185904 matches found
CVE-2026-57187
The Asterisk telephony toolkit is vulnerable to a heap-use-after-free in PJSIP TCP/SDP handling. An authenticated attacker can trigger this by sending a SIP INVITE over a connection-oriented transport and disconnecting before the server responds with a 200 OK. While the crash has only been reprod...
CVE-2026-57187 Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a...
Exploit for Use After Free in Linux Linux_Kernel
Sony Xperia 1 VI — One-Shot Root GhostLock Root exploit for...
Security Bulletin:Vulnerability in zstd-jni may affect IBM Infosphere Change Data Capture (CVE-2026-90852)
Summary A security vulnerability has been identified in zstd-jni, JNI bindings for Zstd native library. zstd-jni is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability Details...
libpng: Fix of 3 CVEs
CVE-2016-10087: fix NULL pointer dereference in pngsettext2 - CVE-2026-25646: fix heap buffer overflow in pngsetdither - CVE-2026-33416: fix use-after-free on pngptr palette and trans buffers...
kernel: Fix of 32 CVEs
s390/ipl: Fix NULL deref in dumpreipl without re-IPL parm block CVE-2026-98399 - USB: serial: ioti: fix heap overflow in buildi2cfwhdr CVE-2026-53195 - hwrng: geode - Fix PCI device refcount leak CVE-2022-50659 - ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput CVE-2026-80829 - ubi: Fix...
CVE-2026-82388
bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by passing the object's embedded hf-sdpparam to btsdpdiscover. That call links the caller-owned parameter block into the SDP client's request...
CVE-2026-82389
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...
CVE-2026-115913
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mmaudio.py and phi4mmutils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forwardattenti...
CVE-2026-82389
In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer, which links the embedded ag-sdpparam.node into the SDP client's pending request list in subsys/bluetooth/host/classic/sdp.c. If the...
UBUNTU-CVE-2026-82388
bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by passing the object's embedded hf-sdpparam to btsdpdiscover. That call links the caller-owned parameter block into the SDP client's request...
CVE-2026-82388
bthfphfconnect in subsys/bluetooth/host/classic/hfphf.c allocates the per-connection HFP Hands-Free object with hfphfcreate, which starts an SDP discovery by passing the object's embedded hf-sdpparam to btsdpdiscover. That call links the caller-owned parameter block into the SDP client's request...
CVE-2026-115913
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mmaudio.py and phi4mmutils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forwardattenti...
Exploit for CVE-2026-98260
CVE-2026-98260 — posix-cpu-timers UAF after a failed exec Eng...
Use of Cache Containing Sensitive Information
Overview Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the OAuthClientCredentialsTokenResolver in the camel-oauth component. When a deployment defines multiple profiles with the same token endpoint and client ID but different scopes or clien...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free through the ssltlsextticketkeycb process during session ticket key rotation. An attacker can cause a crash or corrupt ticket processing by initiating TLS handshakes while setSessionTicketKeys0 frees the shared key array,...
CVE-2026-98896
A flaw was found in the Linux kernel's Thunderbolt driver. A race condition can occur when a device hotplug event is processed concurrently with driver removal, resulting in a use-after-free condition where freed memory is accessed. A local user could exploit this flaw to cause a Denial of Servic...
CVE-2026-116540
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssltlsextticketkeycb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed...
DEBIAN-CVE-2026-116540
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssltlsextticketkeycb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed...
UBUNTU-CVE-2026-116540
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssltlsextticketkeycb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed...