CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-88386

The libsndfile library (version 1.2.2 ) is vulnerable to a misaligned memory access issue within the psf_binheader_readf() function. This flaw occurs during the parsing of WAV fmt chunks , where a specially crafted WAV file can cause the function to cast an unaligned destination address to an uns...

PT-2026-98051

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An issue exists in the netfilter nf conntrack component within the tcp sack function. The timestamp-only fast path incorrectly dereferences the option stream as a 4-byte aligned pointer,...

PT-2026-97815

Name of the Vulnerable Software and Affected Versions libvips version 8.19.0 Description A memory access issue occurs when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader may expose pixel data at an address not properly...

CVE-2026-88360

The libvips 8.19.0 library is vulnerable to a memory access issue when processing little-endian PFM images . The root cause is that an mmap-based loader may expose pixel data at an address improperly aligned for float access if the PFM text header length is not a multiple of four bytes. This occu...

CVE-2026-88357: Incorrect Bitwise Shift of Integer

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

PT-2026-98298

Name of the Vulnerable Software and Affected Versions libsndfile version 1.2.2 Description A misaligned memory access issue exists when parsing WAV fmt chunks. A specially crafted WAV file can cause the psf binheader readf function to cast an unaligned destination address to unsigned int and...

Linux Distros Unpatched Vulnerability : CVE-2026-93250

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vxlan: mdb: Fix use-after-free in vxlanmdbflush vxlanmdbflush iterates over the MDB entries using hlistforeachentrysafe, which only tolerates the removal of the...

EUVD-2026-86285

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

PT-2026-97937

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the vxlan mdb flush function. The function iterates over Multicast Database MDB entries using hlist for each entry safe, which is designed to handle the...

CVE-2026-97417

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: use getunalignedbe32 in tcpsack The timestamp-only fast path dereferences the option stream as be32 ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use getunalignedbe32...

kernel: xfrm: ah6: validate routing header segments_left

A flaw was found in the Linux kernel's xfrm subsystem, specifically within the AH6 Authentication Header for IPv6 module. The ipv6rearrangerthdr function does not properly validate the segmentsleft field in routing headers when processing raw IPv6 HDRINCL packets. This oversight allows an attacke...

github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing

A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads t...

github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing

A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads t...

github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing

A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads t...

CVE-2026-61714

A flaw was found in FluidSynth, a software synthesizer. When the synth.midi-channels configuration is set above 16, the MIDI player can write beyond the allocated memory for tracking active channels. This heap buffer overflow can lead to out-of-bounds memory access, potentially compromising the...

CVE-2026-93989

A flaw was found in vLLM. A remote attacker can exploit a vulnerability by providing malformed input related to 'bad words' token processing. This can lead to out-of-bounds memory access, corrupting the internal data logits memory used for generating responses for other concurrent requests. As a...

github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing

A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads t...

ROS-20260922-73-0096

The vulnerability of the tbxdppropertiesrequest function in the drivers/thunderbolt/xdomain.c file of the general support driver for USB4 and Thunderbolt in the Linux operating system is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090042)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090042 advisory. A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in...