CVE-2026-15567

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

CVE-2026-73141

A flaw was found in svxlink's audio decoders. A variable-length array on the stack is sized using an attacker-controlled encoded-frame length field received over the network. By sending a frame with an excessively large length value, a remote attacker can exhaust the stack, resulting in a denial ...

CVE-2026-73152

GHSA-4g8q-rgxf-fmgf: EchoLink proxy: integer truncation in message length...

CVE-2026-73151

GHSA-x5r8-rq62-q9cj: remotetrx: unvalidated audio length + exposed transceiver control...

CVE-2026-15567

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

wifi: wilc1000: validate assoc response length before subtracting header

...

wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()

...

usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer

...

CVE-2026-72712: Loop with Unreachable Exit Condition

Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parseoptions function in nselib/packet.lua to allocate...

PT-2026-80187

GHSA-x5r8-rq62-q9cj: remotetrx: unvalidated audio length + exposed transceiver control...

PT-2026-70893

Name of the Vulnerable Software and Affected Versions ffuf versions prior to 2.2.0 Description A malicious target server can trigger an out-of-memory denial of service. This occurs because the response size guard in the pkg/runner/simple.go file only verifies the compressed Content-Length, wherea...

CVE-2026-68412

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

AZL-94877 CVE-2026-68412 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

CVE-2026-68411

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: clamp virtio RX length before skbput hwsimvirtiorxwork passes the virtqueue used-ring length reported by the device straight to skbput on a fixed-size receive skb. A backend reporting a length larger than the...

CVE-2026-68402

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211iselementinherited reads the first data octet of the candidate element id = elem-data0 to look it up in an extension non-inheritance list. It does so aft...

CVE-2026-68368

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate datagram bounds in ncmunwrapntb When unpacking host-supplied NTBs, ncmunwrapntb checks datagram length against framemax but does not verify that the datagram fits within the declared block length...

CVE-2026-68353

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler The firmware-controlled nummsg field u8, 0-255 drives the loop in ath6klwmitxcompleteeventrx without validation against the buffer length. This allows...

CVE-2026-68348

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2781: bound firmware description string parsing The TAS2781 firmware parser reads several variable-length description strings with strlen before checking that the string terminator is present inside the firmware blob. A...

CVE-2026-68340

In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll response parser walks a counted list of sensor data blocks. It used the static backing-array capacity as the parse boundary, but a transport response makes only...

CVE-2026-68326

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiexprocessuapevent handles EVENTUAPSTAASSOC by exposing the reassociation request IEs that the firmware copies into the event: sinfo-assocreqies =...