CVE-2026-13343

The UMP Stream responder library in lib/midi2/umpstreamresponder.c builds reply packets in a 16-byte struct midiump uint32t data4. The builders makeendpointinfo and makefunctionblockinfo populate only the first two words res.data0 and res.data1 and, before this fix, declared their result as an...

CVE-2026-68553

A flaw was found in Coturn. An authenticated TURN user can exploit a format string vulnerability by injecting printf-style format specifiers into the STUN USERNAME or REALM attribute. This can lead to a crash of the coturn process, resulting in a Denial of Service DoS and termination of active TU...

DEBIAN-CVE-2026-68553

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

EUVD-2026-63077

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

CVE-2026-68553

Coturn (open-source TURN/STUN server) prior to 4.13.0 is affected by a format string vulnerability in its Redis integration. An authenticated TURN user can inject printf-style format specifiers into the STUN USERNAME or REALM attribute. These values pass is_secure_string() validation and are embe...

CVE-2026-68553 Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

CVE-2026-73523 COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memory onto the CAN bus by sending a rejected UDP datagram with a matching AVTP stream ID. The numcanms...

CVE-2026-73523

In COVESA Open1722 through 0.9.2, the num_can_msgs variable (declared uint8_t) in acf-can-listener.c truncates the -1 error return from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak ~18 KB of adjacent stack memory as ~240 CAN frames to any bus...

CVE-2026-64083

A flaw was found in the Linux kernel's pmbus/adm1266 driver within the hwmon subsystem. The adm1266gpioget and adm1266gpiogetmultiple functions fail to validate the length of responses from I2C block-read operations. A local user or a malicious I2C Inter-Integrated Circuit slave device can exploi...

CVE-2026-9754 Stack memory disclosure in filemd5 command

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...

CVE-2026-9754

CVE-2026-9754 describes an issue where an authenticated user with the read role can read limited amounts of uninitialized stack memory via specially crafted issuances of the filemd5 command. The condition relies on issuing filemd5 in a crafted way to disclose memory that was not initialized, with...

Stack memory disclosure in filemd5 command

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...

glibc: glibc: Information disclosure via zero-valued network query

A flaw was found in glibc, the GNU C Library. When an application calls the getnetbyaddr or getnetbyaddrr functions to resolve a network address, and the system's nsswitch.conf file is configured to use a DNS Domain Name System backend for network lookups, a query for a zero-valued network can le...

CVE-2026-4147 Stack memory disclosure in filemd5 command

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...

CVE-2026-4147

The CVE-2026-4147 entry describes an issue where an authenticated user with the read role can read limited amounts of uninitialized stack memory through specially crafted issuances of the filemd5 command. Root cause: exposure of uninitialized stack memory during filemd5 handling. Impact: potentia...

CVE-2026-4147 Stack memory disclosure in filemd5 command

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command...

glibc security update

2.39-58.0.1.7 - Forward port Oracle changes to 2.39-58.7. - Reviewed-by: David Faust Oracle history: November-26-2025 Cupertino Miranda - 2.39-58.0.1.2 - Forward port Oracle changes to 2.39-58.2. - Reviewed-by: Jose E. Marchesi September-29-2025 David Faust - 2.39-58.0.1 - Forward port Oracle...

CVE-2021-0453

In the Titan-M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

CVE-2021-0449

In the Titan M chip firmware, there is a possible disclosure of stack memory due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

CVE-2026-22190

Summary of CVE-2026-22190 (Panda3D) Affected: Panda3D up to and including 1.10.16, specifically the egg-mkfont utility. Vulnerability: Uncontrolled format string in the -gp (glyph pattern) option. The option is passed directly as the format string to sprintf() with only one argument. If an attack...