PT-2026-72614

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup clean func state cleans dead stack slots in 4-byte halves. When the high half of a STACK SPILL slot is dead and the low half remains live, cleanup converts the live lo...

CLSA-2026-1786471115 php: Fix of 2 CVEs

CVE-2026-7260: fix stack exhaustion on circular symlink chains in phar archives GHSA-vc5h-9ppw-p5f3 - CVE-2026-9672: fix uninitialized stack read in the bundled libgd GIF LZW decoder...

DEBIAN-CVE-2026-68420

In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of-bounds read in xfrmstatefind which flows from xfrmtmplresolveone. Commit 3d776e31c841 "xfrm: Reject optional tunnel/BEET mode templates in...

CVE-2026-71256

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

CVE-2026-71256

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbsreaddeviceidentificationbasic / recvreaddeviceidentificationres in nanomodbus.c. A fixed 3-element stack array order3 = 0,1,2 maps object IDs to buffer indices. The server-supplied objectid fiel...

PT-2026-68125

Name of the Vulnerable Software and Affected Versions nanoMODBUS versions prior to 1.23.1 Description An out-of-bounds stack read exists in the nmbs read device identification basic and recv read device identification res functions within nanomodbus.c. The issue occurs because the object id...

CVE-2026-70368

A stack-based out-of-bounds read vulnerability exists in the "svlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an...

CVE-2026-70368

A stack-based out-of-bounds read vulnerability exists in the "svlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an...

CVE-2026-64411

Linux kernel vulnerability CVE-2026-64411 affects netfilter/ebtables: update_counters() and compat_update_counters() pass a 32-byte user-supplied table name to find_table_lock() without NUL-termination, allowing vsnprintf() to read past the name and trigger a KASAN stack-out-of-bounds condition. ...

Linux Distros Unpatched Vulnerability : CVE-2026-64411

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: ebtables: terminate table name before findtablelock updatecounters and compatupdatecounters forward a user-supplied 32-byte table name to...

CVE-2026-54500 Oj: intern.c form_attr has an uninitialized stack read

Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory and, for long keys, reads out of bounds when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surfac...

CVE-2026-56789

RTKLIB 2.4.3 is affected by a heap buffer overflow and out-of-bounds stack read in readrnxobsb (src/rinex.c). The issue arises when RINEX epoch headers declare more than 64 satellites per epoch, allowing memory corruption and potentially crashing applications such as rnx2rtkp and RTKPOST. Connect...

CVE-2026-56789 RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Count

RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrnxobsb function in src/rinex.c that allows attackers to trigger memory corruption by failing to clamp satellite count values from RINEX epoch headers. Attackers can craft malicious RINEX files declaring more than 64...

CVE-2026-56789 RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Count

RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrnxobsb function in src/rinex.c that allows attackers to trigger memory corruption by failing to clamp satellite count values from RINEX epoch headers. Attackers can craft malicious RINEX files declaring more than 64...

PT-2026-50749

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data...

OPENSUSE-SU-2026:20812-1 Security update for cups

This update for cups fixes the following issues - CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup bsc1261572. - CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss bsc1261571. - CVE-2026-34979: Heap overflow in getoption...

SUSE-SU-2026:21871-1 Security update for cups

This update for cups fixes the following issues - CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup bsc1261572. - CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss bsc1261571. - CVE-2026-34979: Heap overflow in getoption...

CVE-2026-42446 NanaZip: Stack out-of-bounds read in NanaZip ZealFS bitmap parser

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted ZealFS v1 filesystem image. An attacker-controlled BitmapSize field in the...

PT-2026-40360

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a stack-based out-of-bounds read exists in the ZealFS filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted ZealFS v1 filesystem image. An attacker-controlled BitmapSize field in the...

CVE-2026-43453

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: fix stack out-of-bounds read in pipapodrop pipapodrop passes rulemapi + 1.n to pipapounmap as the tooffset argument on every iteration, including the last one where i == m-fieldcount - 1. This reads one...