CVE-2026-51807

Heap-based out-of-bounds write in j2kprecinctsubband::parsepacketheader in OpenHTJ2K versions 0.18.3 and earlier fixed in v0.18.4 caused by missing bounds validation before coding-pass lengths are written to j2kcodeblock::passlength128. A crafted JPEG 2000 codestream containing malformed PPM pack...

SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2914-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2914-1 advisory. The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-53995:...

PT-2026-58862

Name of the Vulnerable Software and Affected Versions OpenHTJ2K versions prior to 0.18.5 Description A buffer overflow exists that allows an attacker to execute arbitrary code. The issue occurs within the j2k precinct subband::parse packet header function located in source/core/coding/coding...

CVE-2026-51807

Heap-based out-of-bounds write in j2kprecinctsubband::parsepacketheader in OpenHTJ2K versions 0.18.3 and earlier fixed in v0.18.4 caused by missing bounds validation before coding-pass lengths are written to j2kcodeblock::passlength128. A crafted JPEG 2000 codestream containing malformed PPM pack...

CVE-2026-51807

Heap-based out-of-bounds write in j2kprecinctsubband::parsepacketheader in OpenHTJ2K versions 0.18.3 and earlier fixed in v0.18.4 caused by missing bounds validation before coding-pass lengths are written to j2kcodeblock::passlength128. A crafted JPEG 2000 codestream containing malformed PPM pack...

CVE-2026-51807

Heap-based out-of-bounds write in j2kprecinctsubband::parsepacketheader in OpenHTJ2K versions 0.18.3 and earlier fixed in v0.18.4 caused by missing bounds validation before coding-pass lengths are written to j2kcodeblock::passlength128. A crafted JPEG 2000 codestream containing malformed PPM pack...

binutils: GNU Binutils Linker heap-based overflow

A head based buffer overflow flaw has been discovered in GNU bin utilities. Impacted is the function bfdelfparseehframe of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution...

PYSEC-2026-2788 Open Babel has out-of-bounds write in CSR PadString (title field)

Summary A memory-safety vulnerability in Open Babel's CSR parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the PadString helper used to handle the CSR title field. A title longer than the fixed destination buffer caused the parser to write past the...

PYSEC-2026-3040 python-multipart: Negative Content-Length in parse_form buffers the entire body in memory

Summary parseform did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. Details...

PYSEC-2026-2991 pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API

Summary The SSRF mitigation added in commit 33c55da for GHSA-7gvf-3w72-p2pg is incomplete. The PREREQFUNCTION-based private IP check was correctly applied to HTTPChunk download path but not to HTTPRequest used by the parseurls API. An authenticated attacker can supply a URL pointing to an...

PYSEC-2026-2988 pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter

Vulnerability Details CWE-918: Server-Side Request Forgery SSRF The parseurls API function in src/pyload/core/api/init.py line 556 fetches arbitrary URLs server-side via geturlurl pycurl without any URL validation, protocol restriction, or IP blacklist. An authenticated user with ADD permission...

PYSEC-2026-2670 multipart vulnerable to ReDoS in `parse_options_header()`

Summary The parseoptionsheader function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking ReDoS when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service DoS attacks against web...

PYSEC-2026-3411 vLLM has SSRF Protection Bypass

Summary The SSRF protection fix for https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc can be bypassed in the loadfromurlasync method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. Affected Component - File:...

PYSEC-2026-2561 Denial of service in langchain-community

Denial of service in SitemapLoader Document Loader in the langchain-community package, affecting versions below 0.2.5. The parsesitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap...

SUSE-SU-2026:2885-1 Security update for alsa

This update for alsa fixes the following issue - CVE-2026-56109: double-free vulnerability in parsedef in src/conf.c that can allow attackers to corrupt memory bsc1268853...

CVE-2026-10666

parseipv4 in subsys/net/ip/utils.c reached via netipaddrparse for strings of the form "a.b.c.d:port" copies the port substring into a fixed 17-byte stack buffer char ipaddrNETIPV4ADDRLEN + 1 using a length of strlen - end - 1, where strlen is the full, unbounded input length and end is only the...

Unchecked Return Value

Overview Magick.NET-Q16-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Unchecked Return Value

Overview Affected versions of this package are vulnerable to Unchecked Return Value through XMP profile parsing in MagickCore/xml-tree.c's ParseEntities routine. An attacker can trigger a crash by supplying a crafted XMP profile that drives the parser down the affected code path and dereferences...

Unchecked Return Value

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Unchecked Return Value

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...