Libyal libpff numerical error vulnerability

Versions of libyal libpff prior to 20260926 contain a numerical error vulnerability. This vulnerability stems from an off-by-one boundary check in libpfftableread6crecordentries. Attackers can exploit specially crafted entries within the 6c table to trigger heap-based out-of-bounds reads. Providi...

PT-2026-123448

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.32.0 Description An off-by-one error in the calculation of max token id within vllm/tokenizers/hf.py allows a pre-tokenized prompt ID equal to the vocabulary size to pass validation. When the tensor-parallel size is on...

vLLM input validation error vulnerability

Versions prior to vLLM 0.32.0 contain a security vulnerability. This vulnerability arises from an off-by-one error in the upper bound calculation of maxtokenid within vllm/tokenizers/hf.py. As a result, pre-tokenized prompt IDs equaling the size of the vocabulary can pass validation. When the...

PT-2026-132750

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/hf.py computes max token id with an off-by-one upper bound, allowing a pre-tokenized prompt ID equal to the vocabulary size to pass validation. For a tensor-parallel size of one and an exact...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2026:1792768772)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792768772 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Include...

CVE-2026-98835

A flaw was found in the Linux kernel's Kionix KX022A accelerometer driver. A local user could trigger a Denial of Service DoS or kernel memory disclosure due to an off-by-one array bounds validation check when converting device register values to array indices. This flaw leads to an out-of-bounds...

CVE-2026-79981

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dnsresolveinitlocked - registerdispatcher - dnsdispatcherregister, with the local port left at 0 so the stack picks an ephemeral port exactly once. dnswrite th...

CVE-2026-79977

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handletransportdata, when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the...

CVE-2026-79981 DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dnsresolveinitlocked - registerdispatcher - dnsdispatcherregister, with the local port left at 0 so the stack picks an ephemeral port exactly once. dnswrite th...

CVE-2026-79981 DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dnsresolveinitlocked - registerdispatcher - dnsdispatcherregister, with the local port left at 0 so the stack picks an ephemeral port exactly once. dnswrite th...

CVE-2026-79981 DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dnsresolveinitlocked - registerdispatcher - dnsdispatcherregister, with the local port left at 0 so the stack picks an ephemeral port exactly once. dnswrite th...

CVE-2026-79981

The Zephyr RTOS DNS stub resolver (specifically in subsys/net/lib/dns/resolve.c) contains a vulnerability where it binds a single UDP socket per configured server during initialization. Because the source port remains constant for the lifetime of the resolver context while only the 16-bit transac...

CVE-2026-79977 WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handletransportdata, when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the...

CVE-2026-79977 WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handletransportdata, when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the...

CVE-2026-79977 WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handletransportdata, when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the...

Security Bulletin: IBM MQ Appliance is affected by an off-by-one buffer overflow vulnerability (CVE-2026-12727)

Summary IBM MQ Appliance has addressed an off-by-one buffer overflow vulnerability that could allow an authenticated attacker to cause potential process instability when processing specially crafted object names. Vulnerability Details CVEID:CVE-2026-12727 DESCRIPTION: IBM MQ could allow an...

Linux Distros Unpatched Vulnerability : CVE-2026-114460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in modqos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Off-by-one Error in Libreswan (CVE-2026-12413)

Summary IBM Watson Speech Services Cartridge is vulnerable to a Off-by-one Error in Libreswan, due to an invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Libreswan is used in our Speech runtimes. This vulnerability has been addressed. Please read the...

GHSA-H3V5-H239-PG29 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

Impact In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the main process. A compromised GPU process could cause the main process to read out-of-bounds memory while producing paint event images, disclosing memory or crashing the app...

npm: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

npm: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry vulnerability discovered by ? in WordPress npm electron versions 42.11.6...