CVE-2026-40892 PJSIP: Stack buffer overflow in pjsip_auth_create_digest2()

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsipauthcreatedigest2 in PJSIP when using pre-computed digest credentials PJSIPCREDDATADIGEST. The function copies credential data using credinfo-data.slen as the...

CVE-2026-40614

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is a buffer overflow when decoding Opus audio frames due to insufficient buffer size validation in the Opus codec decode path. The FEC decode buffers decframe.buf were allocated based on a...

OSV-2026-603 UNKNOWN READ in <wasmtime::runtime::func::Func>::call_unchecked_raw::<

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=504268343 Crash type: UNKNOWN READ Crash state: ::calluncheckedraw::::callimpldocall:: wasmtimeinternalfiber::stackswitch::x8664::wasmtimefiberstart...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013249)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013249 advisory. An issue was discovered in ipracontrol in net/ipv4/ipsockglue.c in the Linux kernel through 5.1.5. There is an unchecked kmalloc of newra, which might allow an...

PT-2026-34219

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.6.0 through 5.9.14 Description The 'actionSavePermissions' endpoint allows a user possessing only viewUsers permission to remove arbitrary users from all user groups. This occurs because the saveUserGroups function enforce...

ROS-20260420-73-0041

Vulnerability in beats related to unchecked array indexing. Exploitation of the vulnerability may allow an attacker to affect confidentiality, integrity and availability of protected information...

CVE-2026-35469 SpdyStream: DOS on CRI

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count ...

PT-2026-33367

Name of the Vulnerable Software and Affected Versions spdystream versions prior to 0.5.1 Description The SPDY/3 frame parser fails to validate attacker-controlled counts and lengths before allocating memory. This occurs in three allocation paths: the SETTINGS frame entry count, the header count i...

CVE-2026-40918

A flaw was found in GIMP. Processing a specially crafted PVR image file with large dimensions can lead to a denial of service DoS. This occurs due to a stack-based buffer overflow and an out-of-bounds read in the PVR image loader, causing the application to crash. Systems that process untrusted P...

CVE-2026-39958

oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...

ROS-20260414-73-0020

Vulnerability in kernel-lt related to unchecked array indexing. Exploitation of the vulnerability may allow an attacker to affect confidentiality, integrity and availability of protected information...

ROS-20260414-73-0051

A vulnerability in the btrfstruncateblock function of the fs/btrfs/inode.c module of the Linux kernel btrfs file system is related to buffer copying without checking the size of the input data classic buffer overflow. Exploitation of the vulnerability could allow an attacker to cause a denial of...

CVE-2026-5504 PKCS7 CBC Padding Oracle — Plaintext Recovery

A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover plaintext through repeated decryption queries with modified ciphertext. In previous versions of wolfSSL the interior padding bytes are not validated...

CVE-2026-40026

A flaw was found in The Sleuth Kit's ISO9660 filesystem parser. An attacker can craft a malicious ISO image that exploits an out-of-bounds read vulnerability in the parsesusp function. This vulnerability occurs because the function trusts length fields from the disk image without proper validatio...

Plane 代码问题漏洞

Plane is an open-source, self-hosted project planning tool developed by Plane OpenSource. Versions of Plane prior to 0.28.0 and 1.3.0 contained code vulnerabilities. These vulnerabilities stemmed from an unchecked redirection in the favicon retrieval path, which could allow low-privilege...

wasmtime 缓冲区错误漏洞

Wasmtime is a lightweight WebAssembly runtime open source by the Bytecode Alliance. Versions of Wastime prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1 contained a buffer error vulnerability. This vulnerability stemmed from the lack of validation for the return value of the realloc function in guest...

CVE-2026-40026

The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parsesusp function trusts lenid, lendes, and lensrc fields from the disk image to memcpy data into a stack buffer without verifying that the source data falls within the parsed SU...

The vulnerability of the Canvas2D component in Mozilla Firefox, Firefox ESR, and the Thunderbird email client allows a hacker to trigger a service failure.

The vulnerability of the Canvas2D component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to insufficient testing of unusual or exceptional states. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

CVE-2026-34079

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on t...

capstone: Capstone: Memory corruption via unchecked vsnprintf return

A flaw was found in Capstone, a disassembly framework. An unchecked return value from vsnprintf within the SStreamconcat function allows a malicious input to manipulate the internal stream index. This can lead to a stack buffer underflow or overflow, potentially enabling a local attacker to achie...