CVE-2026-14368 Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser

The LwM2M JSON content formatter's getstring in subsys/net/lib/lwm2m/lwm2mrwjson.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if stringlength buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...

[SECURITY] Fedora 44 Update: expat-2.8.3-1.fc44

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource...

CVE-2026-79775

A flaw was found in rclone. The archive backend's SquashFS parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a malicious SquashFS image in storage exposed through an rclone :archive: remote can trigger multiple...

CVE-2026-48988

A flaw was found in markdown-it, a Markdown parser. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS when the typographer option is enabled. This occurs due to inefficient processing of smartquotes, leading to excessive CPU consumption when parsing specially...

CVE-2026-82880

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

CVE-2026-74866

A flaw was found in @fastify/busboy, a Node.js multipart form-data parser. The parser incorrectly handles lone carriage return or line feed characters in multipart part headers, treating them as part of the filename or field name rather than as line breaks. A remote attacker could exploit this by...

CVE-2026-82880

YaCy Search Server through 1.941 is affected by an XML External Entity (XXE) injection vulnerability in its SVG , FreeMind , and OpenSearch parsers, which fail to disable external entity resolution. An unauthenticated remote attacker can publish a malicious document containing a DOCTYPE declarati...

CVE-2026-82880 YaCy Search Server through 1.941 XML External Entity Injection via Parsers

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

CVE-2026-82880 YaCy Search Server through 1.941 XML External Entity Injection via Parsers

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

EUVD-2026-68466

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

CVE-2026-82880 YaCy Search Server through 1.941 XML External Entity Injection via Parsers

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files...

RHSA-2026:61247 Red Hat Security Advisory: libxml2 security update

Bulletin has no description...

CVE-2026-65315

A flaw was found in Ollama. A remote attacker can exploit an uncontrolled memory allocation vulnerability in the GGUF metadata parser. By supplying a specially crafted GGUF file, an attacker can manipulate length and count fields, leading to excessive memory allocation. This can cause the server ...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

PT-2026-83971

Name of the Vulnerable Software and Affected Versions GDB affected versions not specified Description A flaw exists in the STABS debug format parser within the read member functions function in gdb/stabsread.c. The issue stems from a linked list removal bug during the separation of destructor and...

PT-2026-89662

A flaw was found in GDB's STABS debug format parser. The read member functions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main...

CVE-2026-13732: Out-of-bounds Write

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

PT-2026-89661

A flaw was found in GDB's STABS debug format parser. The read member functions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main...