CVE-2026-24783 soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives

soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the mulDivx, y, z function incorrectly handled cases where both the intermediate product $x y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was...

CVE-2026-24783 soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives

soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the mulDivx, y, z function incorrectly handled cases where both the intermediate product $x y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was...

PT-2026-5030

Name of the Vulnerable Software and Affected Versions soroban-fixed-point-math versions 1.3.0 through 1.4.0 Description The mulDivx, y, z function in soroban-fixed-point-math incorrectly handles cases where both the intermediate product x y and the divisor z are negative. The logic incorrectly...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to URL validation bypass [CVE-2025-56200]

Summary node.js module validator is used by IBM App Connect Enterprise Certified Container for data validation. IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationRuntime and IntegrationServer operands are vulnerable to URL validation bypass. This bulletin provides patch...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality [CVE-2025-59343]

Summary Node.js module tar-fs is used by IBM App Connect Enterprise Certified Container for processing tar files and streams. IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to HTTP parameter pollution [CVE-2025-7783]

Summary Node.js module form-data is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands are vulnerable to HTTP parameter pollution. This bulletin provides patch information to address the reported vulnerability in Node.js module form-dat...

PT-2024-40622 · Pcre2 · Pcre2

Name of the Vulnerable Software and Affected Versions: PCRE2 affected versions not specified Description: The issue is related to a stack-buffer-overflow write error. Technical details about the crash include the compile class operand and pcre2 compile class nested 16 functions. No information is...

DEBIAN-CVE-2024-36948

In the Linux kernel, the following vulnerability has been resolved: drm/xe/xemigrate: Cast to output precision before multiplying operands Addressing potential overflow in result of multiplication of two lower precision u32 operands before widening it to higher precision u64. -v2 Fix commit messa...

CVE-2024-36948

In the Linux kernel, the following vulnerability has been resolved: drm/xe/xemigrate: Cast to output precision before multiplying operands Addressing potential overflow in result of multiplication of two lower precision u32 operands before widening it to higher precision u64. -v2 Fix commit messa...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel, which stems from an incorrect ordering of operands passed to the TLBI RANGE instruction, which can cause the target virtual...

PT-2024-27219

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a potential overflow in the result of the multiplication of two lower precision u32 operands before widening it to higher precision u64 in the drm/xe/xe migrate...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to server-side request forgery due to [CVE-2023-28155]

Summary Node.js module Request is used by IBM App Connect Enterprise Certified Container operands for both internal and external HTTP calls. IBM App Connect Enterprise Certified Container operands are vulnerable to server-side request forgery. This bulletin provides patch information to address t...

SUSE CVE-2015-2151

The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service memory corruption, or possibly execute arbitrary code via unspecified vectors...

SUSE CVE-2018-20460

In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service application crash caused by stack-based buffer overflow by crafting an input file...

CVE-2021-23434

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === 'proto' returns false if currentPath is 'proto'. This is because t...

TSX Asynchronous Abort speculative side channel

ISSUE DESCRIPTION This is very closely related to the Microarchitectural Data Sampling vulnerabilities from May 2019. Please see https://xenbits.xen.org/xsa/advisory-297.html for details about MDS. A new way to sample data from microarchitectural structures has been identified. A TSX Asynchronous...

radare2 'parseOperands' function stack buffer overflow vulnerability

radare2 is a set of libraries and tools for working with binary files. A stack buffer overflow vulnerability exists in the 'parseOperands' function in the libr/asm/arch/arm/armass64.c file in radare2 versions prior to 3.1.2. An attacker can exploit this vulnerability to cause a denial of service...

UBUNTU-CVE-2018-20460

In radare2 prior to 3.1.2, the parseOperands function in libr/asm/arch/arm/armass64.c allows attackers to cause a denial-of-service application crash caused by stack-based buffer overflow by crafting an input file...

Linux Kernel 'drivers/acpi/acpica/nseval.c' Local Information Disclosure Vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A local information disclosure vulnerability exists in the 'acpinsevaluate' function in the drivers/acpi/acpica/nseval.c file in Linux kernel versions 4.12.9 and earlier, whic...

Linux Kernel 'drivers/acpi/acpica/dsutils.c' Local Information Disclosure Vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A local information disclosure vulnerability exists in the 'acpidscreateoperands' function in the drivers/acpi/acpica/dsutils.c file in Linux kernel 4.12.9 and earlier, which...