EUVD-2026-60605

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or...

PT-2026-77138

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse...

CVE-2026-74238

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

EUVD-2026-60323

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238 TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238 TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack function that allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can...

CVE-2026-74238

TIER IV Nebula through 1.2.0's Vlp32Decoder::unpack() reads past UDP buffer bounds when a short datagram is sent to the Velodyne port, which lacks sender-address restrictions, leaking heap memory into fabricated PointCloud2 messages consumed by Autoware nodes. No in-the-wild exploitation is docum...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100756)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100756 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqesize before using it in ibuverbspostsend ibuverbspostsend uses cmd.wqesi...

PT-2026-76756

Name of the Vulnerable Software and Affected Versions TIER IV Nebula versions prior to 1.2.1 Description An out-of-bounds read exists in the Vlp32Decoder::unpack function. This allows unauthenticated remote attackers to cause the decoder to read past the end of a received UDP buffer into adjacent...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100325)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100325 advisory. In the Linux kernel, the following vulnerability has been resolved: net: sched: clsapi: fix tcchainfillnode to initialize tcminfo to zero to prevent an info-leak Whe...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099726)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099726 advisory. In the Linux kernel, the following vulnerability has been resolved: dm log: fix out-of-bounds write due to regioncount overflow The local variable regioncount in...

CVE-2026-74577 net: mpls: initialize rtm_tos in mpls_getroute()

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

EUVD-2026-59691

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fillmax is set When a USB audio endpoint requests full packet transfers via the fillmax descriptor flag, dataepsetparams promotes ep-curpacksize to ep-maxpacksize. However,...

UBUNTU-CVE-2026-74340

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINTREGINFO indication The firmware-controlled rsp-count field is used as the loop bound for indexing into the flexible rsp-regs array without validation against the message...

CVE-2026-74336 wifi: mac80211: bound S1G TIM PVB walk to the TIM element

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211s1gchecktim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee80211parseelemsfull stores...

CVE-2026-70629

A flaw was found in FFmpeg. An uninitialized heap memory read vulnerability exists in the native RSCC decoder. An attacker can supply a crafted video file with a compressed tile that decompresses fewer bytes than required. This leads to the unwritten portion of an intermediate buffer being copied...

CVE-2026-70630

A flaw was found in FFmpeg. An uninitialized heap memory read vulnerability in the native Screenpresso decoder allows attackers to recover sensitive memory contents. This occurs when a crafted SPV1 packet with a valid zlib stream is supplied, causing the screenpressodecodeframe function to fail i...

FFmpeg 3.0 < 9.0 Multiple Vulnerabilities

The version of FFmpeg installed on the remote host is 3.0 or later but prior to 9.0. It is, therefore, affected by multiple vulnerabilities: - An uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c allows attackers to disclose heap memory contents by supplyin...

UBUNTU-CVE-2026-19548

Multiple Use-After-Free vulnerabilities were found in the addarchiveelement function in ld/ldmain.c of the GNU linker ld, a component of binutils. The root cause is that pluginmaybeclaim in ld/plugin.c frees the original BFD object via bfdclose/bfddeletebfd when entry-thebfd-myarchive == NULL, bu...