7937 matches found
EUVD-2026-107138
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...
CVE-2026-114118
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in createfromblueprint by uint256 subtraction without first checking that codeoffset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling codeoffset can make a factory deploy...
CVE-2026-114118
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in createfromblueprint by uint256 subtraction without first checking that codeoffset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling codeoffset can make a factory deploy...
EUVD-2026-106921
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in createfromblueprint by uint256 subtraction without first checking that codeoffset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling codeoffset can make a factory deploy...
PT-2026-120531
Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler...
Apache bRPC buffer error vulnerability
A security vulnerability exists in Apache bRPC versions prior to 1.18.0. This vulnerability stems from integer underflow and out-of-bounds reads during the parsing of HTTP/2 DATA frames, potentially allowing unauthenticated remote attackers to send malformed DATA frames and induce a...
PT-2026-120538
An integer underflow in the mcpack2pb component of Apache bRPC version 1.18.0 on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value size. The UnparsedValue::as string function computes size - 1 without validating size; whe...
PT-2026-120494
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...
Linux Distros Unpatched Vulnerability : CVE-2026-88833
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled...
Linux Distros Unpatched Vulnerability : CVE-2026-109976
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AFUNIX client connects to the data socket without a bou...
Apache bRPC digital error vulnerability
Versions of Apache bRPC prior to 1.18.0 contain a numeric error vulnerability. This vulnerability stems from UnparsedValue::asstring in the mcpack2pb component, which fails to validate valuesize. When valuesize is set to 0, an integer underflow occurs during calculation of size-1. This results in...
PT-2026-120244
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create from blueprint by uint256 subtraction without first checking that code offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code offset can make a factory...
SUSE CVE-2026-98591
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The...
SUSE CVE-2026-111881
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...
Security Bulletin: Publicly disclosed krb5 vulnerabilities affect IBM Safer Payments (CVE-2026-40355, CVE-2026-40356)
Summary krb5 is used by IBM Safer Payments to support user logins via LDAP/kerberos5. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-40355 DESCRIPTION: In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls...
CLSA-2026-1792490933 hplip: Fix of 7 CVEs
CVE-2026-91097: bound LEDM HTTP response copies in httpread of the SANE hpaio backend stack buffer overflow backport of HPLIP 3.26.6 and RHEL c9s - CVE-2026-91098: bound device-supplied data in the LEDM scan backend resolution lists, job Location header, BinaryURL and chunk size parsing...
CVE-2026-92843
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...
Eclipse OpenJ9 buffer error vulnerability
A security vulnerability exists in Eclipse OpenJ9 versions prior to 0.63.0. This vulnerability stems from the JITServer component’s failure to perform cross-field validation on fields such as size, paddingSize, and dataOffset when deserializing DataDescriptor messages. Unauthenticated remote...
CVE-2026-91189
The GUIX binary resource loader never checks that a font page's glyph range is well formed. gxpageheaderfirstglyph and gxpageheaderlastglyph are read verbatim from the file and only the upper bound of lastglyph is validated, so a page declaring firstglyph lastglyph makes last - first + 1 underflo...
CVE-2026-92843
A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure allows a malicious TLS 1.3 server to trigger an unsigned-integer underflow . This results in a heap out-of-bounds read in any peer processing a remote Certificate message. The vulnerability is reachable pre-authentica...