CVE-2026-25211

Llama Stack (llama-stack)

The vulnerability of the Spring Boot Actuator component in the corporate security solution for the TeleMessage TM SGNL messaging service allows attackers to compromise the confidentiality of the protected information.

The vulnerability of the Spring Boot Actuator component in the corporate security solution for message exchange via TeleMessage TM SGNL is related to the insecure initialization of resources. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise the...

PT-2026-6498

Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...

CVE-2026-25211: Insertion of Sensitive Information into Log File

Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...

PT-2026-5384

Name of the Vulnerable Software and Affected Versions Llama Stack versions prior to 0.4.0rc3 Description The software does not properly conceal the pgvector password within the initialization logs, potentially exposing sensitive credentials. Recommendations Update to version 0.4.0rc3 or later...

openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing

A flaw was found in OpenSSL. A remote attacker can exploit a stack buffer overflow vulnerability by supplying a crafted Cryptographic Message Syntax CMS message with an oversized Initialization Vector IV when parsing AuthEnvelopedData structures that use Authenticated Encryption with Associated...

PT-2026-43843

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the amdgpu ras init function. When the amdgpu nbio ras sw init function fails, the system returns an error code immediately without freeing the allocated con...

openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing

A flaw was found in OpenSSL. A remote attacker can exploit a stack buffer overflow vulnerability by supplying a crafted Cryptographic Message Syntax CMS message with an oversized Initialization Vector IV when parsing AuthEnvelopedData structures that use Authenticated Encryption with Associated...

openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing

A flaw was found in OpenSSL. A remote attacker can exploit a stack buffer overflow vulnerability by supplying a crafted Cryptographic Message Syntax CMS message with an oversized Initialization Vector IV when parsing AuthEnvelopedData structures that use Authenticated Encryption with Associated...

Exploit for CVE-2025-15467

CVE-2025-15467 Stack buffer overflow in OpenSSL CMS AuthEnvel...

openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing

A flaw was found in OpenSSL. A remote attacker can exploit a stack buffer overflow vulnerability by supplying a crafted Cryptographic Message Syntax CMS message with an oversized Initialization Vector IV when parsing AuthEnvelopedData structures that use Authenticated Encryption with Associated...

openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing

A flaw was found in OpenSSL. A remote attacker can exploit a stack buffer overflow vulnerability by supplying a crafted Cryptographic Message Syntax CMS message with an oversized Initialization Vector IV when parsing AuthEnvelopedData structures that use Authenticated Encryption with Associated...

SUSE CVE-2026-22988

In the Linux kernel, the following vulnerability has been resolved: arp: do not assume devhardheader does not change skb-head arpcreate is the only devhardheader caller making assumption about skb-head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after...

The vulnerability of the CMS message handler in the OpenSSL cryptographic library allows a hacker to execute arbitrary code.

The vulnerability of the CMS message handler in the OpenSSL cryptographic library relates to the writing beyond buffer boundaries during initialization vector processing. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending specially crafted packets...

CVE-2026-23553: Improper Initialization

In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Consider: 1 vCPU runs on CPU A, running task ...

PT-2026-22923

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to missing NULL pointer checks within the Classmate laptop driver. Specifically, code utilizing the accel object may execute before the object's...

CVE-2025-15467

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS...

CVE-2025-15467

A flaw was found in OpenSSL. A remote attacker can exploit a stack buffer overflow vulnerability by supplying a crafted Cryptographic Message Syntax CMS message with an oversized Initialization Vector IV when parsing AuthEnvelopedData structures that use Authenticated Encryption with Associated...

SUSE CVE-2026-22986

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix race condition for gdev-srcu If two drivers were calling gpiochipadddatawithkey, one may be traversing the srcu-protected list in gpionametodesc, meanwhile other has just added its gdev in gpiodevaddtolistunlocked...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005093)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005093 advisory. In the Linux kernel, the following vulnerability has been resolved: hfs: fix to initialize fields of hfsinodeinfo after hfsallocinode Syzbot reports uninitialized...