CVE-2026-88385: Undefined Security Weakness

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

Debian dsa-6512 : fonts-opensymbol - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6512 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6512-1 [email protected] https://www.debian.org/securit...

CVE-2026-26054: Out-of-bounds Read

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...

CVE-2026-77797: Improper Input Validation

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files...

CVE-2026-92905: Uncaught Exception

ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector using malformed syslog packets...

CVE-2026-93789: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: bound aligned TLV advance in FW parser Validate ALIGNtlvlen, 4 against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs...

PT-2026-104952

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: bound aligned TLV advance in FW parser Validate ALIGNtlv len, 4 against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs...

CVE-2026-93789

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: bound aligned TLV advance in FW parser Validate ALIGNtlvlen, 4 against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs...

Ubuntu 20.04 LTS / 26.04 LTS : Open-iSNS vulnerability (USN-8807-1)

The remote Ubuntu 20.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8807-1 advisory. It was discovered that Open-iSNS contained a double-free vulnerability when decoding malformed iSNS attributes. An unauthenticated attacker could...

GHSA-9WH6-9HQ7-9688 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

Location: core/kapp/validators/validators.go:201 Register, genesis/checking/nodesSetupChecker.go:73. core/consensus/slot/bls/subslotStartSlot.go:165 core/consensus/.../headerSignatureVerify.go:123 Create.... Description Klever uses a BDN Boneh-Drijvers-Neven BLS multi-signature over BLS12-381 to...

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

Location: core/kapp/validators/validators.go:201 Register, genesis/checking/nodesSetupChecker.go:73. core/consensus/slot/bls/subslotStartSlot.go:165 core/consensus/.../headerSignatureVerify.go:123 Create.... Description Klever uses a BDN Boneh-Drijvers-Neven BLS multi-signature over BLS12-381 to...

CVE-2026-82407

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...

EUVD-2026-85576

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...

CVE-2026-82407 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...

CVE-2026-88835

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

CVE-2026-88835

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

CVE-2026-88835 Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

EUVD-2026-85510

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

USN-8807-1 Open-iSNS vulnerability

It was discovered that Open-iSNS contained a double-free vulnerability when decoding malformed iSNS attributes. An unauthenticated attacker could possibly use this to cause a denial of service...

DRUPAL-CONTRIB-2026-174

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform did not sufficiently guard user-specific access rules against a malformed saved configuration. Under certain site-specific conditions, an access rule intended t...