CVE-2026-63635

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid colormode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled...

CVE-2026-63635

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid colormode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled...

CVE-2026-63635 OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid colormode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled...

CVE-2026-63635 OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid colormode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled...

CVE-2026-47888

A flaw was found in Spring Framework, specifically within Spring RSocket applications. A remote attacker could exploit this vulnerability by sending a malformed SETUP frame to an affected application. This could lead to a memory leak, potentially causing a denial of service. Mitigation Disable...

AZL-105275 CVE-2026-81627 affecting package qemu 10.1.0-1

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...

SUSE CVE-2026-93085

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then...

CVE-2026-63635: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid colormode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled...

DEBIAN-CVE-2026-93090

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Clean up channels on setup failure scmichannelssetup can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing...

AZL-102260 CVE-2026-93090 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Clean up channels on setup failure scmichannelssetup can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing...

CVE-2026-90255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

AZL-102869 CVE-2026-90255 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

DEBIAN-CVE-2026-90255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

CVE-2026-93093

CVE-2026-93093 affects the Linux kernel's firmware/arm_scmi driver. The root cause is an ordering flaw: transport setup routines (mailbox_chan_setup() and smc_chan_setup()) can enable interrupt delivery or register callbacks before the SCMI channel state (the cinfo pointer and cinfo->handle) i...

CVE-2026-93090

CVE-2026-93090 affects the ARM SCMI (System Control and Management Interface) firmware driver in the Linux kernel . The root cause is a failure-handling defect in scmi_channels_setup(): if this function fails after the common BASE channel or earlier protocol channels have already been registered ...

EUVD-2026-82198

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Clean up channels on setup failure scmichannelssetup can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing...

Duplicate Advisory: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qhwx-74w5-xhxq. This link is maintained to preserve external references. Original Description vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the...

CVE-2026-92952

vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omi...

CVE-2026-92962 vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js

vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its output array using prototype-walking index assignment lineslines.length = value rather than a prototype-bypassing...

CVE-2026-92962 vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js

vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its output array using prototype-walking index assignment lineslines.length = value rather than a prototype-bypassing...