CVE-2026-44031

Uncontrolled recursion in DcmSequenceOfItems::read and DcmItem::read in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service stack exhaustion and process crash via a DICOM dataset containing deeply nested sequences SQ elements. The datase...

RLSA-2026:77359 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

vim security update

An update is available for vim. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

Rocky Linux 9 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc (crlsa-2026_75768)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675768 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly from...

CVE-2026-106428: Out-of-bounds Read

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the...

ROS-20261008-73-0236

The vulnerability of the mctu232readintcallback function in the drivers/usb/serial/mctu232.c file of the Linux device driver for USB devices relates to the use of an uninitialized resource. Exploiting this vulnerability could allow a attacker to cause a service failure...

CVE-2026-106438: Incorrect Calculation

An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application,...

CVE-2026-106437: Integer Underflow (Wrap or Wraparound)

The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an...

CVE-2026-106435: Out-of-bounds Read

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106431: Out-of-bounds Write

An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent...

CVE-2026-106430: Interpretation Conflict

The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an...

PT-2026-108198

Name of the Vulnerable Software and Affected Versions MongoDB Python Driver affected versions not specified Description The binary accelerator in the driver can perform an out-of-bounds read when decoding malformed BSON that contains a truncated regular-expression element missing a trailing NUL...

PT-2026-108134

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description An out-of-bounds read occurs during SCRAM authentication response parsing when the driver processes a malformed server-final message. This allows the system to read one byte beyond a...

PT-2026-108136

Name of the Vulnerable Software and Affected Versions MongoDB C++ Driver affected versions not specified Description The MongoDB C++ Driver discards content following an embedded NUL byte in specific field and collection names processed by the collection API. This behavior allows the driver and t...

PT-2026-108141

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description An incorrect calculation in Decimal128 string parsing allows the driver to accept certain over-precision inputs containing leading zeros instead of rejecting them. This results in th...

PT-2026-108140

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. This allows subsequent append or comparison operations to underfl...

PT-2026-108137

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description An off-by-one error exists in the BSON bulk document writer. This occurs when a document ends at a specific buffer boundary, causing the writer to write one zero byte immediately pas...

RockyLinux 8 : vim (RLSA-2026:77359)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:77359 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly fr...

AlmaLinux 8 : vim (ALSA-2026:77359)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:77359 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly fro...

CVE-2026-107202

A command injection vulnerability exists in the h-ui version v0.0.25 and below administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule...