PT-2026-96861

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.14.2-tuxcare.3...

PT-2026-96862

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.19.0-tuxcare.2...

PT-2026-78845

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.7 Wireshark versions 4.4.0 through 4.4.18 Description A buffer over-read in the ERF file parser can lead to a crash, resulting in a denial of service. Recommendations At the moment, there is no information...

PT-2026-78846

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.4.0 through 4.4.18 Wireshark versions 4.6.0 through 4.6.7 Description A crash occurs in the Tektronix K12xx file parser, which can lead to a denial of service. Recommendations Update Wireshark versions 4.4.0 through 4.4.18...

PT-2026-78863

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.7 Wireshark versions 4.4.0 through 4.4.18 Description An abnormal exit in the BUSMASTER file parser allows a denial of service. Recommendations At the moment, there is no information about a newer version...

CVE-2026-76884: Buffer Over-read

ERF file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

PT-2026-78684

The HL7800 cellular modem driver's +CGCONTRDP: response handler on cmd atcmdinfo ipaddr in drivers/modem/vendor standalone/hl7800.c parses the PDP-context dynamic parameters local address, subnet mask, gateway, and DNS servers that the cellular network assigns to the device. The response is...

PT-2026-80792

Name of the Vulnerable Software and Affected Versions Drupal Link content parser affected versions not specified Description A security issue exists within the Drupal Link content parser. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

CVE-2026-50719

The Ingenic T41 , and likely the T32, T40, and A1 SoCs, are vulnerable in their boot ROMs due to an improper handling of the SPL header init table. The boot ROM parses and executes an attacker-controlled init table before performing secure boot state checks or signature verification. Because the ...

PT-2026-78521

Name of the Vulnerable Software and Affected Versions Cisco BroadWorks affected versions not specified Description An issue in the Open Client Interface OCI XML Parser allows an unauthenticated remote attacker to read sensitive configuration information. This occurs because the parser improperly...

CVE-2026-76929: Out-of-bounds Read

Pcapng file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

CVE-2026-52854

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...

UBUNTU-CVE-2026-52854

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...

CVE-2026-52854 mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...

CVE-2026-52854 mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...

EUVD-2026-62200

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...

CVE-2026-50142 libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse applies maxsequenceframes only to...

CVE-2026-50142 libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check)

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse applies maxsequenceframes only to...

CVE-2026-50142

libheif 1.19.0–1.23.0 is vulnerable to denial-of-service via crafted HEIF sequences: Box_stsz::parse() omits bound checks in fixed-size mode, and Track::load() 32-bit arithmetic wraparound bypasses consistency checks, allowing multi-gigabyte allocations. No in-the-wild exploitation reported. Fixe...

CVE-2026-50142

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heifcontextreadfrommemory with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seqboxes.cc, Boxstsz::parse applies maxsequenceframes only to...