18045 matches found
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
CVE-2026-50243 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer...
i2c: stub: Reject I2C block transfers with invalid length
...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
CVE-2026-14322 Timetics < 1.0.57 - Unauthenticated Booking Auto-Approval via Arbitrary payment_method
The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
CLEANSTART-2026-EP65920 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer
Multiple security vulnerabilities affect the knative-serving package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...
CLEANSTART-2026-BF01272 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer
Multiple security vulnerabilities affect the knative-serving package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...
SUSE CVE-2026-16353
Invalid pointer in the DOM: Bindings WebIDL component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
ROS-20260722-73-0001
The vulnerability of the m2tsdmxsendpacket function in the MP4Box utility of the GPAC multimedia platform is related to a use-after-free error during the processing of incorrect MPEG-2 TS files. This vulnerability allows attackers to cause service failures and potentially affect the memory securi...
PT-2026-63413
Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.18.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.18.11-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description An issue occurs when th...
CVE-2026-63958
A flaw was found in the Linux kernel's USB Type-C subsystem. This vulnerability allows a malicious or buggy Power Delivery Microcontroller PPM, such as embedded controller EC firmware or an I2C-attached Universal Serial Bus USB Type-C Connector System Interface UCSI controller, to provide an...
CVE-2026-10675
In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
EUVD-2026-46384
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
EUVD-2026-46383
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...
CVE-2026-10679 Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)
The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...
EUVD-2026-46448
The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...
EUVD-2026-46445
In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer subsys/bluetooth/mesh/pbadv.c, provmsgrecv rescheduled the provisioning protocol watchdog timer unconditionally at the top of the function, before the FCS check and before the ADVLINKINVALID check. Once a provisioning attempt fails, provfailed...