CVE-2026-26309 Envoy has an off-by-one write in JsonEscaper::escapeString()

Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, an off-by-one write in Envoy::JsonEscaper::escapeString can corrupt std::string null-termination, causing undefined behavior and potentially leading to crashes or out-of-bounds reads when the...

iccDEV 缓冲区错误漏洞

iccDEV is a color configuration code base. A buffer overflow vulnerability exists in iccDEV that can be exploited by an attacker to cause a memory leak or crash...

iccDEV 安全漏洞

iccDEV is an open-source color configuration code library developed by the International Color Consortium. Versions of iccDEV prior to 2.3.1.5 contained security vulnerabilities. These vulnerabilities stemmed from the use of the CIccCmm::AddXform function, where the heap was reused after...

Envoy 安全漏洞

Envoy is an open-source gateway program developed by Enphase, used to connect smart home devices. There are security vulnerabilities in versions of Envoy prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13. These vulnerabilities stem from a race condition in the JsonEscaper::escapeString function, which...

iccDEV 缓冲区错误漏洞

iccDEV is an open-source color configuration code library developed by the International Color Consortium. Versions of iccDEV prior to 2.3.1.5 contained a buffer error vulnerability. This vulnerability stemmed from a stack buffer overflow during the CIccXform3DLut::Apply function execution, which...

UNISOC Chipsets 安全漏洞

UNISOC Chipsets are chipset solutions developed by UNISOC, a company based in China. There are security vulnerabilities present in Unisoc Chipsets. These vulnerabilities stem from improper input validation in the NR modems, which can lead to system crashes and may be exploited in remote...

UNISOC Chipsets 安全漏洞

UNISOC Chipsets are chipset solutions developed by UNISOC, a company based in China. There are security vulnerabilities present in UNISOC Chipsets. These vulnerabilities stem from improper input validation in the nr modem, which can lead to system crashes and may be exploited in remote...

UNISOC Chipsets 安全漏洞

UNISOC Chipsets are chipset solutions developed by UNISOC, a company based in China. There are security vulnerabilities present in UNISOC Chipsets. These vulnerabilities stem from improper input validation in the nr modem, which can lead to system crashes and may be exploited in remote...

SUSE-SU-2026:20707-1 Security update for libxslt, libxml2

This update for libxslt, libxml2 fixes the following issues: Changes in libxml2: - CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in xmlCatalogXMLResolveURI bsc1256807, bsc1256811. - CVE-2026-0992: excessive resource consumption when processing XML...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2026-1450)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1450 advisory. MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service CVE-2025-11626 Kafka dissector crash in Wireshark 4.6.0 and 4.4.0 to 4.4.10 allows denial...

openSUSE 16 Security Update : libxml2, libxslt (openSUSE-SU-2026:20312-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20312-1 advisory. Changes in libxml2: - CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in xmlCatalogXMLResolveURI...

NewStart CGSL MAIN 6.06 (SP) : rpm Multiple Vulnerabilities (NS-SA-2026-0012)

The remote NewStart CGSL host, running version MAIN 6.06 SP, has rpm packages installed that are affected by multiple vulnerabilities: - Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, whic...

Medium: wireshark

Issue Overview: MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service CVE-2025-11626 Kafka dissector crash in Wireshark 4.6.0 and 4.4.0 to 4.4.10 allows denial of service CVE-2025-13499 BPv7 dissector crash in Wireshark 4.6.0 allows denial of servi...

Traefik 安全漏洞

Traefik is an open-source reverse proxy and load balancing tool developed by Traefik. Versions prior to Traefik 2.11.38 and 3.6.9 have security vulnerabilities. These vulnerabilities stem from the ForwardAuth middleware, which processes responses without size restrictions. This can lead to memory...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005781)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005781 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma surface copies cou...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005713)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005713 advisory. In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive value...

Astra Linux – Vulnerability in xorg-server

A flaw was discovered in the X.Org X server’s X Keyboard Xkb extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, resulting in a use-after-free condition. This can cause memory corruption or a crash when affected...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: dmaengine: qcom: bamdma: Fixed error handling for num-channels/ees When there is no clock specified in the device tree, there is no way to ensure that BAM is enabled. This often occurs for remotely controlled or remotely power...

Denial of Service Vulnerability in Multiple Apple Products (CNVD-2026-14481)

Apple iOS is an operating system developed for mobile devices.Apple macOS is a specialized operating system developed for Mac computers.Apple iPadOS is an operating system for iPad tablets. A denial of service vulnerability exists in multiple Apple products due to an error in the WebKit component...

BIT-MONGODB-2026-1848 Connections received from the proxy port may not count towards total accepted connections

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header...