CVE-2026-56818 Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling...

SUSE CVE-2026-7867

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...

SUSE CVE-2026-18477

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

CVE-2026-20348

CVE-2026-20348 affects ClamAV’s XAR file format parser. The issue stems from improper boundary checks for XAR content during scanning, leading to memory corruption. An unauthenticated, remote attacker can submit a crafted XAR file to trigger the vulnerability, potentially causing the ClamAV scann...

CVE-2026-20345 ClamAV GPT File Format Processing Memory Corruption Vulnerability

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion...

CVE-2026-20345

ClamAV's GPT file format parser is affected by memory corruption due to improper endian conversion, causing an out-of-bounds write. An unauthenticated attacker can submit a crafted GPT file to a vulnerable ClamAV scanner, potentially terminating the scanning process and causing a DoS. CVSSv3.1 ba...

CVE-2026-20339 ClamAV PESpin File Format Processing Integer Overflow Vulnerability

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpi...

CVE-2026-20347 ClamAV Mach-O File Format Processing Memory Corruption Vulnerability

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-...

CVE-2026-20347

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-...

CVE-2026-20346 ClamAV PDF File Format Processing Memory Corruption Vulnerability

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

CVE-2026-20346

Summary: CVE-2026-20346 affects the PDF file format parser in ClamAV. The vulnerability arises from improper boundary checks during PDF content processing, leading to an out-of-bounds buffer read and memory corruption. Impact as described: An unauthenticated, remote attacker can submit a crafted ...

CVE-2026-20346

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF file...

CVE-2026-20338

CVE-2026-20338 affects ClamAV’s zip archive parser. The issue is due to improper memory handling when processing zip content, allowing an unauthenticated, remote attacker to trigger a memory double-free and cause the ClamAV scanning process to terminate, resulting in a DoS. Attacks can be perform...

CVE-2026-20338 ClamAV ZIP File Format Processing Memory Corruption Vulnerability

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this...

CVE-2026-20337

CVE-2026-20337 concerns ClamAV’s zip archive parser. The issue arises from improper boundary checks for content in zip files during scanning, which can trigger an out-of-bounds write. An unauthenticated, remote attacker could submit a crafted zip file for scanning, potentially causing the ClamAV ...

Directory Traversal

Overview github.com/go-git/go-git/plumbing is a highly extensible git implementation library written in pure Go. Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended...

CVE-2026-19206

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiverstopThreadless of the file src/sampledvalues/svsubscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be...

JLSEC-2026-1186 FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability...

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...

JLSEC-2026-1176 FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer...

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdecasf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtpasffixheader function fails to validate a minimum chunksize when...

JLSEC-2026-1192 FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write...

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode function fails to enforce...