytes::slice, Vec::slice, and Prng::gen range for u64 methods. When...

MiracleLinux 9 : tcpdump-4.99.0-9.el9 (AXSA:2024-8003:03)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2024-8003:03 advisory. tcpslice: use-after-free in extractslice CVE-2021-41043 Tenable has extracted the preceding description block directly from the MiracleLinux security advisor...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003915)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003915 advisory. kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfsquotaus is used e.g., with Kubernetes, allows attackers to cause a denial of service against...

EUVD-2026-1874

RustCrypto Has Insufficient Length Validation in decrypt in SM2-PKE...

RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE

Summary A denial-of-service vulnerability exists in the SM2 public-key encryption PKE implementation: the decrypt path performs unchecked slice::splitat operations on input buffers derived from untrusted ciphertext. An attacker can submit short/undersized ciphertext or carefully-crafted DER-encod...

CVE-2026-22700

CVE-2026-22700 affects RustCrypto: Elliptic Curves SM2 PKE decrypt paths (DecryptingKey::decrypt, decrypt_digest, decrypt_der) in versions 0.14.0-pre.0 and 0.14.0-rc.0. The vulnerability arises from unchecked slice::split_at on input buffers derived from untrusted ciphertext, enabling bounds-chec...

CVE-2026-22700: Improper Input Validation

RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography ECC support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a denial-of-service vulnerability...

CVE-2023-49468

Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the readcodingunit function at slice.cc...

CVE-2024-34049

Open Networking Foundation SD-RAN Rimedo rimedo-ts 0.1.1 has a slice bounds out-of-range panic in "return plmnIdString0:3, plmnIdString3:" in reader.go...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000313)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000313 advisory. An issue was discovered in the Linux kernel before 5.6.5. There is a use-after-free in block/bfq-iosched.c related to bfqidleslicetimerbody. Tenable has extracted th...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000252)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000252 advisory. kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfsquotaus is used e.g., with Kubernetes, allows attackers to cause a denial of service against...

PT-2026-26292

Name of the Vulnerable Software and Affected Versions pgproto3 affected versions not specified Description A flaw exists in pgproto3 where a malicious or compromised PostgreSQL server can send a DataRow message containing a negative field length. This input validation issue can cause a denial of...

PT-2026-26141

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the cram decode slice function called while reading CRAM records, validation of the reference id field occurred too late, allowing two out of bounds...

PT-2026-26143

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data. In the cram decode slice function called while reading CRAM records, the value of the mate reference id field was not validated. Later use of this value,...

CVE-2018-25155

Teradek Slice 7.3.15 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft a malicious web page that automatically submits password change requests to the device when a logged-in user...

CVE-2018-25155 Teradek Slice 7.3.15 Cross-Site Request Forgery via Password Change

Teradek Slice 7.3.15 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft a malicious web page that automatically submits password change requests to the device when a logged-in user...