404564 matches found
UBUNTU-CVE-2026-61666
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...
kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...
kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve()
A flaw was found in the Linux kernel's drm/amd/display component. The dalvectorreserve function calculates memory allocation size using 32-bit arithmetic, which can lead to an integer overflow. This overflow causes a smaller memory buffer to be allocated than intended, resulting in a heap overflo...
kernel: crypto: ccp - copy IV using skcipher ivsize
A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...
SUSE CVE-2026-49263
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...
USN-8629-2: Linux kernel (AWS) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - Network traffic control; - IPv4 networking; - IPv6...
GHSA-8R8V-XF7Q-RCPR New API: Integer overflow in quota billing yields negative charges (self-crediting)
Summary Multiple billing paths multiplied user-controlled quantity parameters into the quota calculation without an upper bound or overflow-safe integer conversion. A crafted extreme value e.g. image n = 18446744073686646784, a wrapped-negative accepted by a uint field makes conversions like...
New API: Integer overflow in quota billing yields negative charges (self-crediting)
Summary Multiple billing paths multiplied user-controlled quantity parameters into the quota calculation without an upper bound or overflow-safe integer conversion. A crafted extreme value e.g. image n = 18446744073686646784, a wrapped-negative accepted by a uint field makes conversions like...
EUVD-2026-60269
The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in oncmdsocknotifyev drivers/modem/vendorstandalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via netbuflinearize, which caps the copy at 39 bytes and returns outlen = 39. The two...
CVE-2026-12519
The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in oncmdsocknotifyev drivers/modem/vendorstandalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via netbuflinearize, which caps the copy at 39 bytes and returns outlen = 39. The two...
CVE-2026-12519
CVE-2026-12519 is an out-of-bounds stack read and write in the Zephyr RTOS WNC-M14A2A LTE-M modem driver, specifically in on_cmd_socknotifyev() (drivers/modem/vendor_standalone/wncm14a2a.c). Two quote-delimiter scanning loops were bounded by the full frame length (len) instead of the linearized b...
CVE-2026-71479
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...
CVE-2026-71479
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...
CVE-2026-71479 New API: Integer overflow in quota billing yields negative charges (self-crediting)
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...
CVE-2026-71479 New API: Integer overflow in quota billing yields negative charges (self-crediting)
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...
EUVD-2026-60262
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...
CVE-2026-71479
In New API (github.com/QuantumNous/new-api) before 1.0.0-rc.18, user-controlled billing multipliers (n, duration, max_tokens, etc.) lacked upper-bound validation and overflow-safe conversion in common/quota_math.go, causing integer overflow into negative settlement charges that credit attacker ac...
kernel: dlm: validate length in dlm_search_rsb_tree
A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...
kernel: netfilter: flowtable: strictly check for maximum number of actions
A flaw was found in the Netfilter flowtable component of the Linux kernel. This vulnerability occurs because the system does not strictly check the maximum number of hardware offload actions for IPv6, allowing it to process more actions than supported. This could potentially lead to system...
CVE-2026-45699
A flaw was found in Netatalk. An integer underflow vulnerability exists in the copydir function of the afpd daemon. This flaw occurs when a file operation crosses a device boundary within an Apple Filing Protocol AFP shared volume. Incorrect calculation of buffer size can lead to a stack-based...