CVE-2026-98892

The Linux kernel contains a vulnerability in the arm_scmi firmware component. The BASE_ERROR_EVENT carries a variable number of message reports, where the count is encoded in the error_status . The notification parser incorrectly used this count without verifying if the received payload contained...

CVE-2026-98892 firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate BASEERROREVENT payload size BASEERROREVENT carries a variable number of message reports, with the count encoded in errorstatus. The notification parser used that count without checking whether the...

CVE-2026-98889 wifi: iwlwifi: mvm: fix sched scan IE sizing

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

EUVD-2026-108683

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98889

The Linux kernel 's iwlwifi driver contains a vulnerability where scheduled scans built probe requests before the iwl_mvm_scan_fits() check. This allowed oversized Information Elements (IEs) to be copied into a fixed preq buffer without prior length validation . To resolve this, the driver was up...

CVE-2026-98889 wifi: iwlwifi: mvm: fix sched scan IE sizing

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98882 media: chips-media: wave5: Add range checks for dec_output_info

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

CVE-2026-98882 media: chips-media: wave5: Add range checks for dec_output_info

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

CVE-2026-98882

The Linux kernel contains a vulnerability in the chips-media wave5 driver. If the driver's dec_output_info contains invalid data, it can result in a buffer overflow where the driver writes into invalid memory. Specifically, the wave5_vpu_dec_get_output_info() function in drivers/media/platform/ch...

EUVD-2026-108676

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

CVE-2026-115723

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and...

CVE-2026-115723 Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and...

EUVD-2026-108711

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and...

CVE-2026-115723

Snap7 versions through 1.4.3 contain an out-of-bounds write vulnerability in the passive partner component. A malicious active partner connecting from a configured peer address can overflow application buffers by declaring an unvalidated BSend total length of up to 65535 bytes while sending a sho...

CVE-2026-115723 Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to 65535 bytes and...

Security update for gimp

This update for gimp fixes the following issues: CVE-2026-82328: undersized palette memory allocations in the ICO loader can cause heap out-of-bounds reads bsc1277618. CVE-2026-82343: improper channel-count handling in the PSD loader can cause heap and stack out-of-bounds reads bsc1277622...

baron-samedit

Baron Samedit PoC Description This is a Proof-of-Concept PoC exploit for the Baron Samedit vulnerability CVE-2021-3156 tested on Ubuntu 20.04 with sudo version 1.8.31 and glibc version 2.31. The exploit leverages a heap-based buffer overflow in sudo's handling of command-line arguments when using...

Exploit for CVE-2026-112403

CVE-2026-112403: Pillow Heap Buffer Overflow via Lossless JPEG...

flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

An update is available for libreoffice, librepository, pentaho-libxml, libfonts, pentaho-reporting-flow-engine, libbase, libformula, liblayout, libloader, flute, libserializer. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

RLSA-2026:88164 Important: flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac security, bug fix, and enhancement update

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fixes: libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion CVE-2026-63276...