SUSE CVE-2026-19023

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

SUSE CVE-2026-42169

A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...

The vulnerability of the sss_nss_protocol_parse_addr() function in the NSS responder of the access control service for remote directories and the SSHD authentication mechanism allows a attacker to cause a service failure.

The vulnerability of the sssnssprotocolparseaddr function in the NSS responder component of the access control service for remote directories and the SSHD authentication mechanism is related to the issue of the operation being executed outside of the buffer. Exploiting this vulnerability could...

Linux Distros Unpatched Vulnerability : CVE-2026-70632

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allow...

Oracle Linux 10 : kernel (ELSA-2026-49871)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49871 advisory. - procfs: fix possible double mmput in doprocmapquery Rafael Aquini RHEL-189665 CVE-2026-23199 - procfs: avoid fetching build ID while holding VMA lo...

The nothings stb TrueType library, up to version 1.26, contains a heap buffer overflow vulnerability

Overview A heap buffer overflow vulnerability exists in the stb TrueType library created by nothings. Exploitation of this vulnerability can occur when handling malformed font data and may lead to both Denial of Service DoS and Information Disclosure. Description The nothings stb repository,...

UBUNTU-CVE-2026-70631

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates...

Linux Distros Unpatched Vulnerability : CVE-2025-49506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking thei...

Linux Distros Unpatched Vulnerability : CVE-2026-43629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the statereaddata function computes...

Linux Distros Unpatched Vulnerability : CVE-2026-71851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom...

UBUNTU-CVE-2026-70632

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode function fails to enforce...

UBUNTU-CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

📄 DCMTK 3.7.0 DICOMDIR Icon Integer Overflow

DCMTK DICOM ToolKit version 3.7.0 has an integer overflow in the PGM image size calculation that results in an undersized heap allocation. The subsequently unchecked conversion of the image dimensions from unsigned int to Uint16 causes the image scaler to process a much larger image than was...

Vulnerability of the websocket_read_wstream() function in the libfreerdp/core/gateway/websocket.c file of the RDP client FreeRDP, which allows a hacker to disclose sensitive information or cause service failure.

The vulnerability of the websocketreadwstream function in the libfreerdp/core/gateway/websocket.c file of the RDP client FreeRDP is related to improper handling of invalid length parameters. Exploiting this vulnerability could allow an attacker to disclose sensitive information or cause service...

The vulnerability of the tls_match_hostname() function in the libfreerdp/crypto/tls.c file of the RDP client FreeRDP allows a attacker to replace the RDP server.

The vulnerability of the tlsmatchhostname function in the libfreerdp/crypto/tls.c file of the RDP client FreeRDP is related to errors in the certificate authentication process. Exploiting this vulnerability could allow an attacker to replace the RDP server remotely...

CVE-2026-43629

llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the statereaddata function computes write size without overflow checking, allowing attackers with write access to the slotsavepath directory to corrupt heap memory. Attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-70631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in...

Linux Distros Unpatched Vulnerability : CVE-2026-32327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the...

Linux Distros Unpatched Vulnerability : CVE-2026-70630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder...

AlmaLinux 10 : kernel (ALSA-2026:49871)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:49871 advisory. kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 kernel: procfs: avoid fetching build ID while...