DEBIAN-CVE-2026-58472

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity...

EUVD-2026-40020

A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/baseencoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The exploit has been made available to the...

UBUNTU-CVE-2026-6681

The PKCS7 decode path ignores the caller-supplied output buffer size outputSz, allowing decoded content to be written past the bounds of the provided buffer. This affects wolfSSL 5.9.0 and earlier and was fixed in the 5.9.1 release...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Media: ccs – Avoid possible division by zero Calculating the maximum value of M for scaler configuration involves dividing by the value of the MINXOUTPUTSIZE limit register. Although this value is presumably non-zero, the driver...

[SECURITY] Fedora 44 Update: perl-Crypt-Argon2-0.031-1.fc44

This module implements the Argon2 key derivation function, which is suitable to convert any password into a cryptographic key. This is most often used to for secure storage of passwords but can also be used to derive a encryption key from a password. It offers variable time and memory costs as we...

[SECURITY] Fedora 43 Update: perl-Crypt-Argon2-0.031-1.fc43

This module implements the Argon2 key derivation function, which is suitable to convert any password into a cryptographic key. This is most often used to for secure storage of passwords but can also be used to derive a encryption key from a password. It offers variable time and memory costs as we...

Astra Linux – Vulnerability in Netty

The Bzip2 decompression decoder function does not allow setting size restrictions on the decompressed output data which affects the allocation size used during decompression. This affects all users of Bzip2Decoder. Malicious inputs can trigger an OOME, thereby causing a DoS attack...

PT-2026-37522

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A division by zero issue exists in the media: ccs component. The driver fails to verify that the MIN X OUTPUT SIZE limit register's value is non-zero when calculating the maximum M for...

PT-2026-31348

Name of the Vulnerable Software and Affected Versions: LiquidJS versions prior to 10.25.3 Description: LiquidJS is a template engine. A flaw exists in the 'replace' filter when the 'memoryLimit' option is enabled. The memory usage calculation incorrectly accounts for the size of the output string...

GHSA-VC68-257W-M432 OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)

Summary The PXR24 decompression function undopxr24impl in OpenEXR internalpxr24.c ignores the actual decompressed size outSize returned by exruncompressbuffer and instead reads from the scratch buffer based solely on the expected size uncompressedsize derived from the header metadata. Additionall...

CVE-2026-29112

DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the ensureSize function in @dicebear/converter read the width and height attributes from the input SVG to determine the output canvas size for rasterization PNG, JPEG, WebP, AVIF. An attacker who can supply a...

Allocation of Resources Without Limits or Throttling

Overview Scriban is a Scriban is a fast, powerful, safe and lightweight scripting language and engine for .NET, which was primarily developed for text templating with a compatibility mode for parsing liquid templates. Today, not only Scriban can be used in text templating scenarios, but also can ...

Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter

Impact The ensureSize function in @dicebear/converter versions 9.4.0 read the width and height attributes from the input SVG to determine the output canvas size for rasterization PNG, JPEG, WebP, AVIF. An attacker who can supply a crafted SVG with extremely large dimensions e.g. width="999999999"...

CVE-2026-30910

Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation, and bin2hex functions do not check that output size will be less than SIZEMAX, which could lead to integer wraparound causing an undersized output buffer...

CVE-2026-30909 Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows

Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows. bin2hex, encrypt, aes256gcmencryptafternm and seal functions do not check that output size will be less than SIZEMAX, which could lead to integer wraparound causing an undersized output buffer. Encountering this...

CVE-2026-30909 Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows

Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows. bin2hex, encrypt, aes256gcmencryptafternm and seal functions do not check that output size will be less than SIZEMAX, which could lead to integer wraparound causing an undersized output buffer. Encountering this...

CVE-2022-23576

Tensorflow is an Open Source Machine Learning Framework. The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. We can have a large enough number ...

EUVD-2021-0425

Malware in sbrugna...

EUVD-2021-2064

Malware in sbrugna...

EUVD-2022-0324

Malicious code in bioql PyPI...