CVE-2026-73547: Improper Input Validation

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's extauthz filter assumes that a request contains a :path pseudoheader when applying queryparameterstoset or queryparameterstoremove from an authorization...

CVE-2026-48521: NULL Pointer Dereference

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transportsocketoptions while selecting an HTTP/3 connection pool without first checking whether the...

CVE-2026-94403: Untrusted Pointer Dereference

A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub140001AF0 in the library ene.sys of the component IOCTL Handler. This manipulation causes untrusted pointer dereference. The attack can only be executed locally. The exploit has been made available to the...

SUSE SLED15 / SLES15 Security Update : libusb-1_0 (SUSE-SU-2026:4050-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4050-1 advisory. This update for libusb-10 fixes the following issue: - CVE-2026-23679: NULL pointer dereference in parseinterface allow...

ALSA-2026:69100 Important: gstreamer1-plugins-base security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fixes: gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow...

PT-2026-96223

Name of the Vulnerable Software and Affected Versions ColorFul iGameCenter version 1.0.3.4 Description A weakness exists in the IOCTL Handler component within the ene.sys library. Specifically, the sub 140001AF0 function is susceptible to untrusted pointer dereference, which occurs when a program...

OESA-2026-3994 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an...

OESA-2026-3993 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an...

OESA-2026-3992 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an...

OESA-2026-3987 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL whil...

OESA-2026-3968 gstreamer1-plugins-base security update

GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin. Security Fixes: GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

OESA-2026-3969 gstreamer1-plugins-base security update

GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin. Security Fixes: A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization...

OESA-2026-3967 gstreamer1-plugins-base security update

GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin. Security Fixes: GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

OESA-2026-3966 gstreamer1-plugins-base security update

GStreamer is a graphics library for built-in media processing components. BasePlug-ins is a the collections used to maintain the GStreamer plugin. Security Fixes: GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

RUSTSEC-2026-0309 `SinglyLinkedList::remove` dereferences a null link

In versions before 0.2.1, SinglyLinkedList::remove is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when node is not in the list, currentelm.next reads a null pointer. That is undefined behavior. The list head is a raw mut Node, and safe code can construct...

`SinglyLinkedList::remove` dereferences a null link

In versions before 0.2.1, SinglyLinkedList::remove is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when node is not in the list, currentelm.next reads a null pointer. That is undefined behavior. The list head is a raw mut Node, and safe code can construct...

Updated patch package fixes security vulnerabilities

NULL Pointer Dereference in GNU patch. CVE-2026-56288 Loop with Unreachable Exit Condition in GNU patch. CVE-2026-56289...

MGASA-2026-0423 Updated patch package fixes security vulnerabilities

NULL Pointer Dereference in GNU patch. CVE-2026-56288 Loop with Unreachable Exit Condition in GNU patch. CVE-2026-56289...

PT-2026-103513

In versions before 0.2.1, SinglyLinkedList::remove is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when node is not in the list, current elm.next reads a null pointer. That is undefined behavior. The list head is a raw mut Node, and safe code can construct...

SUSE CVE-2026-76781

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a...