UBUNTU-CVE-2026-71870

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/cmap.py function parsebfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed...

CVE-2026-71870

A flaw was found in pypdf, a pure-python PDF library. A remote attacker could exploit this vulnerability by providing a specially crafted PDF file. When the library attempts to parse unusually large font /ToUnicode CMap streams during text extraction, it can lead to excessive memory consumption...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the cfhddecode transform-type-2 reconstruction path in the native CFHD decoder. An attacker can corrupt heap memory by supplying a crafted AVI file during stream probing that makes the decoder process a non-Bayer...

EUVD-2026-54615

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/cmap.py function parsebfrange parses unusually large source-code or destination-string tokens in a font /ToUnicode CMap during text extraction. This issue is fixed...

CVE-2026-65819

CVE-2026-65819 affects gopacket before version 1.7.0, where multiple layer decoders may read attacker-controlled lengths, counts, or offsets before validating buffers. A crafted packet decoded via DecodingLayerParser or DecodeFromBytes can trigger an unrecovered panic, enabling unauthenticated re...

CVE-2026-65819 gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

EUVD-2026-54600

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/font.py function Font.collectcidcharacterwidths expands unusually large CID font /W width ranges or excessive width entries during text extractio...

Inefficient Algorithmic Complexity

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the languageDetector middleware. An attacker can cause excessive CPU consumption and block unrelated requests by sending crafted language tags with ...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the rsccdecodeframe path in libavcodec/rscc.c. An attacker can disclose heap memory contents by supplying a crafted RSCC video file whose compressed tile decompresses to fewer bytes than the tile geomet...

CVE-2026-20348

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR file...

DEBIAN-CVE-2026-20348

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR file...

CVE-2026-20338

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this...

DEBIAN-CVE-2026-20339

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpi...

CVE-2026-20337

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition...

SUSE CVE-2026-70628

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...

CVE-2026-20348 ClamAV XAR File Format Processing Memory Corruption Vulnerability

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR file...

CVE-2026-20348

CVE-2026-20348 affects ClamAV’s XAR file format parser. The issue stems from improper boundary checks for XAR content during scanning, leading to memory corruption. An unauthenticated, remote attacker can submit a crafted XAR file to trigger the vulnerability, potentially causing the ClamAV scann...

EUVD-2026-54508

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR file...

CVE-2026-20345 ClamAV GPT File Format Processing Memory Corruption Vulnerability

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion...

CVE-2026-20347 ClamAV Mach-O File Format Processing Memory Corruption Vulnerability

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-...