87286 matches found
PT-2026-108683
Summary The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes. A malicious or compromised AMQP peer can send only a seven-byte body-frame header containing a large attacker-controlled uint32 payload length. The client allocates a slice of that...
PT-2026-108718
This update fixes the following issues: Release Notes Highlights: - Added a note about the SUSE Registry IP address change. - Update to SUSE Multi-Linux Manager 5.2.1 Security fixes Ubuntu 26.04 LTS Support Confidential Computing Attestation for IBM Z Series New uyuni-tftpd Container Monitoring:...
PT-2026-108717
This update fixes the following issues: Release Notes Highlights: - Added a note about the SUSE Registry IP address change. - Update to SUSE Multi-Linux Manager 5.2.1 Security fixes Ubuntu 26.04 LTS Support Confidential Computing Attestation for IBM Z Series New uyuni-tftpd Container Monitoring:...
PT-2026-108146
Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.5 MariaDB Connector/Node.js versions prior to 3.3.4 MariaDB Connector/Node.js versions prior to 3.4.7 MariaDB Connector/Node.js versions prior to 3.5.4 Description When encoding GeoJSON Polygon a...
CVE-2025-24813
CVE-2025-24813 — RCE por deserialización en Partial PUT de Apache Tomcat Severidad: Crítica CVSS 9.8 Autenticación requerida: Ninguna Afecta a: Apache Tomcat 9.0.0.M1 – 9.0.98 / 10.1.0-M1 – 10.1.34 / 11.0.0-M1 – 11.0.2 Parcheado en: Tomcat 9.0.99 / 10.1.35 / 11.0.3 Cómo funciona Apache Tomcat...
Security Bulletin: Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
Summary Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Ra...
bombini
Bombini: eBPF-based Security Monitoring and Sandboxing Agent Bombini is an eBPF-based security agent written entirely in Rust using the Aya library and built on LSM Linux Security Module BPF hooks. At its core, Bombini employs modular components called Detectors, each responsible for monitoring a...
Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
Summary Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage Ra...
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...
GHSA-X3Q2-H9HX-4R4J Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...
USTP-Secure
USTP USTP means UDP Speedy Transmission Protocol. USTP keeps the same authenticated transport model, but the project name is now simply USTP again. By default, USTP uses AEAD for DATA. It also supports an optional negotiated cleartext + HMAC mode for DATA, where payload bytes are visible on the...
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
Summary ImageSharp's TIFF CCITT Group 3 T4 encoder can write beyond its allocated compressed-data buffer when encoding narrow 1-bit images. The unchecked writes can corrupt process memory and terminate the process. This report concerns only the T4 CcittGroup3Fax encoder path. It replaces the prio...
GHSA-J9GM-C75J-XC9Q ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
Summary ImageSharp's TIFF CCITT Group 3 T4 encoder can write beyond its allocated compressed-data buffer when encoding narrow 1-bit images. The unchecked writes can corrupt process memory and terminate the process. This report concerns only the T4 CcittGroup3Fax encoder path. It replaces the prio...
GHSA-J3P4-WP97-RPH4 ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
Summary SixLabors.ImageSharp can terminate a process when an application decodes an attacker-supplied 32-bit floating-point TIFF as Image and applies HistogramEqualization. An IEEE positive-infinity TIFF sample reaches a non-finite or otherwise out-of-range HalfVector4 component, depending on the...
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
Summary SixLabors.ImageSharp can terminate a process when an application decodes an attacker-supplied 32-bit floating-point TIFF as Image and applies HistogramEqualization. An IEEE positive-infinity TIFF sample reaches a non-finite or otherwise out-of-range HalfVector4 component, depending on the...
coruna
Coruna — iOS Safari Sandbox Escape & Post-Exploitation C2 Fram...
CVE-2026-42617
A flaw was found in NTFS-3G. A heap-based buffer overflow occurs when expanding a directory on a specially crafted NTFS filesystem image, such as during file creation. A local attacker can exploit this vulnerability to corrupt memory within the privileged binary, potentially leading to arbitrary...
CVE-2026-42618
A flaw was found in ntfs-3g. A local attacker could achieve privilege escalation or cause a denial of service DoS by mounting or accessing a specially crafted NTFS filesystem image. When the privileged binary reads a malicious file from the image, a heap-based buffer overflow occurs in the...
Security Bulletin: Multiple vulnerabilities affect IBM Cloud Pak System
Summary Multiple vulnerabilities affect IBM Cloud Pak System. These vulnerabilties have been addressed with IBM Cloud Pak System 2.3.5.1. Vulnerability Details CVEID:CVE-2025-15467 DESCRIPTION: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD...