CVE-2026-41637

CVE-2026-41637 affects NLnet Labs Unbound (versions 1.22.0 to 1.25.1). The vulnerability arises when client-terminated DNS-over-QUIC (DoQ) queries are not counted properly, allowing a low-cost inflation of the waiting queue for in-flight queries and causing degradation of resolution service for n...

CVE-2026-41637 Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC DoQ queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service f...

CVE-2026-40691

In Unbound, versions 1.9.0 through 1.25.1 are affected when handling DNSCrypt queries over TCP. The routine that encrypts the reply in place does not bound the reply length to the destination buffer, because the UDP path’s size clamp is not applied on the TCP path. As a result, a reply larger tha...

CVE-2026-40691

In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails to bound the reply length against the destination buffer size. The size clamp that protects the UDP path is not applied on the TCP path, so a reply larger th...

PT-2026-63418

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.18.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.18.11-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description Unexpected program termination occurs in named due to the...

CVE-2026-63932

A flaw was found in the Linux kernel's mhz19b driver, which handles Winsen MHZ19B CO2 sensors. The mhz19breceivebuf function does not properly validate the size of incoming serial replies before copying them into a fixed-size buffer. A remote attacker could exploit this by sending an oversized...

SUSE CVE-2026-63932

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

PT-2026-61925

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump short mode used by rpcinfo -s, version numbers from a remote RPCBPROC DUMP reply are written into a fixed-size stack buffer without bounds checking. A user or administrator who runs rpcinfo -s against a malicious or...

Linux Distros Unpatched Vulnerability : CVE-2026-63996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen...

CVE-2026-63996

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

CVE-2026-63932

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

CVE-2026-64090

CVE-2026-64090 affects the Linux kernel’s batman-adv translation table (TT) handling. The issue arises when a TT reply can be generated either directly or via the global TT state, leading to potential inconsistency and the sending of empty VLANs, which can trigger TT request storms and network in...

CVE-2026-63932

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

CVE-2026-63932 iio: chemical: mhz19b: reject oversized serial replies

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

EUVD-2026-45705

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

CVE-2026-63932 iio: chemical: mhz19b: reject oversized serial replies

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev chunk into the fixed MHZ19BCMDSIZE receive buffer and advances bufidx by len without checking that the chunk fits in the remaining space....

CVE-2026-63932

In the Linux kernel IIO chemical mhz19b driver, mhz19b_receive_buf() appends serdev chunks into a fixed MHZ19B_CMD_SIZE buffer and advances buf_idx without ensuring fit, enabling a potential overflow of st->buf from a large callback. The patch resets the reply state before each command and rej...

PT-2026-61249

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mhz19b receive buf function where serial data chunks are appended to the fixed MHZ19B CMD SIZE receive buffer without verifying if the chunk fits in the remaining...

PT-2026-61407

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv module where the system could send empty VLAN responses when replying from the global TT state. This occurs because previous checks were only applied to...

CVE-2026-12994

The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attacker...