CVE-2026-64553

The CVE-2026-64553 entry concerns the Linux kernel net/psample, specifically PSAMPLE_ATTR_DATA. The vulnerability was an information leak caused by open coding in nla_put() that failed to clear padding for netlink attributes, with data_len not necessarily multiple of 4B. The issue affects the psa...

EUVD-2026-49109

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving actions length check" allowed the...

CVE-2026-64531

CVE-2026-64531 describes a Linux kernel issue in net/openvswitch: generated flow actions stored as nlattrs can exceed the 16-bit nla_len, allowing an oversized container to be closed with a truncated length. The fix preserves large total-action streams but rejects nested action containers that do...

SUSE CVE-2026-64483

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32tocpupayload-samplecount; if...

EUVD-2026-48839

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: bmg160: bail out when bandwidth/filter is not in table bmg160getfilter walks bmg160sampfreqtable looking for the entry matching the bwbits value read from the chip: for i = 0; i ARRAYSIZEbmg160sampfreqtable; ++i if...

EUVD-2026-48827

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32tocpupayload-samplecount; if...

CVE-2026-64483

CVE-2026-64483 affects the Linux kernel ALSA: firewire isight driver. The vulnerability arises when isight_packet() reads frame counts from the device iso packet and validates only against length, allowing a count up to (length-16)/4. Since payload->samples holds 2 * MAX_FRAMES_PER_PACKET valu...

CVE-2026-64483 ALSA: firewire: isight: bound the sample count to the packet payload

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32tocpupayload-samplecount; if...

CVE-2026-64483

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isightpacket takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32tocpupayload-samplecount; if...

CVE-2026-64458 mm/damon/ops-common: handle extreme intervals in damon_hot_score()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damonhotscore Fix three issues in damonhotscore that comes from wrong handling of extreme zero or too high monitoring intervals user setup. When the user sets sampling interval zer...

EUVD-2026-48802

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damonhotscore Fix three issues in damonhotscore that comes from wrong handling of extreme zero or too high monitoring intervals user setup. When the user sets sampling interval zer...

PT-2026-64704

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire: isight: bound the sample count to the packet payload isight packet takes the frame count from the device iso packet and checks it only against the device claimed iso length. count = be32 to cpupayload-sample count...

CVE-2026-65706

CVE-2026-65706 affects FFmpeg versions 3.0–8.1.2. The vulnerability lies in the vf_swaprect video filter, where the filter_frame() reuses a temporary row buffer sized for plane 0’s single-byte pixel step across all planes. This leads to an out-of-bounds write: an 18-byte memcpy is performed into ...

CVE-2026-47254 libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable in libheif/sequences/track.cc stores an out-of-bounds chunk index mchunks.size into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of...

CVE-2026-47254

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable in libheif/sequences/track.cc stores an out-of-bounds chunk index mchunks.size into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of...

CVE-2026-47254 libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable in libheif/sequences/track.cc stores an out-of-bounds chunk index mchunks.size into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of...

CVE-2026-44761 Insecure Sample Credentials in SAP Commerce Cloud

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

CVE-2026-44761

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

CVE-2026-44761

SAP Commerce Cloud is affected by CVE-2026-44761, where a sample OAuth2 client may retain publicly documented sample credentials from SAP Help Portal configuration. If left unchanged, an unauthenticated attacker could obtain a valid access token and invoke certain APIs to read and modify data, re...

PYSEC-2026-3186 TensorFlow vulnerable to `CHECK` fail in `AudioSummaryV2`

Impact When AudioSummaryV2 receives an input samplerate with more than one element, it gives a CHECK fails that can be used to trigger a denial of service attack. python import tensorflow as tf arg0='' arg1=tf.random.uniformshape=1,1, dtype=tf.float32, maxval=None arg2=tf.random.uniformshape=2,1,...