CVE-2026-76929

A flaw was found in Wireshark. A local attacker, by enticing a user to open a specially crafted Pcapng file, could trigger an out-of-bounds read vulnerability in the Pcapng file parser. This could lead to an application crash, resulting in a denial of service. Mitigation To mitigate this...

Security Bulletin: Due to the use of Bouncy Castle for Java, IBM Sterling Control Center is vulnerable to Uncontrolled Recursion(CVE-2026-59645)

Summary Bouncy Castle for Java is used by IBM Sterling Control Center as part of dependency in bcutil-jdk18on-1.81.jar Vulnerability Details CVEID:CVE-2026-59645 DESCRIPTION: In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. Thi...

PT-2026-96775

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0 Description The ELF parser in radare2 incorrectly handles PN XNUM, which is a special value used in ELF files to indicate that the number of program headers is stored elsewhere. The software allocates the...

PT-2026-96774

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0 Description The CPython bytecode .pyc marshal parser in radare2 contains a flaw where marshal readers accept a 32-bit string length without validating if the value overflows the size-plus-one allocation. When...

ROS-20260922-73-0013

A vulnerability in the WAV parser of the GStreamer multimedia framework allows for integer overflow when processing improperly formatted WAV files. This vulnerability enables a malicious actor to cause the application to terminate abnormally service failure...

PT-2026-96780

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0 Description The Mach-O LC DATA IN CODE parser trusts dataoff and datasize and allows a final partial record to be processed. When datasize is not a multiple of data in code entry, the last iteration reads beyond...

PT-2026-96781

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0 Description The NE relocation fixup-chain parser in radare2 lacks an active iteration limit or cycle detection. When opening a specially crafted NE executable where an in-bounds relocation entry points back to...

PT-2026-96782

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0 Description The Windows 64-bit crash-dump dmp64 parser fails to validate the PageCount of a physical-memory-run against the actual dump size. When opening a specially crafted full-memory Windows crash dump, the...

PT-2026-96826

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description LightRAG contains a Server-Side Request Forgery SSRF issue in its native markdown parser. The validated addresses function in lightrag/parser/markdown/parser.py fails to consistently decode IPv6...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: clamav (UTSA-2023-002120)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002120 advisory. A vulnerability in the filesystem image parser for Hierarchical File System Plus HFS+ of ClamAV could allow an unauthenticated, remote attacker to cause a denial of...

CVE-2026-81885: Allocation of Resources Without Limits or Throttling

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81886: Allocation of Resources Without Limits or Throttling

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loo...

CVE-2026-81879: Out-of-bounds Read

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PNXNUM handling was vulnerable because the ELF parser allocated the program-header array using the resolved PNXNUM count but several consumers still iterated with the original ephnum value...

CVE-2026-81884: Out-of-bounds Read

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LCDATAINCODE parser was vulnerable because the Mach-O LCDATAINCODE parser trusted dataoff and datasize and allowed a final partial record to be processed. The vulnerability is triggered...

CVE-2026-81882: Out-of-bounds Read

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable because the binary-property-list Unicode parser underallocated an uninitialized UTF-8 destination and did not guarantee NUL termination. The...

CVE-2026-81878: Integer Overflow or Wraparound

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable because the CPython marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocation. The...

CVE-2026-81881: Out-of-bounds Read

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical inde...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: clamav (UTSA-2023-001071)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001071 advisory. On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0...

firefox: thunderbird: Use-after-free in the DOM: HTML Parser component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: HTML Parser component...

urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser

A flaw was found in urllib3. This flaw allows a Denial of Service DoS through unbounded memory allocation when parsing chunk-encoded responses. A malicious server can send an excessively long chunk-size line without a newline, exhausting client memory and terminating the application...