SUSE CVE-2026-16423

Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-16424

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-64831 FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vpsnumhrdparameter...

CVE-2026-64831 FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vpsnumhrdparameter...

EUVD-2026-47747

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in...

CVE-2026-64830 FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in...

CVE-2026-64830

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in...

CVE-2026-40691

A flaw was found in Unbound, a domain name system DNS resolver. When Unbound is configured with DNSCrypt support, a remote attacker could send a specially crafted DNSCrypt query over TCP. This malicious query could cause a memory error, leading to a server crash and a Denial of Service DoS. This...

USN-8477-3: tar regression

USN-8477-1 fixed a vulnerability in tar. That fix was incomplete and could cause tar to fail to extract old archives that recorded a nonzero size for directory entries, resulting in a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was...

Security update for ImageMagick

This update for ImageMagick fixes the following issues CVE-2026-56375: possible memory leak in ASHLAR coder when action fails bsc1271495. CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title bsc1271496. CVE-2026-61859: policy bypass in script operation due to missing chec...

unbound: NLnet Labs Unbound: Denial of Service via crafted DNS glue records

A flaw was found in Unbound. A remote malicious actor can exploit a vulnerability by controlling a DNS delegation that returns specific glue records. This can cause Unbound to repeatedly clear its DNS caches, leading to a continuous Denial of Service DoS for DNS resolution...

unbound: Unbound: Denial of Service via crafted DNS responses with expired records

A flaw in Unbound allows a remote attacker controlling a delegated domain to trigger a NULL pointer dereference and crash the daemon. Exploitation occurs when serve-expired: yes and specific response-ip or RPZ rules are configured, resulting in a denial of service...

CVE-2026-13036

A flaw was found in Blink, a rendering engine used in Google Chrome. This vulnerability, a 'use after free' error, allows a remote attacker to execute arbitrary code within the browser's security sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page, leading to a...

EUVD-2026-47695

diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted...

CVE-2026-53910 Heap-based Buffer Overflow in GNU diffutils

diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted...

CVE-2026-13037

A flaw was found in the WebView component of Google Chrome on Android. This vulnerability, known as a use-after-free, occurs when a program attempts to use memory after it has been freed, which can lead to unpredictable behavior. A local attacker could exploit this by tricking a user into opening...

CVE-2026-13034

A flaw was found in Google Chrome's Passwords feature. A remote attacker could exploit this vulnerability by compromising the browser's rendering engine and then using a specially designed web page. This could allow the attacker to bypass security measures designed to isolate websites, potentiall...

CVE-2026-16270

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4...

CVE-2026-13022

A flaw was found in Google Chrome's Autofill feature. A remote attacker, after compromising the browser's renderer process, could exploit an inappropriate implementation to leak sensitive data from other websites. This vulnerability is triggered by a specially crafted HTML page, leading to...

USN-8583-1: GIFLIB vulnerabilities

It was discovered that GIFLIB incorrectly handled certain GIF image files. If a user or automated system were tricked into opening a specially crafted GIF file, a remote attacker could use this issue to cause GIFLIB to crash, resulting in a denial of service, or possibly execute arbitrary code...