CVE-2026-109265: Out-of-bounds Read

ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termination in XMP profiles. Attackers can supply a crafted image containing a malformed XMP profile to trigger the over-read and crash...

CVE-2026-109281: Out-of-bounds Read

ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap...

PT-2026-110672

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description An integer truncation issue exists in the license check stream length function. A malicious RDP server can exploit this by sending a crafted SERVER LICENSE REQUEST containing a large scopeCount...

CVE-2026-103658: Heap-based Buffer Overflow

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

CVE-2026-108914: Buffer Copy without Checking Size of Input

A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used...

CVE-2026-109255: Heap-based Buffer Overflow

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...

PT-2026-110962

Name of the Vulnerable Software and Affected Versions GNU Aspell versions prior to 0.60.8.3 Description A heap-based buffer overflow write exists in the read-only dictionary loader. The String::reserve function in common/string.hpp performs a capacity check using a signed integer ints + 1, which...

ALSA-2026:80498 Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

CVE-2026-109256: Heap-based Buffer Overflow

FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR pngwritedata callback that writes past the buffer after a realloc failure. A malicious RDP clipboard peer can supply a large CFDIB image that triggers out-of-bounds memcpy during PNG conversion, causing a client crash...

CVE-2026-109273: Use of Uninitialized Resource

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a buffer one byte longer than the data it decoded. Attackers can supply a crafted PostScript file to expose a single uninitialized byte of memory conten...

ALSA-2026:80497 Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

PT-2026-110667

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description A heap buffer overflow occurs in the collect keys function during PKCS11 key enumeration. Local attackers can exploit this by using smartcard tokens that present more than 64 public key objects...

CVE-2026-109250: Improper Validation of Array Index

FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collectkeys that allows local attackers to write past the fixed 64-entry keys array during PKCS11 key enumeration. Attackers controlling smartcard tokens can present more than 64 public key objects across multiple slots ...

Important: parted

Issue Overview: heap buffer overflow in initfats / fattableread NOTE: https://alioth-lists.debian.net/pipermail/parted-devel/2026-September/006032.html CVE-2026-89085 heap buffer overflow in duplicatelegacyrootdir NOTE:...

Important: parted

Issue Overview: heap buffer overflow in initfats / fattableread NOTE: https://alioth-lists.debian.net/pipermail/parted-devel/2026-September/006032.html CVE-2026-89085 heap buffer overflow in duplicatelegacyrootdir NOTE:...

Important: rpcbind

Issue Overview: A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with rpcinfo -l, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server...

ALSA-2026:80817 Important: rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fixes: rsyslog: A configuration-dependent issue in rsyslog's optional imptc...

ROS-20261012-73-0052

The vulnerability of the nfnlcthelperdumptable function in the net/netfilter/nfnetlinkcthelper.c module of the netfilter component of the Linux operating system is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to caus...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-4236)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server:...

Oracle Linux 8 : kernel (ELSA-2026-77498)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-77498 advisory. - svcrdma: Reject inline replies that overflow the pull-up buffer Roberto Bergantinos Corpas RHEL-187743 CVE-2026-89530 - packet: use consistent...