CVE-2026-64506

CVE-2026-64506 affects the Linux kernel wifi driver rtW89: a bug in the AMPDU drop logic could drop the first AMPDU packet when paired with certain sequence numbers, increasing the chance of disconnection from the AP during busy traffic or rekey. The fix adds an initial state judgement and resets...

CVE-2026-64506 wifi: rtw89: correct drop logic for malformed AMPDU frames

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

CVE-2026-64506

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

EUVD-2026-48947

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

PT-2026-64727

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

Linux Distros Unpatched Vulnerability : CVE-2026-63729

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The SyncTeX parser synctexparser.c shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability...

PT-2026-64761

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-27 Description A memory leak exists in the magick command-line interface. This occurs when invalid options are provided, allowing an attacker to trigger memory exhaustion by repeatedly supplying malformed...

Linux Distros Unpatched Vulnerability : CVE-2026-26197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's siz...

GO-2026-5693 Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git

Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git...

GO-2026-5543 Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp

Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp...

CVE-2026-5038

A flaw was found in multer. This vulnerability allows a remote attacker to trigger a Denial of Service DoS by initiating and then aborting or sending malformed multipart uploads. This action leaves orphaned partial files on the disk, which can lead to the exhaustion of available disk space withou...

GHSA-V74W-7MR3-4QG3 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

Summary An attacker can cause Denial of Service by sending a specially crafted malicious XML payload e.g., repeated . Because the parser state is not saved between decode invocations, an attacker can trickle-feed a payload of / characters. This forces the decoder to repeatedly rescan the entire...

GHSA-MFG7-5GFP-C4W3 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

Summary A memory leak can be caused in Netty's DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occurs incrementally per packet, sustained malicious requests will cause a gradual Denial of Service. Details Inside...

Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

Summary A memory leak can be caused in Netty's DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occurs incrementally per packet, sustained malicious requests will cause a gradual Denial of Service. Details Inside...

SUSE CVE-2026-63729

The SyncTeX parser synctexparser.c shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. ...

PT-2026-64304

Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.19 Loytec L-INX versions prior to 8.4.19 Loytec L-GATE versions prior to 8.4.19 Loytec L-ROC versions prior to 8.4.19 Loytec L-IOB versions prior to 8.4.19 Loytec L-DALI versions prior to 8.4.19 Loytec...

Security update for perl-XML-Bare (moderate)

openSUSE security update: security update for perl-xml-bare ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21435-1 Rating: moderate References: bsc1271637 bsc1271640 Cross-References: CVE-2026-13401 CVE-2026-57074 CVSS scores: CVE-2026-13401 SUSE :...

CVE-2026-50103

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...

CVE-2026-50103 Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...

CVE-2026-50103

CVE-2026-50103 affects the GOOSE/R-GOOSE parser in libIEC61850 (MZ Automation) and describes a NULL dereference when parsing malformed TLV values, enabling a network-adjacent DoS by crashing the subscriber. The related PoCs and analysis in the connected documents confirm the issue and indicate fi...