CVE-2026-110654: Out-of-bounds Write

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbidecode with every slot set to...

CVE-2026-19673: Out-of-bounds Read

ethernetrecv in subsys/net/l2/ethernet/ethernet.c validates only that the first netbuf of a received frame holds a plain 14-byte struct netethhdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct netethvlanhdr without...

FreeBSD-SA-26:70.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:70.tcp Security Advisory The FreeBSD Project Topic: Remotely triggerable buffer overflow in tcprack Category: core Module: tcprack Announced: 2026-10-14...

MiracleLinux 8 : kernel-4.18.0-553.171.1.el8_10 (AXSA:2026-2037:98)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2037:98 advisory. kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition CVE-2025-39994 kernel: gfs2: Fix unlikely race in gdlmputlock...

CVE-2026-86849: Out-of-bounds Write

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend...

FreeBSD-SA-26:72.bhyve

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:72.bhyve Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in bhyve device models Category: core Module: bhyve Announced: 2026-10-14...

MiracleLinux 9 : tftp-5.2-40.el9_8.1 (AXSA:2026-2044:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2044:02 advisory. tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine CVE-2026-85234 Tenable has extracted the preceding description block direct...

CVE-2026-110735: Signed to Unsigned Conversion Error

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader core/io/resourceformatbinary.cpp, ResourceLoaderBinary::getunicodestring. A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a...

FreeBSD -- Remotely triggerable buffer overflow in tcp_rack

Problem Description: When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer...

CVE-2026-75085: Out-of-bounds Read

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...

CVE-2026-101946: Out-of-bounds Read

An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent low-privilege attacker to disclose limited rpd process memory and disrupt an LDP adjacency via an IPv6 LDP message...

CVE-2026-98419: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...

CVE-2024-58392: Out-of-bounds Read

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

CVE-2026-100236: Out-of-bounds Write

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...

CVE-2026-100231: Out-of-bounds Write

A flaw was found in the GStreamer multimedia framework's ASF muxer plugin asfmux. When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane such as emoji to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE...

CVE-2026-100229: Out-of-bounds Write

A flaw was found in GStreamer's H.266 codec parser library libgstcodecparsers. An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could...

MiracleLinux 9 : compat-openssl11-1.1.1k-5.el9_8.6 (AXSA:2026-2042:05)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2042:05 advisory. openssl: heap buffer overflow in CMS key unwrapping CVE-2026-63072 openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer...

CVE-2026-98405

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

Linux Distros Unpatched Vulnerability : CVE-2026-93683

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory a...

Linux Distros Unpatched Vulnerability : CVE-2026-86848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to...