Astra Linux – Vulnerability in TIF format

A null source pointer passed as an argument to the memcopy function within TIFFReadDirectory in tifdirread.c in libtiff versions from 4.0 to 4.3.0 could lead to a Denial of Service attack through a crafted TIFF file. For users who compile libtiff from source code, a fix is available in the commit...

CVE-2026-71202

The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height. When an offset exceeds the corresponding source dimension, width2 - offsetx or the height...

EUVD-2026-37948

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.11, the HTJ2K High-Throughput JPEG 2000 decoder, htundoimpl in OpenEXRCore is vulnerable to a heap-buffer-overflow READ. The htundoimp...

CVE-2026-8786

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is...

CVE-2026-44928

In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal...

BIT-JAVA-2024-55549

xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes...

PT-2026-36101

Name of the Vulnerable Software and Affected Versions nanobot affected versions not specified Description An issue exists where including the | character in a sender address allows an attacker to bypass the Channel allowlist. This bypass provides full access to the Agent Loop, exposing all tools,...

JLSEC-2026-171

A flaw was discovered in ldapX509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in adkeystring, resulting in denial of service...

The vulnerability of the netlink_ack_tlv_len() function in the net/netlink/af_netlink.c module allows a hacker to cause a service failure within the Linux operating system’s socket monitoring interface.

The vulnerability of the netlinkacktlvlen function in the net/netlink/afnetlink.c module, which supports NETLINK socket monitoring interfaces in Linux operating systems, is related to errors in deleting confidential information before reusing it. Exploiting this vulnerability could allow an...

SUSE-SU-2026:0377-1 Security update for libheif

This update for libheif fixes the following issues: - CVE-2025-68431: Fixed heap buffer over-read in HeifPixelImage::overlay via crafted HEIF that exercises the overlay image item bsc1255735...

Azure Linux 3.0 Security Update: binutils (CVE-2025-7546)

The version of binutils installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-7546 advisory. - A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this...

Azure Linux 3.0 Security Update: kernel (CVE-2024-57949)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-57949 advisory. - In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Don't enable...

ROS-20260120-7311

A vulnerability in the !defined function kernel/sched/core.c of the Linux kernel is related to the execution of a loop with an unreachable exit condition. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

CVE-2025-66863

An issue was discovered in function ddiscriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file...

EUVD-2025-202882

In U-Boot of appenduint32le, there is a possible fault injection due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-53607

CVE-2023-53607 involves the Linux kernel ALSA ymfpci driver. The bug is caused by snd_ymfpci_probe using snd_BUG_ON() with snd_dma_buffer.bytes that were not accounting for the aligned size, leading to a faulty check and a kernel warning in snd_ymfpci_create. The issue manifests as a local, low-p...

CVE-2023-53607 ALSA: ymfpci: Fix BUG_ON in probe function

In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Fix BUGON in probe function The snddmabuffer.bytes field now contains the aligned size, which this sndBUGON did not account for, resulting in the following: 9.625915 ------------ cut here ------------ 9.633440...

EUVD-2023-41062

Malicious code in bioql PyPI...

EUVD-2025-21789

Malicious code in bioql PyPI...

CVE-2025-39919

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: add missing check for rx wcid entries Non-station wcid entries must not be passed to the rx functions. In case of the global wcid entry, it could even lead to corruption in the wcid array due to pointer being...