Linux Distros Unpatched Vulnerability : CVE-2026-80575

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: cs40l50-vibra - validate custom data from user space cs40l50add copies the custom data of an FFPERIODIC/FFCUSTOM effect straight from the ffeffect the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098824)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098824 advisory. In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btreeiter btreeiter is used in two ways: either...

CVE-2026-65979 OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.12, the HTJ2K decoder parses a header-length field PLEN from a chunk's compressed data but never checks that this value fits within the...

CVE-2026-65979

OpenEXR (the reference implementation for the EXR image format, widely used in the motion picture industry) versions 3.4.0 through 3.4.12 contain an out-of-bounds read in the HTJ2K decoder . The decoder parses a header-length field (PLEN ) from a chunk's compressed data and advances the codestrea...

CVE-2026-13216 Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length

The virtio PCI driver drivers/virtio/virtiopci.c parses a device's PCI capability list during driver initialization. In virtiopcireadcap the device-supplied capability length byte caplen read from PCI config space via pcieconfread was only checked with asserttmp.caplen == capstructsize. That asse...

CVE-2026-13216 Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length

The virtio PCI driver drivers/virtio/virtiopci.c parses a device's PCI capability list during driver initialization. In virtiopcireadcap the device-supplied capability length byte caplen read from PCI config space via pcieconfread was only checked with asserttmp.caplen == capstructsize. That asse...

CVE-2026-13216

CVE-2026-13216 is an out-of-bounds stack write in the Zephyr RTOS virtio PCI driver (drivers/virtio/virtio_pci.c). The device-supplied cap_len field, read from PCI config space, was validated only by a compiled-out assert() (gated by CONFIG_ASSERT, off by default in production). The unvalidated l...

CVE-2026-13216 Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length

The virtio PCI driver drivers/virtio/virtiopci.c parses a device's PCI capability list during driver initialization. In virtiopcireadcap the device-supplied capability length byte caplen read from PCI config space via pcieconfread was only checked with asserttmp.caplen == capstructsize. That asse...

CVE-2026-59646

A flaw was found in Bouncy Castle for Java. The DTLS Datagram Transport Layer Security handshake reassembler allocates buffers based on an unchecked 24-bit length value. A remote attacker could exploit this vulnerability by sending a specially crafted DTLS handshake message, leading to excessive...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the AV1 RTP packetizer’s ffrtpsendav1 keyframe sequence-header search loop in libavformat/rtpencav1.c. An attacker can make FFmpeg read past the end of an AV1 packet by supplying a crafted AV1 frame with an...

SUSE CVE-2026-68451

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests ccaecc2protkey derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length excee...

SUSE CVE-2026-68452

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests ccacipher2protkey derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length...

SUSE CVE-2026-69219

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a...

PT-2026-81374

The virtio PCI driver drivers/virtio/virtio pci.c parses a device's PCI capability list during driver initialization. In virtio pci read cap the device-supplied capability length byte cap len read from PCI config space via pcie conf read was only checked with asserttmp.cap len == cap struct size...

CVE-2026-14682

A flaw was found in Bouncy Castle for Java, including its LTS and FIPS variants. This vulnerability allows a remote attacker to trigger an Out-Of-Memory OOM error by providing specially crafted input during a definite-length read operation. This unbounded memory allocation can lead to a Denial of...

CVE-2026-74724

A flaw was found in the Linux kernel's IPVS IP Virtual Server component. A local attacker can exploit this vulnerability by manipulating packets processed by IPVS, specifically within the ipvsnaticmp function. This manipulation can lead to an out-of-bounds write due to improper handling of the IP...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

CVE-2026-78475

A flaw was found in the file-pix ESM plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array VLA on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a...

CVE-2026-71934

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this vulnerability via...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...