PT-2026-117496

IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations...

CVE-2026-98582

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

Astra Linux – Vulnerability in exiv2

Exiv2 0.27.2 allows attackers to cause a crash in the Exiv2::getULong function in types.cpp, when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimageint.cpp. This occurs because there is no validation of the relationship between the total size and the offset and size...

Astra Linux – Vulnerability in libraw

LibRaw before 0.20-RC1 lacks a check for the thumbnail size range. This affects decoders/unpackthumb.cpp, postprocessing/memimage.cpp, and utils/thumbutils.cpp. For example, mallocsizeoflibrawprocessedimaget+T.tlength is used without validating T.tlength...

Astra Linux – Vulnerability in xorg-server

A out-of-bounds read flaw was discovered in the X.Org X server and Xwayland within the glXDispChangeDrawableAttributes function. A incorrect size validation check allows a client-controlled number of bytes to be read, exceeding the request buffer, resulting in information disclosure. A write path...

CVE-2026-86561

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption...

CVE-2026-86561

A flaw exists in DPDK lib/vhost where memory size is not adequately validated before the mmap operation during vhost memory-region setup. This vulnerability, categorized under CWE-770 , can lead to memory corruption or a host crash . No mitigation is currently available. No information regarding ...

Linux Distros Unpatched Vulnerability : CVE-2026-86561

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memo...

CVE-2026-71892

A flaw was found in Bouncy Castle. A remote attacker can bypass cryptographic key-size validation by sending a crafted Cryptographic Message Syntax CMS message that uses key derivation. Due to an incorrect algorithm identifier comparison in the recipient handling logic, key-size verification is...

EUVD-2026-95910

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

SUSE CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/lib: Validate size for vector operations Some parts of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. However, the size of these operations is determined separately in the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: wavefront: Fixed integer overflow in sample size validation The wavefrontsendsample function has a problem with integer overflow when validating sample size. The header-size field is of type u32, but it is cast to int for...

Astra Linux – Vulnerability in Linux 5.10

A vulnerability was discovered in the net/tipc/crypto.c file within the Linux kernel before version 5.14.16. The Transparent Inter-Process Communication TIPC functionality allows remote attackers to exploit a lack of sufficient validation of the user-supplied sizes for the MSGCRYPTO message type...

Incorrect Comparison

Overview Affected versions of this package are vulnerable to Incorrect Comparison through the JceKeyTransRecipient key transport path in pkix/src/main/java/org/bouncycastle/cms/jcajce/JceKeyTransRecipient.java. An attacker can bypass the opt-in key-size check and have an EnvelopedData or...

Incorrect Comparison

Overview Affected versions of this package are vulnerable to Incorrect Comparison through the JceKeyTransRecipient key transport path in pkix/src/main/java/org/bouncycastle/cms/jcajce/JceKeyTransRecipient.java. An attacker can bypass the opt-in key-size check and have an EnvelopedData or...

DEBIAN-CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

UBUNTU-CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...