DEBIAN-CVE-2026-95114

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service...

CVE-2026-95114

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service...

CVE-2026-65200

The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An...

CVE-2026-105460

A stack-based out-of-bounds read vulnerability exists in the BlueZ project's btmon Bluetooth monitor tool. The flaw occurs within the return_link_keys_evt() function due to an unvalidated num_keys parameter when processing HCI Return Link Keys events. A maliciously crafted btsnoop capture file ca...

CVE-2026-105460 Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

EUVD-2026-98739

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-105460 Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-90261

A flaw was found in the btrfs zoned filesystem component of the Linux kernel. During metadata-heavy operations, a specific writeback scenario can prevent the system from properly managing active block groups. This issue can lead to a transaction abortion, forcing the filesystem into a read-only...

CVE-2026-90262

A flaw was found in the Linux kernel's btrfs filesystem. This flaw occurs when the btrfsreadmerkletreepage function encounters a Merkle folio that is not up-to-date. Instead of retrying the read, the system incorrectly treats this as a permanent error, causing transient read failures to become...

CVE-2026-81507

ESF-IDF is the Espressif Internet of Things IOT Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2cmain.c and l2cutils.c does not consistently validate option lengths against the remaining received packet bytes. A...

CVE-2026-81507 ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data

ESF-IDF is the Espressif Internet of Things IOT Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2cmain.c and l2cutils.c does not consistently validate option lengths against the remaining received packet bytes. A...

CVE-2026-81507 ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data

ESF-IDF is the Espressif Internet of Things IOT Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2cmain.c and l2cutils.c does not consistently validate option lengths against the remaining received packet bytes. A...

CVE-2026-81507

The ESF-IDF (Espressif IoT Development Framework) contains an out-of-bounds read vulnerability in the BlueDroid L2CAP configuration-option processing within l2c_main.c and l2c_utils.c. Due to inconsistent validation of option lengths against received packet bytes, a remote unauthenticated BR/EDR ...

CVE-2026-90257

A flaw was found in the kernel's virtiobt component. When processing responses to Zephyr vendor commands, the system fails to properly check the length of the received data. This can lead to an out-of-bounds read, where adjacent memory is accessed beyond the intended buffer. Consequently, sensiti...

tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring function. This leads to out-of-bounds read/write operations. A remote, unauthenticated...

Moderate: Red Hat Security Advisory: tftp security update

An update for tftp is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-90246

A flaw was found in AppArmor within the Linux kernel. An unprivileged user can exploit an integer overflow vulnerability in the verifytags function by crafting a malicious AppArmor policy. This flaw allows an attacker to trigger an out-of-bounds read during policy loading, which could lead to...

CVE-2026-90230

A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker, by sending a specially crafted NVMe-oF NVMe over Fabrics in-band authentication negotiation message with an invalid transfer length or identifier lengths, could trigger a heap out-of-bounds read in the nvmetauthnegotiate...