EUVD-2026-46434

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in libheif/region.cc contains an integer overflow. Both width and height are unsigned int 32-bit values parsed from the HEIF file. Their product can exceed UINT32MAX, wrapping to...

SUSE-SU-2026:22835-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-10263: arm64: cputype: Add C1-Premium definitions bsc1266290. - CVE-2025-39894: netfilter: brnetfilter: do not check confirmed bit in brnflocalin after confirm...

GHSA-4J32-57V6-6G45 Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Summary Type: Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed x strong or x strong-emphasis combined pairs causes ON² parser work. Distinct from the bracket-bomb DoS repetition and from the formatting-plugin DoS /==/^^; this one fires on default-config mistune...

CVE-2026-44229 RT: Cross-Site Scripting via inline-served uploaded content

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...

CVE-2026-44229

CVE-2026-44229 (RT) affects the Request Tracker project: versions 5.0.0 and 6.0.0 and above, up to but not including 5.0.10 and 6.0.3, contain an XSS vulnerability where uploaded content is served inline instead of as an attachment. An authenticated user who can upload content can inject JavaScri...

SUSE CVE-2026-63815

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

CVE-2026-63815

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

CVE-2026-63815 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

CVE-2026-63815

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

CVE-2026-63815 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

CVE-2026-63815

CVE-2026-63815 (Linux kernel, f2fs) : The vulnerability arises when flexible_inline_xattr is enabled; do_read_inode() unconditionally loads i_inline_xattr_size from disk, but sanity_check_inode() only validates it if FI_INLINE_XATTR is set. This enables an attacker-controlled i_inline_xattr_size ...

CVE-2026-63815

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

EUVD-2026-45481

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize unconditionally: if f2fssbhasflexibleinlinexattrsbi fi-iinlinexattrsize =...

PT-2026-61131

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the f2fs file system when the flexible inline xattr feature is enabled. The do read inode function loads the i inline xattr size value from disk without...

Linux Distros Unpatched Vulnerability : CVE-2026-63815

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - f2fs: bound iinlinexattrsize for non-inline-xattr inodes When the flexibleinlinexattr feature is enabled, doreadinode loads the on-disk iinlinexattrsize...

CVE-2026-44019

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that acce...

CVE-2026-44019 Docling Core has insufficient validation of image reference URIs

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that acce...

CVE-2026-44019

Docling Core (docling-core) versions 2.5.0 through before 2.74.1 allow local file:// image references and inline data: content without a decoded-size limit when processing untrusted image references. This could enable access to local files readable by the process or cause excessive memory usage f...

CVE-2026-44019 Docling Core has insufficient validation of image reference URIs

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that acce...

CVE-2026-59862 Kiota: Code Generation Literal Injection in the Python Generator

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values.description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and...