CVE-2026-107169 M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8

A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting in a Denial of Service DoS...

Linux Distros Unpatched Vulnerability : CVE-2026-93078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cxl/features: Reject Set Features output buffer smaller than the header cxlctlsetfeature sizes its output buffer from the user's fwctlrpc.outlen but never check...

CVE-2026-93078 cxl/features: Reject Set Features output buffer smaller than the header

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Set Features output buffer smaller than the header cxlctlsetfeature sizes its output buffer from the user's fwctlrpc.outlen but never checks it is large enough to hold even the fwctlrpccxlout header. With...

CVE-2026-93078

CVE-2026-93078 is a vulnerability in the Linux kernel 's cxl/features subsystem. The function cxlctl_set_feature() sizes its output buffer from the user-supplied fwctl_rpc.out_len without verifying it is large enough to hold the fwctl_rpc_cxl_out header. When out_len is zero, kvzalloc() returns Z...

PT-2026-94876

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cxlctl set feature function where the output buffer size is determined by the user-provided fwctl rpc.out len without verifying if it is large enough to accommodat...

CVE-2026-15461

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

CVE-2026-15461

Zephyr RTOS HL78xx modem GNSS driver contains a type confusion caused by a struct member offset mismatch: struct gnss_nmea0183_match_data was placed as the second member instead of the first, so NMEA parse callbacks read and write state at a shifted offset. The GSV callback reads a bogus pointer ...

CVE-2026-15461 Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

CVE-2026-15461 Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

CVE-2026-15461 Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

EulerOS 2.0 SP12 : alsa-lib (EulerOS-SA-2026-3322)

According to the versions of the alsa-lib packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The Advanced Linux Sound Architecture ALSA library before 1.2.16.1 contains a double-free vulnerability in parsedef in src/conf.c that allows...

EulerOS 2.0 SP12 : alsa-lib (EulerOS-SA-2026-3247)

According to the versions of the alsa-lib packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The Advanced Linux Sound Architecture ALSA library before 1.2.16.1 contains a double-free vulnerability in parsedef in src/conf.c that allows...

DEBIAN-CVE-2026-84965

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently larg...

CVE-2026-84965

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently larg...

Amazon Linux 2 : alsa-lib, --advisory ALAS2-2026-3874 (ALAS-2026-3874)

The version of alsa-lib installed on the remote host is prior to 1.1.4.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3874 advisory. The Advanced Linux Sound Architecture ALSA library before 1.2.16.1 contains a double-free vulnerability in parsedef in src/conf....

Medium: alsa-lib

Issue Overview: The Advanced Linux Sound Architecture ALSA library before 1.2.16.1 contains a double-free vulnerability in parsedef in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration...

PT-2026-89519

Name of the Vulnerable Software and Affected Versions Tesseract versions prior to 5.5.4 Description The Classify::ReadIntTemplates function in src/classify/intproto.cpp fails to validate the NumClassPruners, NumClasses, and NumProtoSets values read from the TESSDATA INTTEMP component of a crafted...

PT-2026-69625

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the alvium ctrl init function where several controls are created and the returned pointers are used without validation. This can lead to write access over a...

CVE-2026-5857

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...

CVE-2026-5857

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...