PT-2026-76860

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description An integer overflow occurs during image processing, which may lead to arbitrary code execution. This issue was addressed by...

CVE-2026-67967

Buffer Overflow vulnerability in Tenda W20E V16.01.0.62782 allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819...

CVE-2026-39255

A buffer overflow in SteelSeries GG v107.0.0 for macOS, located in the libSSEdevice.dylib library's dup_wcs function, allows an unauthenticated remote attacker to execute arbitrary code. CVSS 9.8 (Critical); no patch or exploit code is mentioned in the provided documents.

gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update

gstreamer1-plugins-bad-free 1.22.12-7.4 - Fix ADPCM decoder negotiation and input size check CVE-2026-19387 Resolves: RHEL-235496 gstreamer1-plugins-ugly-free 1.22.12-6.2 - Fix integer overflows during bounds checks in asfdemux - Resolves: RHEL-235519...

PT-2026-73273

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally...

PT-2026-73323

Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication...

Important: rust

Issue Overview: rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipherupdateinplace in openssl/src/cipherctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVPaes128,192,256wrappad. For a...

haproxy security update

3.0.5-6.2 - Fix uint16t overflow in FCGI demux record length CVE-2026-55203 Resolves: RHEL-211068 - Fix NULL pointer dereference in hpackdhtinsert CVE-2026-55204 Resolves: RHEL-211081...

389-ds:1.4 security update

1.4.3.39-26 - Bump version to 1.4.3.39-26 - Resolves: RHEL-183073 - EMBARGOED CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check rhel-8.10.z - Resolves: RHEL-190782 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref contro...

The vulnerability of APEI/GHES components in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of APEI/GHES components in Linux operating systems is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the rtl8xxxu_probe() function in the drivers/net/wireless/realtek/rtl8xxxu/core.c driver for Realtek wireless adapter drivers in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the rtl8xxxuprobe function in the drivers/net/wireless/realtek/rtl8xxxu/core.c file of the Realtek wireless adapter driver for the Linux operating system is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow a remot...

The vulnerability in the driver/net/ethernet/freescale/dpaa2/dpaa2-switch.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c component of the Linux operating system is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the ec_bhf component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the ecbhf component in the Linux operating system’s kernel is related to the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the `net/bluetooth/l2cap_core.c` component of the Linux operating system allows a hacker to gain access to confidential data and compromise its integrity.

The vulnerability of the net/bluetooth/l2capcore.c component in the Linux operating system is related to incorrect checking of the data size at the input stage. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity...

PT-2026-76871

Name of the Vulnerable Software and Affected Versions S2OPC version 1.7.3 Description A heap-based out-of-bounds write occurs during server-side EventFilter handling while processing CreateMonitoredItems. This flaw allows a remote attacker to execute arbitrary code. A heap-based out-of-bounds wri...

unbound security update

1.24.2-18 - Add unit tests for CVE-2026-44690,55973 1.24.2-17 - Fix CVE-2026-55973: dns-error-reporting stack buffer overflow 1.24.2-16 - Fix CVE-2026-44690 - Cross-zone wildcard cache poisoning...

CVE-2026-67868

S2OPC 1.7.3 has a heap-based out-of-bounds write in the server-side EventFilter handler invoked during CreateMonitoredItems processing, exploitable by an unauthenticated remote attacker to achieve arbitrary code execution (CVSS 9.8 critical). No patch version or exploit code is provided in the do...

Medium: gimp

Issue Overview: A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions ysize and zsize are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum valu...

PT-2026-73263

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100522)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100522 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accept...