10171 matches found
Oracle Linux 7 : ImageMagick (ELSA-2026-17618)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-17618 advisory. - Fix CVE-2026-32636 Orabug: 39375225 - Fix CVE-2026-28691 and CVE-2026-28693 Orabug: 39174244 - Fixes Local File Disclosure via Path Traversal CVE-2026-25965...
Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-1814)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1814 advisory. libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap- buffer-overflow write vulnerability in the grid tile compositing, allowing an attacker to...
Amazon Linux 2023 : rsync, rsync-daemon (ALAS2023-2026-1801)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1801 advisory. Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger...
htslib:hts_open_fuzzer: Null-dereference READ in cram_decoder_init
Project: https://github.com/samtools/htslib.git Detailed Report: https://oss-fuzz.com/testcase?key=4867212363235328 Project: htslib Fuzzing Engine: afl Fuzz Target: htsopenfuzzer Job Type: aflasanhtslib Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State...
php security update
An update is available for php. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language commonly used with the Apache HTTP...
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
Two things landed within days of each other this week. A security startup reported 21 previously unknown vulnerabilities in FFmpeg, the media library inside almost everything that touches video, all of them found by an autonomous AI agent. The same week, Google shipped Chrome 149 with patches for...
CVE-2025-70103
A flaw was found in libjxl, an image processing library. This heap buffer overflow vulnerability could potentially allow a remote attacker to cause a denial of service. The flaw occurs when processing specially crafted PBM Portable Bitmap images, primarily impacting applications that handle...
RHEL 10 : php (RHSA-2026:23388)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:23388 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: PHP: PHP: Denial of Service via...
EulerOS Virtualization 2.13.0 : alsa-lib (EulerOS-SA-2026-2157)
According to the versions of the alsa-lib package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topolog...
RockyLinux 10 : php (RLSA-2026:23388)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:23388 advisory. PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7258 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting...
PT-2026-49602
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=519841736 Crash type: Global-buffer-overflow READ 8 Crash state: cram decoder init cram decode compression header cram next slice...
CVE-2026-49361
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...
CVE-2026-46597
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service DoS for the affected system...
CVE-2026-41069
A flaw was found in libheif, a HEIF High Efficiency Image File Format and AVIF file format decoder and encoder. A remote attacker could exploit this vulnerability by providing a specially crafted, malformed HEIF sequence file. This malformed file can trigger an out-of-bounds read during the core...
CVE-2026-42582
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specially crafted compressed field section during header block decoding. This flaw occurs because the system allocates a new byte array based on ...
CVE-2026-42583
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory up to 32 MB per block before...
php8.4 security update
An update is available for php8.4. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language. PHP attempts to make it easy for...
gpac:fuzz_scene: Heap-use-after-free in gf_node_unregister
Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=4714478829895680 Project: gpac Fuzzing Engine: honggfuzz Fuzz Target: fuzzscene Job Type: honggfuzzasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x793e102e0140 Crash...
