Linux Distros Unpatched Vulnerability : CVE-2026-66485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based ...

Linux Distros Unpatched Vulnerability : CVE-2026-68184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmcioctlcdromvolume first reads the audio control mode page into a 32-byte stack buffer with cgc-buflen set ...

Linux Distros Unpatched Vulnerability : CVE-2026-68159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user- controlled length but only rejects values large enough to overflow...

CVE-2026-19341

A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpSrvGlobalConfig. Such manipulation of the argument EncryptionMode leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has...

CVE-2026-19341 UTT HiPER 1200GW pptpSrvGlobalConfig strcpy stack-based overflow

A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpSrvGlobalConfig. Such manipulation of the argument EncryptionMode leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has...

EUVD-2026-54910

A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpSrvGlobalConfig. Such manipulation of the argument EncryptionMode leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has...

CVE-2026-62295

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested,...

CVE-2026-62296 HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner and parseElement, raisi...

CVE-2026-62296 HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner and parseElement, raisi...

CVE-2026-62296

CVE-2026-62296 affects HAPI FHIR (Java). The vulnerable component is the XHTML parser (XhtmlParser.java) where, prior to 6.9.11, there is no maximum element nesting depth, allowing deeply nested text.div narratives to trigger unbounded recursion between parseElementInner() and parseElement(). Thi...

CVE-2026-62295 HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested,...

CVE-2026-62295

HAPI FHIR (Java) prior to 6.9.11 has a denial-of-service risk: the JSON parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth, so deeply nested, valid FHIR JSON can trigger unbounded readArray/readObject recursion and cause a StackOverflowError before validatio...

CVE-2026-62295 HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested,...

JLSEC-2026-1173 FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan...

FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vpsnumhrdparameter...

OESA-2026-3312 busybox security update

The Swiss Army Knife of Embedded Linux Security Fixes: A stack overflow in the evaluate function editors/awk.c of BusyBox commit 371fe9 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script.CVE-2026-38752 A use-after-free in the awksub function editors/awk.c of...

OESA-2026-3310 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through...

openSUSE 16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (openSUSE-SU-2026:21532-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21532-1 advisory. This update for php8 fixes the following issues - Update to version 8.4.24 - CVE-2026-7260: Stack overflow in phar with circular symlinks...

Ruby oj Gem < 3.17.2 Stack Buffer Overflow

The version of the oj Ruby gem installed on the remote host is prior to 3.17.2. It is, therefore, affected by a stack buffer overflow vulnerability. - Oj.dump is vulnerable to a stack-based buffer overflow when a large :indent value is provided by the developer. fillindent in dump.h calls...

SUSE CVE-2026-71266

tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpylinebuf, p, plen, guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file...

SUSE CVE-2026-71267

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy...