CVE-2026-102360: Out-of-bounds Read

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...

PT-2026-102624

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...

PT-2026-102625

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent he...

PT-2026-102609

Name of the Vulnerable Software and Affected Versions lib0 versions 0.2.1 through 0.2.117 lib0 versions prior to 1.0.0-rc.33 Description A missing bounds check in the binary decoder allows an unauthenticated remote peer to read adjacent process memory. The readUint8Array function fails to compare...

Amazon Linux 2 : crash (ALAS-2026-3937)

The version of crash installed on the remote host is prior to 8.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3937 advisory. A flaw was found in GDB's STABS debug format parser. Thereadmemberfunctions function in gdb/stabsread.c contains a linkedlist removal...

CVE-2026-102566: Out-of-bounds Write

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...

CVE-2026-102567: Out-of-bounds Read

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent he...

ALSA-2026:73425 Important: gdb security update

The GNU Debugger GDB allows debugging programs written in C, C++, Java, and other languages by executing them in a controlled fashion and then printing their data. Security Fixes: gdb: STABS debug format parser out-of-bounds write via crafted ELF binary CVE-2026-13732 For more details about the...

RHEL 8 : gdb (RHSA-2026:73425)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:73425 advisory. The GNU Debugger GDB allows debugging programs written in C, C++, Java, and other languages by executing them in a controlled fashion and then...

PT-2026-102787

Name of the Vulnerable Software and Affected Versions MobilityDB versions prior to 1.3.1 Description An out-of-bounds read exists in the MEOS binary and library WKB deserialization logic. Unprivileged database users can cause a remote denial-of-service condition, crashing the PostgreSQL backend...

Important: gdb security update

The GNU Debugger GDB allows debugging programs written in C, C++, Java, and other languages by executing them in a controlled fashion and then printing their data. Security Fixes: gdb: STABS debug format parser out-of-bounds write via crafted ELF binary CVE-2026-13732 For more details about the...

DEBIAN-CVE-2026-102010

A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading...

AZL-107979 CVE-2026-102010 affecting package gcc 13.2.0-7

A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading...

CVE-2026-102010

A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading...

CVE-2026-102010

A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading...

EUVD-2026-88443

A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading...

CVE-2026-102010 Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading...

Malicious code in nebula-llm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566 The npm package [email protected] ships a preinstall lifecycle script preinstall.cjs that embeds a 257KB Windows PE binary as a base64+zlib-compressed...

MAL-2026-17227 Malicious code in nebula-llm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566 The npm package [email protected] ships a preinstall lifecycle script preinstall.cjs that embeds a 257KB Windows PE binary as a base64+zlib-compressed...

CVE-2026-19444

A path traversal vulnerability exists in the Kubernetes kubectl client's kubectl cp command on Windows . When copying files from a container, kubectl executes tar inside the container to build an archive. If a malicious tar binary is present in the container, it can emit unexpected output, allowi...