CVE-2026-110600

xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in mainsheetgetsheetfileexpatcallbackelementstart in lib/xlsxioread.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship...

CVE-2026-110600

The xlsxio library, versions through 0.2.37 , contains a NULL pointer dereference vulnerability in the main_sheet_get_sheetfile_expat_callback_element_start() function located in lib/xlsxio_read.c. An attacker can crash the application by providing a crafted .xlsx file where the workbook.xml.rels...

CVE-2026-110596 quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search

quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern in lib/identify.c that allows attackers to hang quircend with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode...

CVE-2026-110596

quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern in lib/identify.c that allows attackers to hang quircend with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode...

CVE-2026-110596

quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern in lib/identify.c that allows attackers to hang quircend with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode...

EUVD-2026-101224

quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern in lib/identify.c that allows attackers to hang quircend with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode...

CVE-2026-110596

quirc versions through 1.2 are vulnerable to a Denial of Service (DoS) via an excessive-iteration flaw in the find_alignment_pattern() function located in lib/identify.c. An attacker can provide a crafted image with three arranged finder patterns that produce a near-degenerate perspective transfo...

curl: libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP request

AI WAS USED IN THE PROCESS OF IDENTIFYING THIS VULNERABILITY. The vulnerability was tested manually and the report was carefully read. Suggested severity Low Affected version curl 8.23.0, tag curl-8230, commit 3163ec065643ba20709f190111f42c3e1fe95273. Affected interface The issue is reachable...

Malicious code in @newspage/lib-ng-async-routes-ui (npm)

npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In version 99.99.4, index.js sen...

Linux Distros Unpatched Vulnerability : CVE-2026-86567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap. CVE-2026-865...

Linux Distros Unpatched Vulnerability : CVE-2026-86563

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access. CVE-2026-86563 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-86847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causin...

Linux Distros Unpatched Vulnerability : CVE-2026-86566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vho...

CVE-2026-86562: Concurrent Execution using Shared Resource with Improper Synchronization

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler...

PT-2026-114302

Name of the Vulnerable Software and Affected Versions DPDK versions prior to 25.11.4-1.1 Description A flaw in the lib/vhost library involves a double-offset bug during the calculation of vhost log mapping, which can result in incorrect memory access. Recommendations Update to version 25.11.4-1.1...

PT-2026-114304

Name of the Vulnerable Software and Affected Versions DPDK versions prior to 25.11.4-1.1 Description A flaw exists in the lib/vhost library where a guest using runt RX descriptors can cause a copy length underflow during the vhost enqueue process. This can lead to a denial of service in shared...

PT-2026-114305

Name of the Vulnerable Software and Affected Versions DPDK versions prior to 25.11.4-1.1 Description A flaw exists in the DPDK lib/vhost component where the VDUSE handler does not invalidate vring pointers during IOTLB invalidation. This failure results in a use-after-unmap condition, which occur...

CVE-2026-86849: Out-of-bounds Write

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend...

Linux Distros Unpatched Vulnerability : CVE-2026-86845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type...

Linux Distros Unpatched Vulnerability : CVE-2026-86849

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer ...