MGASA-2026-0292 Updated lrzip package fixes security vulnerabilities

The updated package fixes security vulnerabilities: ckolivas lrzip stream.c lzmadecompressbuf use after free. CVE-2025-15570 ckolivas lrzip strtoll.c GIstrtollinternal null pointer dereference. CVE-2025-9396...

Updated lrzip package fixes security vulnerabilities

The updated package fixes security vulnerabilities: ckolivas lrzip stream.c lzmadecompressbuf use after free. CVE-2025-15570 ckolivas lrzip strtoll.c GIstrtollinternal null pointer dereference. CVE-2025-9396...

PT-2026-64283

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts otherwise assert would trigger before NULL dereference and bogus or misbehaving controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are...

CVE-2026-50103

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...

CVE-2026-50032

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field...

CVE-2026-50032 NULL Pointer Dereference in MZ Automation libIEC61850

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field...

CVE-2026-50032

CVE-2026-50032: A NULL pointer dereference in the MMS Write Named Variable List handler of libIEC61850 (MMS write service) can crash the server when an empty listOfData is sent. Affected in libIEC61850 up to v1.6.1; fix status: patched in v1.6.2 (bd338f23). The issue is a DoS condition exploitabl...

EUVD-2026-48397

A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field...

CVE-2026-50103

CVE-2026-50103 affects the GOOSE/R-GOOSE parser in libIEC61850 (MZ Automation) and describes a NULL dereference when parsing malformed TLV values, enabling a network-adjacent DoS by crashing the subscriber. The related PoCs and analysis in the connected documents confirm the issue and indicate fi...

CVE-2026-50103 Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...

EUVD-2026-48396

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...

openjdk: OpenJDK: Enhance AWT ImagingLib (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...

PT-2026-64177

Name of the Vulnerable Software and Affected Versions MZ Automation libIEC61850 affected versions not specified Description A NULL pointer dereference occurs in the L2 GOOSE and R-GOOSE shared parser. This issue allows a network-adjacent attacker to crash a subscribing application by sending a...

Oracle Linux 8 : httpd:2.4 (ELSA-2026-42828)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42828 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 -...

PT-2026-64176

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A NULL pointer dereference occurs in the MMS Write Named Variable List handler. A network adjacent attacker can cause the server to crash by sending a WriteReque...

capstone: Capstone: Denial of Service vulnerability via crafted input

A flaw was found in the Capstone disassembly framework. This vulnerability, a null pointer dereference, can be exploited by a remote attacker. By providing a specially crafted input containing a specific 4-byte sequence during the disassembly of 3DNow! opcodes, the attacker can cause any...

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing

A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...

CVE-2026-55717 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...