CVE-2026-68552 Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16t len variable in stungetmessagelenstr in src/client/nsturnmsg.c to...

haproxy security update

3.0.5-6.2 - Fix uint16t overflow in FCGI demux record length CVE-2026-55203 Resolves: RHEL-211068 - Fix NULL pointer dereference in hpackdhtinsert CVE-2026-55204 Resolves: RHEL-211081...

CVE-2026-49263

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...

EUVD-2026-58747

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...