CVE-2026-49837

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded b...

The vulnerability in the `qcom_geni_serial_handle_tx_dma()` function of the `drivers/tty/serial/qcom_geni_serial.c` driver of the TTY console driver in the Linux kernel’s serial port allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the qcomgeniserialhandletxdma function in the drivers/tty/serial/qcomgeniserial.c driver of the TTY console driver in the Linux kernel’s serial port is related to a violation of the buffer boundary. Exploiting this vulnerability could allow an attacker to compromise the...

DEBIAN-CVE-2026-68433

In the Linux kernel, the following vulnerability has been resolved: libceph: bound getversion reply decode to front len handlegetversionreply uses msg-frontalloclen as the decode boundary for MONGETVERSIONREPLY. That is the size of the reused reply buffer, not the number of bytes actually receive...

EUVD-2026-57041

In the Linux kernel, the following vulnerability has been resolved: libceph: bound getversion reply decode to front len handlegetversionreply uses msg-frontalloclen as the decode boundary for MONGETVERSIONREPLY. That is the size of the reused reply buffer, not the number of bytes actually receive...

CVE-2026-68433 libceph: bound get_version reply decode to front len

In the Linux kernel, the following vulnerability has been resolved: libceph: bound getversion reply decode to front len handlegetversionreply uses msg-frontalloclen as the decode boundary for MONGETVERSIONREPLY. That is the size of the reused reply buffer, not the number of bytes actually receive...

CVE-2026-68433

In the Linux kernel, the following vulnerability has been resolved: libceph: bound getversion reply decode to front len handlegetversionreply uses msg-frontalloclen as the decode boundary for MONGETVERSIONREPLY. That is the size of the reused reply buffer, not the number of bytes actually receive...

Linux Distros Unpatched Vulnerability : CVE-2026-68433

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: bound getversion reply decode to front len handlegetversionreply uses msg-frontalloclen as the decode boundary for MONGETVERSIONREPLY. That is the size...

PT-2026-70947

In the Linux kernel, the following vulnerability has been resolved: libceph: bound get version reply decode to front len handle get version reply uses msg-front alloc len as the decode boundary for MON GET VERSION REPLY. That is the size of the reused reply buffer, not the number of bytes actuall...

CVE-2026-51272

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2026-51270

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

EUVD-2026-49864

schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the HTTP request header construction logic. The application dynamically splices attacker-controlled host name, path, query string, and multiple HTTP header fields into a fixed psptr heap buffer without proper size...

The vulnerability of the `nvme_dbbuf_set()` function in the driver/nvme/host/pci.c module of the Linux NVME driver allows a attacker to escalate their privileges or execute arbitrary code.

The vulnerability of the nvmedbbufset function in the drivers/nvme/host/pci.c file of the NVME kernel driver in Linux is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability can allow an attacker to increase their privileges or execute arbitrary code...

The vulnerability of the `nikon_load_padded_packed_raw()` function in the `src/decoders/decoders_libraw.cpp` file, which is part of the LibRaw image processing library, allows a hacker to trigger a service failure.

The vulnerability of the nikonloadpaddedpackedraw function in the src/decoders/decoderslibraw.cpp file, which is part of the LibRaw image processing library, relates to the situation where the operation’s output goes beyond the buffer boundaries in memory when processing the loadflags and rawwidt...

ROS-20260715-73-0009

The vulnerability of the ajpparsedata function in the Apache HTTP Server is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to disclose confidential information remotely...

BIT-PYTHON-MIN-2026-3298 Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes

The method "sockrecvfrominto" of "asyncio.ProacterEventLoop" Windows only was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected...

UBUNTU-CVE-2026-14612

Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized response from a configured external OAuth2/OIDC Identity Provider. An attacker who controls or can man-in-the-middle the IdP endpoint may b...

CVE-2026-44042

UltraVNC repeater up to version 1.8.2.2 contains an off-by-one bug in the Base64 decode helper used for HTTP Basic authentication. In repeater/webgui/webutils.c:817, wi_uudecode() uses a strict > check to ensure output fits the buffer, but the correct condition is >=. When strlen(authdata) ...

The vulnerability of the decode_dlta() function in the libavcodec/rasc.c file of the RASC video decoder from the FFmpeg multimedia library allows a attacker to cause a service failure.

The vulnerability of the decodedlta function in the libavcodec/rasc.c file of the RASC video decoder from the FFmpeg multimedia library is related to buffer overflow attacks. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability in the driver/multi-touch.c module of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability in the driver/multi-touch.c module of the Linux operating system is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260615-73-0019

The vulnerability of the freerdpimagecopyfromicondata function libfreerdp/codec/color.c in the RDP client FreeRDP arises due to an operation being executed outside the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to cause service failure...