SUSE-SU-2026:3038-1 Security update for qemu

This update for qemu fixes the following issues - CVE-2026-3886: QEMU calcimagehostmem Integer Overflow Local Privilege Escalation Vulnerability bsc1268061. - CVE-2026-48004: heap use-after-free race condition allows a DoS by an unprivileged guest user bsc1270133. - CVE-2026-48914: qemu-kvm: Heap...

Security Bulletin: Multiple vulnerabilities in python affects AIX/VIOS.

Summary Integer overflow and use after may cause memory corruption and denial of service. Vulnerability Details CVEID:CVE-2026-56403 DESCRIPTION: libexpat before 2.8.2 has an integer overflow in storeAtts. CWE:CWE-190: Integer Overflow or Wraparound CVSS Source: NVD CVSS Base score: 6.9 CVSS...

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack

...

SUSE CVE-2026-25541

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...

SUSE CVE-2026-40468

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below...

SUSE CVE-2026-40469

Integer overflow vulnerability has been found in "builtin.c" program file of gawk dosub routine. This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below...

EUVD-2026-44519

CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...

EUVD-2026-44520

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not requir...

EUVD-2026-44525

CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...

RockyLinux 9 : pacemaker (RLSA-2026:39323)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39323 advisory. pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression CVE-2026-10649 Tenable has extracted the preceding description block...

RHEL 8 : pacemaker (RHSA-2026:39322)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39322 advisory. The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in t...

Oracle Linux 10 : mingw-glib2 (ELSA-2026-18344)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-18344 advisory. 2.87.0-1 - Update to 2.87.0 - RHEL-130993 - CVE-2025-13601 mingw-glib2: Integer overflow in in gescapeuristring Tenable has extracted the preceding descriptio...

PT-2026-60344

Name of the Vulnerable Software and Affected Versions Autel MaxiCharger AC Elite Home affected versions not specified Description Remote attackers can execute arbitrary code on affected EV chargers without authentication. The issue occurs during the handling of WebSocket messages related to the...

RockyLinux 8 : pacemaker (RLSA-2026:39322)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39322 advisory. pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression CVE-2026-10649 Tenable has extracted the preceding description block...

AlmaLinux 8 : pacemaker (ALSA-2026:39322)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:39322 advisory. pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression CVE-2026-10649 Tenable has extracted the preceding description block...

RHEL 9 : pacemaker (RHSA-2026:39323)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39323 advisory. The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in t...

CVE-2026-48354

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not requir...

CVE-2026-48298

CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...

CVE-2026-48296

CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...

JLSEC-2026-686 Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt

Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a call to the function wcXChaCha20Poly1305Decrypt which is not used with TLS connections, only from direct calls from an application...