PT-2026-51390

Name of the Vulnerable Software and Affected Versions MessagePack for C versions prior to 2.5.301 MessagePack for C versions prior to 3.1.7 Description MessagePack for C is a MessagePack serializer for C. The ReadDateTime function in MessagePackReader can allocate stack memory based on an...

Medium: perl-Storable

Issue Overview: Storable versions before 3.05 for Perl has a stack overflow. The retrievehook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow...

Tenda AC7 stack buffer overflow vulnerability

The Tenda AC7 is a 1200m1 11ac dual-band wireless router designed for large households undergoing broadband upgrades and router replacements. The Tenda AC7 has a stack buffer overflow vulnerability. This vulnerability stems from the GoForm/AdvSetMacMtuWan function failing to correctly verify the...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: can: isotp: fix tx.buf use-after-free in isotpsendmsg CVE-2026-31474 kernel: mptcp: fix slab-use-after-free in inetlookupestablished CVE-2026-31669 kernel: xen/privcmd: fix double free vi...

Amazon Linux 2023 : perl-CryptX, perl-CryptX-tests (ALAS2023-2026-1834)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1834 advisory. CryptX versions before 0.088001 for Perl compare AEAD authentication tags in non-constant time in the streaming decryptdone path. The decryptdone$tag form compares it against the computed tag...

RHEL 9 : kernel (RHSA-2026:27789)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:27789 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: can: isotp: fix tx.buf...

Exploit for Out-of-bounds Write in Tenda Ac9_Firmware

CVE-2025-29384 Proof-of-Concept Exploit Overview This repo...

RUSTSEC-2026-0187 Stack overflow in lopdf via deeply nested PDF objects

lopdf::Document::loadmem and the other load entry points parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array /X … , on the order of 10,000 levels exhausts the call stack and aborts the process with SIGABRT. Because...

SUSE-SU-2026:22306-1 Security update for tiff

This update for tiff fixes the following issues Security issues: - CVE-2025-8851: libtiff: LibTIFF Stack-based buffer overflow bsc1248278. - CVE-2026-4775: signed integer overflow in the putcontig8bitYCbCr44tile function bsc1260411. Non security issue: - QGIS can't export with GDAL- LERC codec,...

OPENSUSE-SU-2026:20995-1 Security update for tiff

This update for tiff fixes the following issues Security issues: - CVE-2025-8851: libtiff: LibTIFF Stack-based buffer overflow bsc1248278. - CVE-2026-4775: signed integer overflow in the putcontig8bitYCbCr44tile function bsc1260411. Non security issue: - QGIS can't export with GDAL- LERC codec,...

PT-2026-54955

lopdf::Document::load mem and the other load entry points parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array /X … , on the order of 10,000 levels exhausts the call stack and aborts the process with SIGABRT. Because...

SUSE CVE-2026-43994

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decodeoauthtokengcm. A uint16t noncelen field read from an attacker-supplied OAuth access token 0-65535 is passed directly to memcpy as the copy length into a 256-byte...

kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI synchronization. A local user could trigger a stack buffer overflow by binding a specific type of Bluetooth socket with an excessive number of Bluetooth Isochronous Stream BIS entries. This memory corruption can lead t...

SUSE SLED15 / SLES15 Security Update : rustup (SUSE-SU-2026:2441-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2441-1 advisory. This update for rustup fixes the following issues - CVE-2026-25727: time: parsing of user-provided input by the RFC 282...

SUSE SLES16 Security Update : opensc (SUSE-SU-2026:22126-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22126-1 advisory. - CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses bsc1261214. - CVE-2025-66037: crafted input...

AZL-91275 CVE-2026-48715 affecting package radvd for versions less than 2.21-1

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, printff copies up to 2032 bytes from attacker-controlled...

CVE-2026-48715

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, printff copies up to 2032 bytes from attacker-controlled...

CVE-2026-48715

radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, printff copies up to 2032 bytes from attacker-controlled...

Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

Summary Oj::Doceachchild, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process. This is a denial of service reachable from untrusted JSON. Details Two-step chain in ext/oj/fast.c: 1. doceachchild line 1501 increments doc-where pas...

GHSA-3M6Q-JJ5J-38C9 Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

Summary Oj::Doceachchild, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process. This is a denial of service reachable from untrusted JSON. Details Two-step chain in ext/oj/fast.c: 1. doceachchild line 1501 increments doc-where pas...