CVE-2026-0864 affecting package python3 for versions less than 3.12.9-14

CVE-2026-0864 affecting package python3 for versions less than 3.12.9-14. A patched version of the package is available...

CVE-2026-12003 affecting package python3 for versions less than 3.12.9-14

CVE-2026-12003 affecting package python3 for versions less than 3.12.9-14. A patched version of the package is available...

CVE-2026-3087 affecting package python3 for versions less than 3.12.9-14

CVE-2026-3087 affecting package python3 for versions less than 3.12.9-14. A patched version of the package is available...

CVE-2026-55995 affecting package isns-utils for versions less than 0.102-2

CVE-2026-55995 affecting package isns-utils for versions less than 0.102-2. A patched version of the package is available...

CVE-2026-44944 affecting package iscsi-initiator-utils for versions less than 2.1.12-1

CVE-2026-44944 affecting package iscsi-initiator-utils for versions less than 2.1.12-1. An upgraded version of the package is available that resolves this issue...

gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

...

CVE-2026-19341 UTT HiPER 1200GW pptpSrvGlobalConfig strcpy stack-based overflow

A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpSrvGlobalConfig. Such manipulation of the argument EncryptionMode leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has...

JLSEC-2026-1226

In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers...

SUSE SLES15 Security Update : libssh2_org (SUSE-SU-2026:3526-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3526-1 advisory. - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598:...

CVE-2026-71958

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

CVE-2026-71958

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

CVE-2026-71958 D-Link DWR-M961 Buffer Overflow via quicksetup.cgi

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

CVE-2026-71958

The CVE-2026-71958 entry concerns D-Link DWR-M961 devices (hardware version C1, software 1.1.2_C1_202602110044). The vulnerability is a buffer overflow in the quicksetup.cgi interface. An unauthenticated remote attacker can supply oversized inputs to the test4, ssid2, and username fields to cause...

CVE-2026-71957

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist.name field and execute arbitrary commands by crafting a specific...

CVE-2026-71957

D-Link DWR-M961 devices (hardware version C1, software 1.1.2_C1_202602110044) contain a buffer overflow in the app.cgi interface. A remote attacker can write an overly long string to netAcc.addlist[].name to execute arbitrary commands or crash the device. Root cause: improper input handling in ap...

EUVD-2026-54809

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist.name field and execute arbitrary commands by crafting a specific...

CVE-2026-42170

A heap-based buffer overflow vulnerability exists in the GIMP DDS DirectDraw Surface file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel bpp value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the...

CVE-2026-42170 Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)

A heap-based buffer overflow vulnerability exists in the GIMP DDS DirectDraw Surface file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel bpp value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the...

CVE-2026-42170

A heap-based buffer overflow vulnerability exists in the GIMP DDS DirectDraw Surface file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel bpp value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the...

CVE-2026-8798 Native entropy source retries the CPU entropy instructions without limit

In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...