EUVD-2026-84574

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPMSAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the...

CVE-2026-86056 Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPMSAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the...

CVE-2026-86056

Versions of Notepad++ prior to 8.9.8 are vulnerable to a null pointer dereference in the NPPM_SAVESESSION handler located in PowerEditor/src/NppBigSwitch.cpp . The application fails to verify if lParam is null before dereferencing its nbFile , files , and sessionFilePathName members. An attacker ...

CVE-2026-86056 Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPMSAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the...

CVE-2026-86056 Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPMSAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp converts lParam to a sessionInfo pointer and dereferences its nbFile, files, and sessionFilePathName members without checking for null. A process running at the...

SUSE CVE-2026-90374

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

SUSE CVE-2026-90426

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241cmdqvremove tears each VINTF down first, then calls freeirq. Tearing a VINTF down frees vintf0 and clears cmdqv-vintfs0. An error in that window makes...

SUSE CVE-2026-93038

In the Linux kernel, the following vulnerability has been resolved: iio: dac: ad5686: missing NULL check on match data Verify that chipinfo pointer is not NULL. If a user binds the driver using driveroverride via sysfs with a device name not present in the idtable or ofmatchtable, match data will...

SUSE CVE-2026-93056

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

SUSE CVE-2026-93068

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

OPENSUSE-SU-2026:21910-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc1255225. - CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull...

SUSE-SU-2026:23887-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc1255225. - CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull...

SUSE-SU-2026:23902-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc1255225. - CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull...

CVE-2026-84396: NULL Pointer Dereference

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2022-000576)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000576 advisory. NULL Pointer Dereference in function vimregexecstring at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function...

Adobe InDesign < 20.5.5 / 21.0 < 21.6.0 Multiple Application denial-of-service (APSB26-145) (macOS)

The version of Adobe InDesign installed on the remote macOS host is prior to 20.5.5, 21.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-145 advisory. - InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2023-002315)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002315 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. Tenable has extracted the preceding description block directly from the Unity Linux security...

Adobe InDesign < 20.5.5 / 21.0 < 21.6.0 Multiple Application denial-of-service (APSB26-145)

The version of Adobe InDesign installed on the remote Windows host is prior to 20.5.5, 21.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-145 advisory. - InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an...

Unity Linux 20.1060e / 20.1070e Security Update: wpa_supplicant (UTSA-2021-001735)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2021-001735 advisory. The EAP-pwd implementation in hostapd EAP server before 2.8 and wpasupplicant EAP peer before 2.8 does not validate fragmentation reassembly state properly for a cas...

AlmaLinux 9 : gstreamer1-plugins-base (ALSA-2026:69100)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:69100 advisory. gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow CVE-2026-18297 gstreamer1-plugins-base: gstreamer: NULL/invalid-point...