CVE-2026-103672 HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index

The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC = 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination...

sqlite: sqlite: Denial of Service via stack exhaustion in countOfViewOptimization()

A flaw was found in SQLite. This vulnerability allows an attacker to cause a Denial of Service DoS by crashing the host application. By supplying a specially crafted database file or SQL query that performs a count operation over a large multi-row VALUES clause, an attacker can trigger excessive...

CVE-2026-112368

A flaw was found in the MongoDB PHP driver. An uncontrolled recursion vulnerability in the Binary JSON BSON decoding logic allows an unauthenticated remote attacker to cause a Denial of Service DoS. By supplying specially crafted binary document data to the decoder, an attacker can exhaust the...

CLSA-2026-1792519677 apr-util: Fix of 2 CVEs

CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in aprxmlquoteelem - CVE-2026-34502: apr-util: heap buffer overflow in the APR memcached client...

CLSA-2026-1791894819 glibc: Fix of 8 CVEs

CVE-2026-6368: posix: make wordexp work on a copy of wewordv when WRDEAPPEND is set and restore the original on non-NOSPACE errors, preventing a use-after-free in wordfree; add tst-wordexp-append regression test - CVE-2026-77117: iconvdata: clear the pending character in the SHIFTJISX0213 decoder...

fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01)

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response...

Moderate: Red Hat Security Advisory: fetchmail security update

An update for fetchmail is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Exploit for CVE-2026-105810

CVE-2026-105810 TP-Link Tapo C320WS authenticated connectAp...

CLSA-2026-1792490933 hplip: Fix of 7 CVEs

CVE-2026-91097: bound LEDM HTTP response copies in httpread of the SANE hpaio backend stack buffer overflow backport of HPLIP 3.26.6 and RHEL c9s - CVE-2026-91098: bound device-supplied data in the LEDM scan backend resolution lists, job Location header, BinaryURL and chunk size parsing...

apr-util: Fix of 2 CVEs

CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in aprxmlquoteelem...

CVE-2026-113650 ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options. The recursion has no bound and starts each...

CVE-2026-113650 ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options. The recursion has no bound and starts each...

CVE-2026-113650 ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an is not allowed and disallowedTagsMode is 'discard' the defaults, its raw-text content is re-sanitized by a recursive call to sanitizeHtmltext, options. The recursion has no bound and starts each...

CVE-2026-113650

The ApostropheCMS Node.js content management system is vulnerable in the sanitize-html 2.18.0 component due to unbounded recursion . When an is disallowed and disallowedTagsMode is set to 'discard' (the default), the raw-text content undergoes a recursive re-sanitization via sanitizeHtml(text, o...

GIMP buffer error vulnerability

GIMP 3.2.2 has a buffer error vulnerability. This vulnerability stems from the improper validation of the length of the data provided by the user when parsing APNG files. The data is copied into the stack buffer without proper validation, leading to a stack buffer overflow. This could allow remot...

Vyper buffer error vulnerability

Vyper versions from 0.1.0b4 up to but not including 0.3.0 contain a buffer error vulnerability. This vulnerability arises when an internal function call is made within an array, causing an incorrect top-of-stack pointer value. It may lead to memory corruption and resulting in erroneous contract...

VyperLang Vyper Processing Logic Vulnerability

VyperLang Vyper 0.1.0b10 to 0.2.3 versions have a processing logic error. This bug stems from incorrect code generated by return statements within for loops in internal functions that call other functions at least two levels deep. This results in invalid jump targets stack underflow, causing...

TOTOLINK EX200 buffer error vulnerability

The TOTOLINK EX200 version 5.2.3c.7200 contains a buffer error vulnerability. This vulnerability arises from the setStaticDhcpConfig function in the lan.so component, which handles the Comment parameter in the file /cgi-bin/cstecgi.cgi, resulting in a stack buffer overflow. This may enable remote...

Cisco Open Source Snort3 buffer error vulnerability

Cisco Open Source Snort 3 versions from 3.1.2.0 to 3.12.2.0, Cisco Secure Firewall Threat Defense FTD Software versions from 7.2.0 to 10.0.0, and Cisco UTD SNORT IPS Engine Software versions from 17.12.1a to 26.1.2 have a buffer error vulnerability. This vulnerability stems from the improper rang...

CVE-2026-95108 Deleting a user-mode module thread leaks its privileged kernel stack

One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a TXTHREAD control block through txmmoduleobjectallocate; txmmodulemanagerthreadcreate then takes a second allocation of TXMMODULEKERNELSTACKSIZE bytes for...