Linux Kernel Security Vulnerabilities

The Linux kernel version 6.14 contains a security vulnerability. This vulnerability arises from the use of qnapmcuexec, which exposes the stack-based receive buffer to the unsynchronized serdev receive path. In cases where commands fail or writes fail, delayed responses or unrequested messages ma...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from a typo in the acpipccretrievebiosdata function, which allows for out-of-bounds writing to the pcc-sinf array, potentially leading to a stack overflow...

vim: Vim: Denial of Service via crafted spell file

A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by convincing a user to load a specially crafted spell file. This malicious file can trigger a stack out-of-bounds write, which corrupts the editor's memory and causes it to crash...

apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack

A flaw was found in Apache Portable Runtime Utility apr-util. A remote attacker could exploit a stack recursion vulnerability by providing specially crafted XML input to a library consumer that uses the aprxmlquoteelem function. This could lead to a denial of service DoS due to an application cra...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

Security update for opensc

This update for opensc fixes the following issue: CVE-2026-40510: stack buffer overflow in pivprocesshistory allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device bsc1266964. Patch Instructions: To install this SUSE update use the SU...

SUSE-SU-2026:4123-1 Security update for opensc

This update for opensc fixes the following issue: - CVE-2026-40510: stack buffer overflow in pivprocesshistory allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device bsc1266964...

Security update for opensc

This update for opensc fixes the following issue: CVE-2026-40510: stack buffer overflow in pivprocesshistory allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device bsc1266964. Patch Instructions: To install this SUSE update use the SU...

SUSE-SU-2026:4122-1 Security update for opensc

This update for opensc fixes the following issue: - CVE-2026-40510: stack buffer overflow in pivprocesshistory allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device bsc1266964...

USN-8737-2: GNU C Library vulnerabilities

USN-8737-1 fixed vulnerabilities in GNU C Library. This update provides the corresponding fixes for Ubuntu 24.04 LTS. Original advisory details: It was discovered that GNU C Library had a buffer overflow in the strfmon function when handling right-justification padding. An attacker could possibly...

Malicious code in error-stack-parsersasasa (npm)

Source: ossf-package-analysis 95ee2924307d088b5e7509bfa51de2136a5611527d0de92d5ea4020f7ba0edf0 The OpenSSF Package Analysis project identified 'error-stack-parsersasasa' @ 1.2.7 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with maliciou...

Malicious code in error-bash-monitor-stack-decode (npm)

Source: amazon-inspector 9a40039f7e0254dac8bfdd5141586a28742202eadc46a657b45eb9ffcd727ee2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

aegis-stack (>=0.8.0, <=0.16.1), aegis-stack-crawl4ai (0.1.0) +10 more potentially affected by CVE-2026-53951 via copier (>=9.6.0, <=9.14.3)

copier PYPI version =9.6.0, =0.8.0, =2.7.0, =1.6.0b0, =0.1.58, =4.12.2rc1, =4.12.2rc1, =5.0.0b2, =4.12.2rc1, =4.12.2rc1, =2.9.1, =2.51.0 Source cves: CVE-2026-53951 Source advisory: OSV:PYSEC-2026-3818...

apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack

A flaw was found in Apache Portable Runtime Utility apr-util. A remote attacker could exploit a stack recursion vulnerability by providing specially crafted XML input to a library consumer that uses the aprxmlquoteelem function. This could lead to a denial of service DoS due to an application cra...

CVE-2026-88289

GeoVision GV-LPC2211 V1.14 260903 fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service...

CVE-2026-88280

GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker...

CVE-2026-88281

GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker...

CVE-2026-88284

GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker...

CVE-2026-88283

GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker...

CVE-2026-88287

GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process...