PT-2026-28331

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the icmp tag validation function. This function unconditionally dereferences a pointer without a preceding NULL check. Specifically, it dereferenc...

Fedora 42 : qt6-qtdeclarative (2025-62d125612b)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-62d125612b advisory. CVE-2025-12385: Fix improper validation of img tag size in Text component parser Tenable has extracted the preceding description block directly from the Fedo...

EUVD-2012-0098

Malware in sbrugna...

CVE-2025-54887 jwe: Missing AES-GCM authentication tag validation in encrypted JWEs

jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption JWE standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk becau...

CVE-2025-24015

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in which the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the...

CVE-2025-24015

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions 1.46.0 through 2.1.6 have an issue that affects AES-256-GCM and AES-128-GCM in Deno in which the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the...

PT-2026-88983

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions 4.20.0 through 4.22.2 PocketMine-MP versions 5.0.0 through 5.2.0 Description Failure to validate NBT tag types in the BlockActorDataPacket allows a player to crash the server. By sending a packet containing sign NBT data...

AArch64cryptolib path traversal vulnerability

AArch64cryptolib is an open source scratch implementation of a cryptographic primitive by Arm Software. A path traversal vulnerability exists in versions prior to AArch64cryptolib 20230220, which stems from the inability of the armv8decaesgcmfull API to validate authentication tags for AES-GCM...

SUSE CVE-2012-0060

RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an invalid region tag in a package header to the 1 headerLoad, 2 rpmReadSignature, or 3 headerVerify function...

CVE-2023-0333 TemplatesNext ToolKit < 3.2.9 - Contributor+ Stored XSS

The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Oracle Linux 5 / 6 : rpm (ELSA-2012-0451)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0451 advisory. - Proper region tag validation on package/header read CVE-2012-0060 - Double-check region size against header size CVE-2012-0061 Tenable has...

rpm: improper validation of header contents total size in headerLoad()

The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service crash and possibly execute arbitrary code via a large region size in a package header...

rpm security update

4.8.0-19.1 - Proper region tag validation on package/header read CVE-2012-0060 - Double-check region size against header size CVE-2012-0061 - Validate negated offsets too in headerVerifyInfo CVE-2012-0815...

CVE-2010-2630

The TIFFReadDirectory function in LibTIFF 3.9.0 does not properly validate the data types of codec-specific tags that have an out-of-order position in a TIFF file, which allows remote attackers to cause a denial of service application crash via a crafted file, a different vulnerability than...

libexif: Buffer overflow vulnerability

Background libexif is a library for parsing, editing and saving EXIF data. Description libexif contains a buffer overflow vulnerability in the EXIF tag validation code. When opening an image with a specially crafted EXIF tag, the lack of validation can cause applications linked to libexif to cras...