Lexmark Printers Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2018-15520)

Various Lexmark devices have a Buffer Overflow vulnerability. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505905; scriptversion"1.2";...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Wavlink Wl-Nu516U1_Firmware

cve-id Donate Support the maintenance of this project wit...

PT-2026-64588

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack buffer overflow exists in the hid-goodix-spi driver. The function goodix hid set raw report utilizes a 128-byte stack buffer tmp buf to build a protocol frame, consisting of an...

CVE-2026-63887 scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf iscsiencodetextoutput concatenates "key=value\0" records into login-rspbuf, an 8192-byte kzallocMAXKEYVALUEPAIRS buffer allocated in iscsitallocloginsetupbuffer...

CVE-2026-63887 scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf iscsiencodetextoutput concatenates "key=value\0" records into login-rspbuf, an 8192-byte kzallocMAXKEYVALUEPAIRS buffer allocated in iscsitallocloginsetupbuffer...

GO-2026-5104 AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf

AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

EUVD-2026-38824

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in cephxdecrypt In cephxdecrypt, a part of the buffer p is interpreted as a cephxencryptheader, and the magic field of this struct is accessed. This happens without any guarantee that t...

CVE-2026-53022 platform/x86: dell-wmi-sysman: bound enumeration string aggregation

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: bound enumeration string aggregation populateenumdata aggregates firmware-provided value-modifier and possible-value strings into fixed 512-byte struct members. The current code bounds each individu...

DEBIAN-CVE-2026-53704

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using reskippascalstring without validating that offsets remain...

CVE-2026-11787

A flaw was found in 389 Directory Server. The ldaputf8prev function reads bytes before the start of a buffer without bounds checking, causing a heap buffer over-read in string filter parsing that may influence internal filter processing behavior...

USN-8387-1 inetutils vulnerabilities

It was discovered that the Inetutils telnet daemon incorrectly handled the CREDENTIALSDIRECTORY environment variable. An attacker could possibly use this issue to escalate privileges. CVE-2026-28372 It was discovered that the Inetutils telnet daemon did not properly validate buffer bounds when...

CVE-2026-10047 Out-of-bounds write in Napoca real-mode hook handler via guest-controlled SS:SP (VA-13905)

The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c. The handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without bounds validation. With...

CVE-2026-46230 drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Ipados

No d...

Astra Linux – Vulnerability in open-iscsi

A issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data. It...

CVE-2026-43618

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended...

CLSA-2026-1778260679 vim: Fix of 7 CVEs

CVE-2021-3875: fix mlget error after search with range; clamp ea-line2 to the buffer length in getaddress so out-of-range addresses do not produce an out-of-bounds read exdocmd.c, upstream patch 8.2.3489 - CVE-2022-4293: fix crash when dividing the largest negative integer by -1 in numdivide;...

PT-2026-37606

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the GHES/CPER logic of the Linux kernel regarding the handling of ARM processor CPER records. The system fails to detect when the section length is excessively large. ...

php: Fix of 4 CVEs

CVE-2018-14883: fix integer overflow leading to heap buffer overflow in exifthumbnailextract - CVE-2019-19246: fix heap buffer overflow in oniguruma strlowercasematch - CVE-2018-19518: disable imap rsh/ssh by default to prevent argument injection imap.enableinsecurersh INI added - CVE-2018-20783:...

CVE-2026-31708 smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2ioctlqueryinfo QUERYINFO path smb2ioctlqueryinfo has two response-copy branches: PASSTHRUFSCTL and the default QUERYINFO path. The QUERYINFO branch clamps qi.inputbufferlength to the server-report...