EUVD-2026-101225

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

CVE-2026-110598

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

CVE-2026-110597 Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

CVE-2026-110597 Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

CVE-2026-110597

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

CVE-2026-110597 Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

CVE-2026-110597

Tinyexr versions through 3.2.0 are vulnerable to a heap out-of-bounds read in the ParseEXRMultipartHeaderFromMemory() function. The root cause is a stale remaining-size value that allows a crafted multi-part EXR file to bypass ReadAttribute() bounds checks. This can result in an application crash...

EUVD-2025-211089

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links,...

EUVD-2024-55799

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

CVE-2024-58392

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

CVE-2024-58392

PhysicsFS versions through 3.2.0 are vulnerable to an out-of-bounds read in the __PHYSFS_utf8codepoint() function. The root cause is an off-by-one cursor advance occurring when processing six-octet UTF-8 sequences . An attacker can provide a crafted archive containing entry names ending in these ...

CVE-2024-58392 PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

CVE-2024-58392 PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

wazuh-unauth-chain

Wazuh exploit-chain PoC fixed in 4.14.8 — CVE-2026-74034 / C...

K000162610: NGINX Gateway Fabric vulnerability CVE-2026-96615

Security Advisory Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition CRD and has an authenticated gRPC connection with NGINX Agent. A namespaced authenticated attacker with access to a service account may impersonate the authenticate...

EUVD-2026-101054

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

CVE-2026-98405

The Linux kernel contains a vulnerability in the smb client component within the parse_posix_sids() function. The issue stems from a missing iov bounds check , where sidsbuf_end is calculated using a server-supplied out_len without being validated against the actual iov_len. This allows a malicio...

CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in the IBM Netezza Appliance have been remediated in the latest security patch releases of NPS and Callhome. Vulnerability Details CVEID:CVE-2026-59999 DESCRIPTION: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over...