PT-2026-6842

Name of the Vulnerable Software and Affected Versions GNOME affected versions not specified Description A flaw exists in the GNOME localsearch MP3 Extractor, specifically within tracker-miners. Incorrect handling of malformed MP3 files can lead to a denial of service, potentially allowing for...

PT-2026-2245

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.6.0 Description pypdf is a pure-python PDF library. Versions prior to 6.6.0 are susceptible to long runtimes when processing malformed startxref entries within PDF files. An attacker can create a specially crafted PDF...

PT-2026-3301

Name of the Vulnerable Software and Affected Versions pyasn1 versions prior to 0.6.2 Description pyasn1, a generic ASN.1 library for Python, contains a denial-of-service issue. The issue stems from incorrect handling of malformed RELATIVE-OIDs with excessive continuation octets during decoding. A...

PT-2026-4955

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 3.6 Description A type confusion issue exists in the signature verification of signed PKCS7 data. This occurs when an ASN1 TYPE union member is accessed without first validating the type, potentially leading to a...

PT-2026-4954

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.1, 3.0, 3.3, 3.4, and 3.5 OpenSSL versions 3.6 through 3.6.0 Description An invalid or NULL pointer dereference can occur in applications processing malformed PKCS12 files. This can lead to a denial of service when an...

CVE-2025-66023: Use After Free

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. Versions prior to 0.24.5 have a Heap-Use-After-Free UAF vulnerability within the MQTT bridge client component implemented via the underlying NanoNNG library. The vulnerability is triggered when NanoMQ acts as a bridge connecting ...

PT-2026-6841

Name of the Vulnerable Software and Affected Versions tracker-miners affected versions not specified Description A flaw exists in tracker-miners related to the handling of malformed MP3 files. Specifically, the software incorrectly processes certain MP3 files, potentially leading to a denial of...

PT-2026-29037

Name of the Vulnerable Software and Affected Versions Node.js affected versions not specified Description A flaw in Node.js URL processing can lead to an assertion failure in native code when the url.format function is invoked with a malformed internationalized domain name IDN containing invalid...

PT-2026-6840

Name of the Vulnerable Software and Affected Versions GNOME localsearch MP3 Extractor affected versions not specified Description A flaw exists in tracker-miners where it incorrectly processes malformed MP3 files. This can lead to a denial of service, potentially causing the application to crash...

PT-2026-25938

CVE-2026-4359 A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver. https://t.co/CeMfkBeSoo...

AZL-73379 CVE-2025-11961 affecting package nmap for versions less than 7.93-4

pcapetheraton is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function...

CVE-2025-11961 OOBR and OOBW in pcap_ether_aton() in libpcap

pcapetheraton is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function...

CVE-2025-11961 OOBR and OOBW in pcap_ether_aton() in libpcap

pcapetheraton is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function...

CVE-2025-11961

pcapetheraton is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function...

CVE-2025-11961

CVE-2025-11961 affects the libpcap library (pcap_ether_aton) with an OOB read/write when given malformed MAC-48 inputs. Concretely, packages libpcap versions older than 1.10.6-1 are affected (examples: libpcap for Fedora 42/43, Mariner 1.x). Some advisories also indicate affected downstreams (e.g...

Linux Distros Unpatched Vulnerability : CVE-2025-11961

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pcapetheraton is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-form...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992716)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992716 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Malformed user...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992290)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992290 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Malformed user...

CLSA-2025-1767028936 Fix CVE(s): CVE-2025-11839

SECURITY UPDATE: crash in objdump when processing malformed debug data - debian/patches/CVE-2025-11839.patch: remove abort call in DGB debug-format printing code to avoid uncontrolled program termination when handling crafted input files - CVE-2025-11839...

CVE-2025-13158

Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the application, potentially leading to denial of service or...