CVE-2026-68229

In the Linux kernel, the following vulnerability has been resolved: media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 refpiclist0/refpiclist1 entries from the stateless slice control and later uses their indices to look up decode-dpb in cedruswritereflist. Rejecting...

CVE-2026-68255

Summary: CVE-2026-68255 affects the Linux kernel DRM/virtio EDID handling. The function virtio_get_edid_block() validates reads only against the device-supplied resp->size, not against the fixed-size resp->edid array. An attacker-controlled virtio-gpu backend can advertise a large size with...

kernel: smb: client: fix OOB reads parsing symlink error response

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote, untrusted server could send a specially crafted symlink error response, leading to an out-of-bounds read vulnerability. This could result in the disclosure of sensitive information from the kernel's memory to a loca...

Astra Linux – Vulnerability in Squid

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid was vulnerable to out-of-bound reads when handling ICP traffic. This issue allowed a remote attacker to access small amounts of memory that might contain sensitive information, by responding with...

EUVD-2026-54987

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer asfdemux when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause...

CVE-2026-19389

GStreamer gst-plugins-ugly asfdemux (ASF demuxer) has multiple integer overflow/underflow issues when parsing header objects from crafted ASF/WMV/WMA files. Insufficient validation of length/size can bypass bounds checks and trigger out-of-bounds heap reads, leading to application crash, denial o...

EUVD-2026-54532

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-...

CVE-2026-49746

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages. Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages...

CVE-2026-5855

Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...

SUSE SLES15: libpcp-devel / libpcp3 / libpcp_gui2 / libpcp_import1 / libpcp_mmv1 / etc (SUSE-SU-2026:3506-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3506-1 advisory. - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot...

Security update for pcp

This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...

Security update for pcp

This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...

SUSE-SU-2026:3507-1 Security update for pcp

This update for pcp fixes the following issues: - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. - CVE-2026-16527: missing...

Security update for pcp

This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...

SUSE-SU-2026:3506-1 Security update for pcp

This update for pcp fixes the following issues: - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. - CVE-2026-16527: missing...

Security update for pcp

This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...

gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a...

Security update for xen

This update for xen fixes the following issues: CVE-2026-42493: x86 shadow paging is deprecated bsc1271528. CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling bsc1271530. CVE-2026-62426,CVE-2026-62427: sysctl and platform-op...

CVE-2026-58160 Apache Traffic Server: Out-of-bounds reads while parsing DNS responses

Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

SUSE SLED15: glib2-devel / glib2-lang / glib2-tools / libgio-2_0-0 / etc (SUSE-SU-2026:3341-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3341-1 advisory. - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read...