Linux Distros Unpatched Vulnerability : CVE-2026-61908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of- bounds index. An authenticated user could attempt to...

CVE-2026-61908

An out-of-bounds read vulnerability in Cyrus IMAP before 3.12.4 (also fixed in 3.10.4 and 3.8.8) allows an authenticated user to download a crafted JMAP email-header blob ID of the form H-, which reads past the end of the internal blob_headers array, potentially exposing adjacent heap memory . NV...

CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

EUVD-2026-75134

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

CVE-2026-53604 nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the real pki.CAResolver directly into mobilebundle.Build. Inside Build, resolver.LoadByID decrypts the CA's ed25519 private key into a pki.CAManager, but Build...

CVE-2026-34616

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must...

CVE-2026-34616 DNG SDK | Out-of-bounds Read (CWE-125)

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must...

EUVD-2026-67216

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must...

CVE-2026-34616

CVE-2026-34616 affects Adobe DNG SDK versions 1.7.1 2502 and earlier , containing an out-of-bounds read (CWE-125) that can lead to sensitive memory exposure . Exploitation requires user interaction : a victim must open a malicious file. The CVSS 3.1 score is 5.5 (MEDIUM) , with local attack vecto...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the AV1 RTP packetizer’s ffrtpsendav1 keyframe sequence-header search loop in libavformat/rtpencav1.c. An attacker can make FFmpeg read past the end of an AV1 packet by supplying a crafted AV1 frame with an...

APSB26-124 : Security update available for Adobe Illustrator

Adobe has released an update for Adobe Illustrator. This update resolves an important vulnerability that could result in memory exposure...

APSB26-129 : Security update available for Adobe Substance 3D Painter

Adobe has released an update for Adobe Substance 3D Painter. This update addresses critical and important vulnerabilities in Adobe Substance 3D Painter that could result in arbitrary code execution and memory explosure...

Adobe Illustrator < 29.8.10 / 30.0 < 30.7 Memory exposure (APSB26-124)

The version of Adobe Illustrator installed on the remote Windows host is prior to 29.8.10, 30.7. It is, therefore, affected by a vulnerability as referenced in the APSB26-124 advisory. - Out-of-bounds Read CWE-125 potentially leading to Memory exposure CVE-2026-71441 Note that Nessus has not test...

Astra Linux – Vulnerability in Thunderbird

Thunderbird unprotects a secret OpenPGP key before using it for decryption, signing, or key import tasks. If the task fails, the secret key may remain in memory in an unprotected state. This vulnerability affects Thunderbird versions earlier than 78.8.1...

Astra Linux – Vulnerability in libsoup2.4

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server...

Astra Linux – Vulnerability in Chromium

The use of uninitialized variables in WebCodecs in Google Chrome prior to version 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in libssh

A flaw was discovered in the libssh library in versions prior to 0.11.2. An out-of-bounds read vulnerability can occur in the sftphandle function due to an incorrect comparison check. This allows the function to access memory beyond the valid handle list and to return an invalid pointer, which is...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Propagating errors from htablockbucket to user space In the function htabmaplookupanddeletebatch, if htablockbucket returns -EBUSY, the operation proceeds to the next bucket. Moving to the next bucket may not only silently...

SUSE CVE-2026-74729

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoopfileread putfifowithdiscard acts as both producer and consumer on the kfifo: it calls kfifoskip advances out and kfifoput advances in from the IRQ handler without synchronizin...

CVE-2026-74729

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoopfileread putfifowithdiscard acts as both producer and consumer on the kfifo: it calls kfifoskip advances out and kfifoput advances in from the IRQ handler without synchronizin...