Astra Linux – Vulnerability in CGal

There are multiple code execution vulnerabilities in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malformed file can lead to an out-of-bounds read and type confusion, which could result in code execution. An attacker can provide malicious input to trigger...

Astra Linux – Vulnerability in http-parser

Node.js versions before 10.23.1, 12.20.1, 14.15.4, and 15.5.1 allow for two copies of a header field in an HTTP request for example, two Transfer-Encoding header fields. In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling...

Astra Linux – Vulnerability in Wireshark

The K12 RF5 file parser crashes in Wireshark versions 4.6.0 to 4.6.4, and 4.4.0 to 4.4.14, causing a denial of service...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd: Fixed an out-of-bounds error in the BIOS parser. The array size is hardcoded to 8 in atomfirmware.h, but sometimes the firmware uses a larger array size. Dereferencing the larger array causes an out-of-bounds error. T...

Security Bulletin: IBM MQ .NET client is vulnerable to XML external entity injection (CVE-2026-12667)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the IBM MQ .NET client's RFH2 message parser Vulnerability Details CVEID:CVE-2026-12667 DESCRIPTION: IBM MQ could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service...

Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13287)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer monitor result parser Vulnerability Details CVEID:CVE-2026-13287 DESCRIPTION: IBM MQ is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could...

Security Bulletin: IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVE-2026-13285)

Summary IBM MQ has addressed an XML external entity XXE vulnerability in the Managed File Transfer template parser Vulnerability Details CVEID:CVE-2026-13285 DESCRIPTION: IBM MQ is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit...

Exploit for CVE-2026-85706

CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read...

CLSA-2026-1789376231 TuxCare security update for fast-xml-parser (1 CVE)

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.1-tuxcare.2...

CVE-2026-90783

A flaw was found in MKVToolNix. An attacker can exploit this vulnerability by crafting a malicious AVI Audio Video Interleave file. When the mkvmerge tool processes this file, an integer wraparound in the bundled avilib library's ODML OpenDML superindex parser leads to an undersized memory...

CVE-2026-90716: Out-of-bounds Read

A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parsenumberexpression of the file src/compiler/gravityparser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The...

The vulnerability of the pcapng file parser used by the Wireshark network traffic analyzer allows a hacker to cause a service failure.

The vulnerability of the pcapng file parser in the Wireshark network traffic analyzer is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow attackers to cause service failures...

CVE-2026-90816: Improper Resource Shutdown or Release

A vulnerability was found in FFmpeg 8.0.x. This affects the function parseplaylist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/targetduration results in denial of service. The attack is possible to be carried out remotely...

CVE-2026-90994: Out-of-bounds Read

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

PT-2026-91200

A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse number expression of the file src/compiler/gravity parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. Th...

PT-2026-91456

Name of the Vulnerable Software and Affected Versions FFmpeg version 8.0.x Description A remote denial of service can be triggered through the manipulation of the duration or target duration arguments. This issue occurs within the parse playlist function located in the libavformat/hlsproto.c file...

PT-2026-97770

TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.1-tuxcare.2...

PT-2026-91177

Name of the Vulnerable Software and Affected Versions marcobambini Gravity versions prior to 0.9.8 Description A weakness in the JSON parser component, specifically within an unknown function in the src/utils/gravity json.c file, allows for remote memory corruption. Memory corruption occurs when ...

Important: expat

Issue Overview: libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, CVE-2026-50219 libexpat before 2.8.2 lacks handler...

PT-2026-91201

A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb clear parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be...