CVE-2026-112010

smpeg through 2.0.0 contains an integer underflow vulnerability in str...

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. T...

CVE-2026-98679

A flaw was found in the Linux kernel's KXCJK-1013 accelerometer driver. A local user could exploit this flaw by submitting duplicate event disable requests to the device configuration interface. Because the driver does not filter repeated disable requests, it improperly releases a runtime power...

CVE-2026-111808 Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version...

CVE-2026-111808

Apache Traffic Server is vulnerable to a worker-pool exhaustion attack affecting versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. The vulnerability is caused by an integer underflow (CWE-191) occurring during the processing of a malformed padded HTTP/2 DATA ...

CVE-2026-102699

A flaw was found in Xen. A malicious guest domain can trigger an integer underflow when requesting cache flush operations. This calculation error leads to an excessively long processing loop in the hypervisor, causing the host system to crash and resulting in a Denial of Service DoS. Mitigation...

CLSA-2026-1792593112 krb5: Fix of 2 CVEs

CVE-2026-40355: NULL pointer dereference in parsenegomessage - CVE-2026-40356: integer underflow and out-of-bounds read in parsemessage...

CVE-2026-98621

A flaw was found in the Linux kernel's Generic UDP Encapsulation GUE networking component. A remote attacker could exploit this vulnerability by sending specially crafted network packets containing invalid remote checksum offsets. This improper input validation causes an integer underflow, allowi...

CVE-2026-74755

An integer underflow in the mcpack2pb component of Apache bRPC version 1.18.0 on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero valuesize. The UnparsedValue::asstring function computes size - 1 without validating size; when...

CVE-2026-56386

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

CLSA-2026-1792238729 gstreamer1-plugins-good: Fix of 4 CVEs

CVE-2026-73433: avidemux: fix unsigned integer underflow and out-of-bounds access when parsing FUJIFILM metadata in strd chunks - CVE-2026-73434: avidemux: fix out-of-bounds read by using the correct divisor when counting vprp video field descriptors...

EUVD-2026-107180

An integer underflow in the mcpack2pb component of Apache bRPC version 1.18.0 on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero valuesize. The UnparsedValue::asstring function computes size - 1 without validating size; when...

CVE-2026-74755 Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service

An integer underflow in the mcpack2pb component of Apache bRPC version 1.18.0 on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero valuesize. The UnparsedValue::asstring function computes size - 1 without validating size; when...

CVE-2026-74755

Apache bRPC (versions prior to 1.18.0 ) is vulnerable to a Denial of Service due to an integer underflow in the mcpack2pb component. The UnparsedValue::as_string() function in src/mcpack2pb/parser.cpp fails to validate the value_size of string fields from network data; when the size is 0, the cal...

CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

EUVD-2026-107172

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...

CVE-2026-56386

The Apache bRPC HTTP/2 server DATA frame parser is vulnerable to an integer underflow and out-of-bounds read . The issue arises because the handler decrements the fragment size when the PADDED flag is set before verifying the presence of the mandatory pad length byte. An unauthenticated remote at...

CVE-2026-111075

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

EUVD-2026-107138

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...