CVE-2026-40691

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger th...

CVE-2026-63932

A flaw was found in the Linux kernel's mhz19b driver, which handles Winsen MHZ19B CO2 sensors. The mhz19breceivebuf function does not properly validate the size of incoming serial replies before copying them into a fixed-size buffer. A remote attacker could exploit this by sending an oversized...

CVE-2026-63932

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

CVE-2026-63932 iio: chemical: mhz19b: reject oversized serial replies

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

EUVD-2026-45705

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

CVE-2026-63932

In the Linux kernel IIO chemical mhz19b driver, mhz19b_receive_buf() appends serdev chunks into a fixed MHZ19B_CMD_SIZE buffer and advances buf_idx without ensuring fit, enabling a potential overflow of st->buf from a large callback. The patch resets the reply state before each command and rej...

CLSA-2026-1777054556 squid: Fix of 2 CVEs

CVE-2022-41317: fix exposure of sensitive cache manager information via non-HTTP URI schemes due to typo in default manager ACL regex - CVE-2023-49288: fix use-after-free in StoreEntry::startWriting reachable via oversized replies with collapsedforwarding enabled...