CVE-2026-55645

CVE-2026-55645 affects xrdp (open source RDP server). The vulnerability is an out-of-bounds read in the processing of Client Control PDUs during the RDP connection sequence, caused by insufficient length validation in the parser before reading data from the network stream. This can allow a remote...

CVE-2026-55645 xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control)

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...

CVE-2026-35217 NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read

NanoMQ contains a protocol-semantics flaw in its MQTT v5 SUBSCRIBE handling: if a subscription entry is missing the final 1-byte Subscription Options field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length...

CVE-2026-35590

CVE-2026-35590 affects libvips’ EXIF decoder. Versions

CVE-2026-35590 Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in...

CVE-2026-53402

A flaw was found in the Linux kernel's framebuffer console fbcon component. When the fbcondosetfont function fails, the system's error handling does not correctly restore the font state, leading to a desynchronized terminal. A local user can exploit this by providing character indices that cause ...

CVE-2026-26197 Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the...

CVE-2026-26197 Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the...

CVE-2026-26197

CVE-2026-26197 affects HDF5 data types where an array datatype’s full size, element count, and element size must align (dt->shared->size, dt->shared->u.array.nelem, dt->shared->parent->shared->size). If a maliciously altered file corrupts any one of these so that element s...

CVE-2026-53387

A flaw was found in the Linux kernel's veml6075 light sensor driver. The driver performs an out-of-bounds array access when processing certain index values from the VEML6075CONFIT register. This issue could potentially lead to system instability or a denial of service if triggered by a faulty...

CVE-2026-64084

A flaw was found in the Linux kernel's hardware monitoring hwmon subsystem, specifically within the pmbus/adm1266 driver. This vulnerability involves an out-of-bounds memory access, where the system attempts to read or write data beyond the allocated memory region. A local attacker could exploit...

CVE-2026-16254

A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the scanner. If that panic is not recovered, the Clair indexer process can crash, leading to a denial of service...

CVE-2026-15813

A vulnerability was found in the network packet de-fragmentation engine of kronosnet Version affected = 1.34. The internal reassembly code does not properly validate sequence numbers of incoming payload fragments. An attacker can exploit this lack of verification by transmitting malformed packets...

CVE-2026-64126

A flaw was found in the Linux kernel's Bluetooth Management MGMT subsystem. The handler for the MGMTOPADDEXTADVDATA command does not correctly validate the lengths of extended advertising data and scan response data against the overall command payload. This oversight allows a local attacker with...

netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

CVE-2026-64133

A flaw was found in the Linux kernel, specifically within the Advanced Linux Sound Architecture ALSA asihpi component. This vulnerability occurs because a function designed to retrieve cached information does not properly check the boundaries of an array it is accessing. This oversight could allo...

CVE-2026-16254 Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parser

A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the scanner. If that panic is not recovered, the Clair indexer process can crash, leading to a denial of service...

CVE-2026-16254

CVE-2026-16254 affects claircore’s apk package scanner, where malformed package-database data in a container layer can trigger an out-of-bounds access that panics the scanner. If the panic is not recovered, the Clair indexer process can crash, resulting in a denial of service. The available docum...

CVE-2026-16254

A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the scanner. If that panic is not recovered, the Clair indexer process can crash, leading to a denial of service...

EUVD-2026-45900

A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the scanner. If that panic is not recovered, the Clair indexer process can crash, leading to a denial of service...