DEBIAN-CVE-2026-29035

CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...

CVE-2026-29035

CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...

CVE-2026-29035

CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...

CVE-2026-29035

CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...

PT-2026-70902

CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the read websocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE ZLIB and MG EXPERIMENTAL INTERFACES are defined. Attackers can...

Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: Update to release 4.4.8. CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution bsc1269490. CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of...

Security Bulletin:Vulnerability in Perl affects IBM Netezza Appliance

Summary The Perl package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-4176 Vulnerability Details CVEID:CVE-2026-4176 DESCRIPTION: Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a...

SUSE-SU-2026:23154-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

MiracleLinux 8 : ruby:3.3 (AXSA:2026-1503:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1503:01 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

Photon OS 5.0: Zlib PHSA-2026-5.0-91-0874

An update of the zlib package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0874. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

SUSE SLES15: libavcodec58_134 / libavformat58_76 / libavutil56_70 / etc (SUSE-SU-2026:3529-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3529-1 advisory. Update to release 4.4.8. - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code...

SUSE CVE-2026-70630

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

SUSE-SU-2026:3529-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: Update to release 4.4.8. - CVE-2026-8461: out-of-bounds write in the MagicYUV decoder can lead to denial of service or remote code execution bsc1269490. - CVE-2026-12706: heap use-after-free read in the RASC video decoder can lead to denial of...

JLSEC-2026-1184 FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability...

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlibdecomp functi...

Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport

...

Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

...

EUVD-2026-54162

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:3520-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3520-1 advisory. Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF an...