CVE-2026-109438

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option -Ne is configured. Attackers can send a client probe that fail...

EUVD-2026-101290

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option -Ne is configured. Attackers can send a client probe that fail...

CVE-2026-109438

Versions 0.9.7 through 1.0.1 of 3proxy are vulnerable to an uninitialized stack memory disclosure vulnerability. When the external-NAT option (-Ne) is configured, unauthenticated attackers can send a client probe that fails the SOCKS version check. This triggers a SOCKS4 reply containing uninitia...

CVE-2026-109438 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option -Ne is configured. Attackers can send a client probe that fail...

CVE-2026-109438 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option -Ne is configured. Attackers can send a client probe that fail...

CVE-2026-109438: Use of Uninitialized Resource

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option -Ne is configured. Attackers can send a client probe that fail...

SUSE CVE-2026-98201

In the Linux kernel, the following vulnerability has been resolved: Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:...

CVE-2026-98201

In the Linux kernel, the following vulnerability has been resolved: Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:...

CVE-2026-98201 Input: zero ff_effect before compat copy in input_ff_effect_from_user

In the Linux kernel, the following vulnerability has been resolved: Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:...

EUVD-2026-79218

A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to obtain limited information from memory and disrupt the normal operation of the affected service. Successful exploitation could result in a denial of service system crash or the...

CVE-2026-13343

The UMP Stream responder library in lib/midi2/umpstreamresponder.c builds reply packets in a 16-byte struct midiump uint32t data4. The builders makeendpointinfo and makefunctionblockinfo populate only the first two words res.data0 and res.data1 and, before this fix, declared their result as an...

CVE-2026-13343 Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder

The UMP Stream responder library in lib/midi2/umpstreamresponder.c builds reply packets in a 16-byte struct midiump uint32t data4. The builders makeendpointinfo and makefunctionblockinfo populate only the first two words res.data0 and res.data1 and, before this fix, declared their result as an...

CVE-2026-13343 Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder

The UMP Stream responder library in lib/midi2/umpstreamresponder.c builds reply packets in a 16-byte struct midiump uint32t data4. The builders makeendpointinfo and makefunctionblockinfo populate only the first two words res.data0 and res.data1 and, before this fix, declared their result as an...

CVE-2026-13343

CVE-2026-13343 affects the Zephyr RTOS UMP Stream responder library (lib/midi2/ump_stream_responder.c). The functions make_endpoint_info() and make_function_block_info() declare a local struct midi_ump without initialisation, populating only the first two of four uint32_t words. The remaining two...

CVE-2026-68553

A flaw was found in Coturn. An authenticated TURN user can exploit a format string vulnerability by injecting printf-style format specifiers into the STUN USERNAME or REALM attribute. This can lead to a crash of the coturn process, resulting in a Denial of Service DoS and termination of active TU...

DEBIAN-CVE-2026-68553

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

EUVD-2026-63077

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

CVE-2026-68553 Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

CVE-2026-68553

Coturn (open-source TURN/STUN server) prior to 4.13.0 is affected by a format string vulnerability in its Redis integration. An authenticated TURN user can inject printf-style format specifiers into the STUN USERNAME or REALM attribute. These values pass is_secure_string() validation and are embe...

CVE-2026-73523

In COVESA Open1722 through 0.9.2, the num_can_msgs variable (declared uint8_t) in acf-can-listener.c truncates the -1 error return from avtp_to_can() to 255, causing a write loop to iterate 255 times over a 15-slot stack array and leak ~18 KB of adjacent stack memory as ~240 CAN frames to any bus...