OSV-2026-21 Use-of-uninitialized-value in processTLSBlock

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=474015854 Crash type: Use-of-uninitialized-value Crash state: processTLSBlock ndpisearchdtls ndpisearchtlswrapper...

PT-2026-3413

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=474015854 Crash type: Use-of-uninitialized-value Crash state: processTLSBlock ndpi search dtls ndpi search tls wrapper...

EUVD-2026-1416

AWS SDK for Swift adopted defense in depth enhancement for region parameter value...

EUVD-2026-1418

AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value...

GHSA-G59M-GF8J-GJF5 AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value

Summary This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value. A defense-in-depth enhancement has been implemented in th...

CVE-2025-14505

The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...

CVE-2025-14505

The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...

CVE-2026-21895

The CVE-2026-21895 entry concerns the rsa crate (Rust) where constructing an RSA private key from components panics if one of the primes equals 1 in versions prior to 0.9.10. The issue is resolved in 0.9.10. Connected sources confirm the affected component (rsa crate) and the fix version, with no...

CVE-2025-69259

A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability...

imagemagick:encoder_dng_fuzzer: Use-of-uninitialized-value in LibRaw::phase_one_flat_field

Detailed Report: https://oss-fuzz.com/testcase?key=5715416526946304 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: LibRaw::phaseoneflatfield...

DEBIAN-CVE-2026-21869

llama.cpp is an inference of several LLM models in C/C++. In commits 55d4206c8 and prior, the ndiscard parameter is parsed directly from JSON input in the llama.cpp server's completion endpoints without validation to ensure it's non-negative. When a negative value is supplied and the context fill...

Trend Micro Apex Central security vulnerabilities

Trend Micro Apex Central is a web-based console from Trend Micro. A security vulnerability exists in Trend Micro Apex Central that stems from an unchecked NULL return value that could lead to a denial of service attack...

CVE-2025-61550

edu Business Solutions Print Shop Pro WebDesk version 18.34 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue originates from the improper output encoding or sanitization of user-supplied input within the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/Te...

CVE-2025-61550

Cross-Site Scripting XSS is present on the ctl00Content01fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 fixed in 19.69. User-supplied input is stored and later rendered in HTML pages without prope...

Elliptic security vulnerabilities

Elliptic is a fast elliptic curve cryptographic library in javascript by the individual developer Fedor Indutny. A security vulnerability exists in Elliptic 6.6.1 and earlier versions, which stems from a miscalculation of the k-value in the ECDSA implementation and could lead to key disclosure...

PT-2026-1937

Name of the Vulnerable Software and Affected Versions Trend Micro Apex Central affected versions not specified Description A flaw exists in Trend Micro Apex Central that could allow a remote attacker to cause a denial-of-service condition. Authentication is not required to exploit this issue. The...

CVE-2025-69259: Origin Validation Error

A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the ndiscard parameter in the server's completion endpoints. An attacker can cause memory corruption, process crashes, or potentially execute arbitrary code by supplying a negative value that leads to out-of-boun...

ndpi:fuzz_ndpi_reader_pl7m_simplest_internal: Use-of-uninitialized-value in processTLSBlock

Project: https://github.com/ntop/nDPI.git Detailed Report: https://oss-fuzz.com/testcase?key=6530401670856704 Project: ndpi Fuzzing Engine: libFuzzer Fuzz Target: fuzzndpireaderpl7msimplestinternal Job Type: libfuzzermsanndpi Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address...

pcapplusplus:FuzzTargetNg: Use-of-uninitialized-value in pcpp::HeaderField::HeaderField

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=6521259027660800 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTargetNg Job Type: libfuzzermsanpcapplusplus Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...