PT-2026-115154

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs reads...

PT-2026-115159

Game Music Emu libgme through 0.6.5 contains a global out-of-bounds read vulnerability in Classic Emu::mute voices that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip flags 0x3F,...

PT-2026-115160

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

PT-2026-115162

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init soundfont in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry...

PT-2026-115164

EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3 detect in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2 ISVALIDHEADER to msr3 parse or ms3 detect, over-reading up to 8 bytes and...

PT-2026-115165

libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf lef extended attribute read data because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application o...

PT-2026-115171

libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM Load because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and...

PT-2026-115262

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/load dsm.cpp because nPat is never checked against MAX PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt len value to corrupt heap memory and crash the...

PT-2026-115263

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/load ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:4651-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4651-1 advisory. - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser bsc1282981. - CVE-2025-14181:...

CVE-2026-110872

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

rpcbind security update

1.2.5-11 - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service statistics tracking allows unauthenticated remote denial of service Resolves: RHEL-266668...

rpcbind security update

1.2.6-7.1 - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service statistics tracking allows unauthenticated remote denial of service - Resolves: RHEL-266677...

CVE-2026-109855

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...

Rocky Linux 9 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc (crlsa-2026_82040)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly fr...

CVE-2026-110736

Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimizedtranslation.cpp, OptimizedTranslation::getmessage. Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation;...

CVE-2026-110735

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader core/io/resourceformatbinary.cpp, ResourceLoaderBinary::getunicodestring. A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a...

CVE-2026-88753

The trentm markdown2 library (through version v2.5.5 ) is vulnerable to a Regular-Expression Denial of Service (ReDoS) . The flaw exists within the extract_metadata() function located in the lib/markdown2.py file. An attacker can exploit this by providing a crafted Markdown document to trigger a ...

EUVD-2026-102186

A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service DoS via a crafted Markdown document...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : YAML-LibYAML vulnerabilities (USN-8925-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8925-1 advisory. Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection...