93 matches found
CVE-2026-68553
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...
CVE-2026-58084
FreeBSD 15.0 and 15.1 are affected by a kernel stack disclosure in the POSIX interval timer subsystem (ktimer). When an unprivileged local user calls timer_settime(2) with a non-NULL old_value argument on a CLOCK_TAI timer, the kernel invokes realtimer_gettime() to retrieve the previous timer val...
CVE-2026-58084 Kernel stack disclosure via timer_settime(2)
To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to...
CVE-2026-49425
CVE-2026-49425 is a kernel stack information disclosure in the FreeBSD compat32 subsystem (the 32-bit compatibility layer for 64-bit platforms). The kevent() handler translates a 64-bit kevent struct into a stack-declared 32-bit struct without first zeroing it , allowing an unprivileged local use...
CVE-2026-49425 Kernel stack disclosure in 32-bit compatibility support
The compat32 kevent handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information...
CVE-2026-49424
CVE-2026-49424 affects the Linux compatibility layer (Linuxulator, module linux(4)) in FreeBSD 14.3, 14.4, and 15.0 . The waitid() system call implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t without first zeroing it, allowing an unprivileged user to obse...
CVE-2026-49424 Kernel stack disclosure in Linux compatibility layer
The Linux waitid implementation translates a FreeBSD siginfot struct into a stack-declared Linux siginfot. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information...
PT-2026-78698
Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.13.0 Description An authenticated TURN user can introduce printf-style format specifiers into the STUN USERNAME or REALM attributes. These attributes bypass is secure string validation and are embedded into Redis key...
CVE-2026-73523 COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation
COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...
FreeBSD-SA-26:51.ktimer
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:51.ktimer Security Advisory The FreeBSD Project Topic: Kernel stack disclosure via timersettime2 Category: core Module: ktimer Announced: 2026-07-29 Credits:...
SUSE CVE-2026-6390
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to...
PT-2026-63568
Name of the Vulnerable Software and Affected Versions GNU nano affected versions not specified Description A flaw exists in the multi-buffer error message handling of GNU nano. When multiple files are opened at startup and one triggers an ALERT-level error, a specially crafted filename containing...
CVE-2026-6390
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to...
FreeBSD-kernel -- Kernel stack disclosure in 32-bit compatibility support
Problem Description: The compat32 kevent handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. Impact: An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information...
GHSA-FM7P-MPRW-WJM9 Oj: intern.c form_attr (uninitialized stack read)
Summary Oj.load in :object mode reads uninitialized stack memory and, for long keys, reads out of bounds when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. Details In ext/oj/intern.c, formattr handles the...
Oj: intern.c form_attr (uninitialized stack read)
Summary Oj.load in :object mode reads uninitialized stack memory and, for long keys, reads out of bounds when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. Details In ext/oj/intern.c, formattr handles the...
Astra Linux – Vulnerability in Vino
The commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak CWE-655 in the VNC server code. This flaw allows an attacker to read stack memory, and it can be exploited for information disclosure. Combined with another vulnerability, this flaw can be used to leak stack memory and...
CVE-2026-34945
A flaw was found in Wasmtime's Winch compiler. This vulnerability, present in versions from 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, arises from an incorrect translation of the table.size instruction for 64-bit WebAssembly tables. An attacker, by crafting a malicious WebAssembly guest, could...
