CVE-2026-75090

Mistral.rs up to v0.8.22 has an out-of-bounds read in convert_gguf_to_hf_tokenizer (file: mistralrs-core/src/gguf/gguf_tokenizer.rs) triggered by crafted eos_token_id/bos_token_id/unknown_token_id arguments. The exploit is public (SSVC Exploitation: poc); upgrading to v0.8.23 (patch commit cd5297...

CVE-2026-75090

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

CVE-2026-75090 EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-bounds

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

CVE-2026-75090 EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-bounds

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

EUVD-2026-60480

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to cause unexpected system termination or read kernel memory...

PT-2026-77138

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse...

Linux Distros Unpatched Vulnerability : CVE-2026-72029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: wwan: iosm: bound device offsets in the MUX downlink decoder muxdladbdecode walks a chain of aggregated datagram tables using offsets and lengths taken fro...

Linux Distros Unpatched Vulnerability : CVE-2026-74332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: amd: acp-sdw-sof: Bound DAI link iteration createsdwdailinks walks sofdais until it finds an entry with initialised cleared, but sofdais is allocated with...

VMware Fusion 25.x < 26.0.0 Information Disclosure (VMSA-2026-0006)

The version of VMware Fusion installed on the remote macOS host is 25.x 25H2 prior to 26.0.0 26H1. It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory: - VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor wit...

AlmaLinux 9 : gstreamer1-plugins-good (ALSA-2026:55436)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55436 advisory. gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write CVE-2026-73433...

Linux Distros Unpatched Vulnerability : CVE-2026-74300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a...

RHEL 9 : gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free (RHSA-2026:55865)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55865 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package...

Linux Distros Unpatched Vulnerability : CVE-2026-72297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATMANYCLASS in checktp. SOATMQOS stores the supplied QoS after...

Linux Distros Unpatched Vulnerability : CVE-2026-72400

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - seg6: validate SRH length before reading fixed fields seg6validatesrh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-74292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: tegra: tegra210ahub: Validate written enum value tegraahubputvalueenum reads e-valuesitem0 before checking whether item0 is within the enum item range. Th...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2045)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2045 advisory. In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix race condition during PASID entry replacement CVE-2026-45945 In the Linux kernel, the following vulnerabilit...

PT-2026-77161

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat smplooped in src/load pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat loops, so an index of zero reads pat loops-1, one byt...

PT-2026-77336

Zephyr's Precision Time Protocol receive handler ptp msg post recv in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptp msg type msg-header.type major sdo id & 0xF, range 0-15 and uses it to index the msg size table. That table only defines entries up to PTP MSG...

Linux Distros Unpatched Vulnerability : CVE-2026-72076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the...

AlmaLinux 10 : gstreamer1-plugins-good (ALSA-2026:55434)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55434 advisory. gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write CVE-2026-73433...