100944 matches found
CVE-2026-112373 H3C Magic NX15 usrlist sub_416874 stack-based overflow
A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be use...
CVE-2026-112373
A stack-based buffer overflow vulnerability exists in H3C Magic NX15 running NX15V100R017 . The flaw is located in the sub_416874 function of the /usr/bin/usrlist file. This vulnerability allows for remote attacks, and the exploit has been disclosed publicly. While specific exploitation links are...
CVE-2026-112373 H3C Magic NX15 usrlist sub_416874 stack-based overflow
A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be use...
DEBIAN-CVE-2026-112898
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-112898
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-112898 Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-112898
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-112898
The Pillow Python imaging library (versions 9.1.0 through 12.x.x ) is vulnerable to an information disclosure flaw in the Image.quantize() function. When an empty palette is used, the ImagingPaletteCacheUpdate() function fails to initialize a local cache array, leading the conversion path to emit...
CVE-2026-112898 Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-112898
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...
CVE-2026-76788
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CLSA-2026-1792444141 fribidi: Fix of CVE-2022-25308
CVE-2022-25308: fix stack-based buffer overflow...
GO-2026-6688 Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize
Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize...
GO-2026-6693 Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/coraza
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow process crash in github.com/corazawaf/coraza...
CLSA-2026-1792443100 c-ares: Fix of 2 CVEs
CVE-2022-4904: fix stack overflow in aressetsortlist due to missing input validation...
CVE-2026-76788
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
EUVD-2026-104600
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...