CVE-2026-40468

A flaw was found in gawk. An integer overflow vulnerability could allow a local attacker to cause memory exhaustion, leading to a denial of service. This flaw may also enable an attacker to corrupt gawk's internal memory, potentially leading to system instability. Mitigation Do not execute...

firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been...

firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of...

CVE-2026-67300

A flaw was found in FreeRDP. This client-side heap use-after-free vulnerability occurs when a malicious or compromised Remote Desktop Protocol RDP server sends specially crafted update orders. The async update message proxy incorrectly handles memory by shallow-copying structures with pointers th...

CVE-2026-6695

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA Paint Shop Pro Array image file. This vulnerability, a heap-based out-of-bounds write in the decodelzss function of the PAA file format plugin, allows data to be written beyond t...

CVE-2026-18582

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function ReportingRCBWriteAccessHandler of the file src/iec61850/server/mmsmapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not ...

CVE-2026-20473

The CVE-2026-20473 entry describes a memory corruption via use-after-free in the display path that could enable local privilege escalation if the attacker already holds System privileges. Exploitation reportedly does not require user interaction. The public documents note a patch ID: ALPS11019722...

EUVD-2026-52062

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019722; Issue ID: MSV-7759...

glib: GLib: Buffer underflow in GVariant parser leads to heap corruption

A flaw was found in GLib Gnome Lib. This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings...

EUVD-2026-52017

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function ReportingRCBWriteAccessHandler of the file src/iec61850/server/mmsmapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not ...

CVE-2026-18582

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function ReportingRCBWriteAccessHandler of the file src/iec61850/server/mmsmapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not ...

CVE-2026-64446

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. A local user can exploit this vulnerability by supplying a crafted Wi-Fi Protected Access WPA Information Element IE during a connection request. This can lead to a one-byte heap buffer overflow, potentially causing memory corruption...

CVE-2026-64386

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the queryinfo replay mechanism attempts to free a response buffer that has already been released. This can happen if an error occurs during the initialization of an SMB2...

OESA-2026-3189 python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816 Security Fixes: Pillow is a Python imaging library. Prior to 12.3.0, whe...

OESA-2026-3187 python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816 Security Fixes: Pillow is a Python imaging library. Prior to 12.3.0, whe...

CVE-2026-67300

FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOWSTATEORDER and NOTIFYICONSTATEORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies...

CVE-2026-67300

CVE-2026-67300 – FreeRDP before 3.29.0 : A client-side heap use-after-free in the async update message proxy affects RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. If a malicious RDP server sends crafted update orders, the proxy shallow-copies structures containi...

CVE-2026-67299

FreeRDP before 3.29.0 is affected by a client-side heap use-after-free in the async update path when WINDOW_ICON_ORDER is processed. In update_message_WindowIcon(), a shallow CopyMemory overwrites a newly allocated lParam->iconInfo with a parser-owned windowIcon->iconInfo pointer; after the...

CVE-2026-67299 FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...

CVE-2026-67299 FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message

FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp /async-update. In updatemessageWindowIcon a shallow CopyMemory overwrites a freshly allocated lParam-iconInfo with the parser-owned...