PT-2026-104952

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: bound aligned TLV advance in FW parser Validate ALIGNtlv len, 4 against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs...

PT-2026-97989

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An issue exists in the iwlwifi driver within the firmware parser. The parser fails to validate the ALIGNtlv len, 4 calculation against the remaining length of the firmware image before...

Linux Distros Unpatched Vulnerability : CVE-2026-81879

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's ELF PNXNUM handling was vulnerable because the ELF pars...

Linux Distros Unpatched Vulnerability : CVE-2026-93789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: bound aligned TLV advance in FW parser Validate ALIGNtlvlen, 4 against remaining parser length before consuming bytes from the firmware image. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-81886

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable...

CVE-2026-88358

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...

Linux Distros Unpatched Vulnerability : CVE-2026-81882

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser was vulnerable...

Linux Distros Unpatched Vulnerability : CVE-2026-81881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable becau...

Linux Distros Unpatched Vulnerability : CVE-2026-81878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable...

Linux Distros Unpatched Vulnerability : CVE-2026-93543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. CVE-2026-93543 Note...

Linux Distros Unpatched Vulnerability : CVE-2026-81884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O LCDATAINCODE parser was vulnerable because the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libevent (UTSA-2026-124537)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124537 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding...

CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

PT-2026-99157

Name of the Vulnerable Software and Affected Versions jackson-core versions 2.16.0 through 2.18.0 jackson-core versions 3.0.0 through 3.0.0 Description Parsers built over character input, such as Reader, String, or char sources served by ReaderBasedJsonParser, fail to properly apply the...

CVE-2026-88358

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...

EUVD-2026-86315

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-88382: Allocation of Resources Without Limits or Throttling

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

SUSE CVE-2026-96280

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize 32 bits on 32-bit systems, causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an O...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

Jawn: Quadratic parsing effort in AsyncParser

AsyncParser can be forced to perform On^2 work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start. Impact Denial of service via CPU exhaustion when parsing untrusted JSON. Preconditions: - Application...