CVE-2020-37031 Simple Startup Manager 1.17 - 'File' Local Buffer Overflow

Simple Startup Manager 1.17 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory through the 'File' input parameter. Attackers can craft a malicious payload with 268 bytes to trigger code execution, bypassing DEP and overwriting memo...

PT-2026-5483

Name of the Vulnerable Software and Affected Versions 10-Strike Bandwidth Monitor version 3.9 Description The software contains a buffer overflow issue that allows attackers to bypass SafeSEH, ASLR, and DEP protections. Exploitation occurs through crafted input sent to the application’s...

PT-2026-5486

Name of the Vulnerable Software and Affected Versions Frigate version 3.36.0.9 Description Frigate version 3.36.0.9 contains a local buffer overflow in the Command Line input field. An attacker can exploit this to execute arbitrary code by crafting a malicious payload that overflows the buffer,...

SUSE-SU-2026:20390-1 Security update for the Linux Kernel (Live Patch 4 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise kernel 6.4.0-24.1 fixes one security issue The following security issue was fixed: - CVE-2025-38588: ipv6: prevent infinite loop in rt6nlmsgsize bsc1249241. The following non security issue was fixed: - fix addrbitset issue on big-endian machines bsc12569...

SUSE-SU-2026:0336-1 Security update for libxml2

This update for libxml2 fixes the following issues: - CVE-2026-0989: Fixed call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth when resolving directives bsc1256805...

PT-2026-37485

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The imx rproc elf find loaded rsc table function may incorrectly report a loaded resource table when the current firmware does not provide one. This occurs because when the device tree...

The vulnerability of the Suricata intrusion detection and prevention system, due to the unlimited distribution of resources, allows an intruder to trigger a service failure.

The vulnerability of the Suricata intrusion detection and prevention system is related to the unlimited distribution of resources during DNP3 traffic analysis. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

SUSE-SU-2026:0327-1 Security update for alloy

This update for alloy fixes the following issues: Update to 1.12.2: Security fixes: - CVE-2025-68156: github.com/expr-lang/expr/builtin: Fixed potential DoS via unbounded recursion bsc1255333: - CVE-2025-31133, CVE-2025-52565, CVE-2025-52881: github.com/opencontainers/runc: Fixed container...

kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGACMDMAXDATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access...

CVE-2026-22263

Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, inefficiency in http1 headers parsing can lead to slowdown over multiple packets. Version 8.0.3 patches the issue. No known workarounds are available...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005084)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005084 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that ha...

A week in security (January 19 – January 25)

Last week on Malwarebytes Labs: Spammers abuse Zendesk to flood inboxes with legitimate-looking emails, but why? Fake LastPass maintenance emails target users Under Armour ransomware breach: data of 72 million customers appears on the dark web Can you use too many LOLBins to drop some RATs?...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-004954)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004954 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: scsitransportsas: Fix error handling in sasphyadd If transportadddevice fails in sasphyadd,...

CVE-2026-23005

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATEBVi in guest XSAVE state whenever XFDi=1 When loading guest XSAVE state via KVMSETXSAVE, and when updating XFD in response to a guest WRMSR, clear XFD-disabled features in the saved or to be restored XSTATEBV...

CVE-2026-23011

CVE-2026-23011: In the Linux kernel, ip_gre: make ipgre_header() robust to prevent skb under_panic when a device (e.g., bonding/team) changes dev->needed_headroom or dev->hard_header_len. The crash described involves mld_newpack/mld_sendpack path with an skb that had insufficient headroom, ...

CVE-2026-24553

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Retrieve Embedded Sensitive Data.This issue affects Fraud Prevention For Woocommerce: fro...

CVE-2025-71158 gpio: mpsse: ensure worker is torn down

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: ensure worker is torn down When an IRQ worker is running, unplugging the device would cause a crash. The sealevel hardware this driver was written for was not hotpluggable, so I never realized it. This change uses a...

CVE-2026-24553

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Retrieve Embedded Sensitive Data.This issue affects Fraud Prevention For Woocommerce: fro...

CVE-2026-24553

CVE-2026-24553 describes an exposure of embedded sensitive data in the WordPress plugin “Fraud Prevention For WooCommerce” (also listed as woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers) affecting versions n/a through 2.3.1. The vulnerability is a data exposure flaw that could...

CVE-2026-24553 WordPress Fraud Prevention For Woocommerce plugin <= 2.3.2 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Retrieve Embedded Sensitive Data.This issue affects Fraud Prevention For Woocommerce: fro...