CVE-2026-123203

A flaw was found in NEURON. A local attacker can cause a Denial of Service DoS and stack memory corruption by convincing a user or system to load a specially crafted model dataset containing oversized tokens. When the application parses these malformed data files, a stack-based buffer overflow...

CVE-2026-76077

A flaw was found in asn1scc. The XML Encoding Rules XER tokenizer does not properly enforce length bounds when copying tag data and fails to check buffer limits during input processing. A remote attacker could exploit this vulnerability by providing a crafted XER message, leading to stack memory...

CVE-2026-54913 WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guest

WebAssembly Micro Runtime WAMR is a lightweight standalone WebAssembly Wasm runtime. Prior to 2.4.5, loadinitexpr in core/iwasm/interpreter/wasmloader.c accepts a non-reference heap-type byte for ref.null when WASMENABLEGC=0, while the local WASMValue curvalue union is not zero-initialized and...

CVE-2026-54913

The WebAssembly Micro Runtime (WAMR) runtime contains a vulnerability prior to version 2.4.5 in the load_init_expr function of core/iwasm/interpreter/wasm_loader.c. When WASM_ENABLE_GC=0, the runtime fails to properly validate the ref.null heap-type byte. Because the local WASMValue union is not ...

Linux Distros Unpatched Vulnerability : CVE-2026-121505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the...

CVE-2026-113782

The ESP-IDF (Espressif Internet of Things Development Framework) contains a stack-based buffer overflow (CWE-121) in the OpenThread Border Router Neighbor Discovery packet handler. Specifically, the handler trusts an attacker-controlled ICMPv6 option length while copying data into a fixed stack b...

CVE-2026-89843

A flaw was found in the Linux kernel's scsi: qla2xxx component. This vulnerability arises in several block SCSI generic bsg handlers due to improper initialization of stack buffers when processing requests. A local attacker can exploit this by sending a specially crafted request, which causes...

CVE-2026-121505

A flaw was found in NTPsec. A malicious Network Time Security Key Exchange NTS-KE server can cause information disclosure by sending a response record with a declared length exceeding the data received. This triggers an out-of-bounds read in the client response parser, allowing the server to...

CVE-2026-121505

An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...

EUVD-2026-115826

An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...

CVE-2026-121505 Out-of-bounds Read in NTPsec

An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...

CVE-2026-121505 Out-of-bounds Read in NTPsec

An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...

CVE-2026-121505 Out-of-bounds Read in NTPsec

An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...

CVE-2026-121505

NTPsec versions before 1.2.4 are vulnerable to an out-of-bounds read in the nts_client_process_response_core function of the NTS-KE client response parser. A malicious NTS-KE server can trigger this by sending a record where the declared length exceeds the actual data received. This allows the se...

CVE-2026-121505: NTPsec: An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4…

An out-of-bounds read in the NTS-KE client response parser ntsclientprocessresponsecore in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the client then sends in cleartext as NTS cookies, via an NTS-KE record who...

CVE-2026-119739

The VobSub subtitle decoder libsubvob part of the Amlogic DroidLogic SubTitleService, as shipped on Nexbox A95X Amlogic S905X TV boxes, contains an out-of-bounds write vulnerability in vobfillpixel that allows remote attackers to corrupt stack memory by sending a crafted SETCONTR command with an...

EUVD-2026-115548

The VobSub subtitle decoder libsubvob part of the Amlogic DroidLogic SubTitleService, as shipped on Nexbox A95X Amlogic S905X TV boxes, contains an out-of-bounds write vulnerability in vobfillpixel that allows remote attackers to corrupt stack memory by sending a crafted SETCONTR command with an...

SUSE CVE-2026-120243

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempfrestorebuf copies uninitialized stac...

SUSE CVE-2026-120246

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled newpalette entries in cdxldecodeham8 or...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...