CVE-2026-64275 Input: elan_i2c - prevent division by zero and arithmetic underflow

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device...

CVE-2026-64275

The CVE-2026-64275 entry concerns the Linux kernel Elan I2C touchpad driver. Public documents describe a vulnerability where invalid firmware or device-tree-provided x_traces/y_traces (zero values) could trigger a fatal division-by-zero during device probe, and where an underflow in touch reporti...

Linux Distros Unpatched Vulnerability : CVE-2026-65706

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by...

PT-2026-64733

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Suppress UBSAN warning caused by field misuse The definition of reg-access width changes depending on the reg-space id type. Type ACPI ADR SPACE PLATFORM COMM uses access width to indicate the PCC region, which can...

Linux Distros Unpatched Vulnerability : CVE-2026-64512

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ACPI: CPPC: Suppress UBSAN warning caused by field misuse The definition of reg-accesswidth changes depending on the reg-spaceid type. Type...

PT-2026-64496

In the Linux kernel, the following vulnerability has been resolved: Input: elan i2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device...

PT-2026-64514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd veventq fops read function where a bound-check for the normal vEVENT path incorrectly uses sizeofhdr instead of sizeofhdr. Because hdr is a pointer,...

UBUNTU-CVE-2026-66036

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the...

CVE-2026-66036

CVE-2026-66036 affects FFmpeg up to version 8.1.2. A heap out-of-bounds write exists in the vf_hqdn3d filter when a crafted video increases frame width between frames and filtergraph reinitialization is disabled (-reinit_filter 0). The vulnerability stems from vf_hqdn3d.config_input() allocating ...

CVE-2026-15648

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-48508

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15648

The CVE-2026-15648 entry concerns the Brands for WooCommerce plugin for WordPress. Affected: all versions up to 3.8.8. Issue: Stored Cross-Site Scripting via the width shortcode attribute caused by insufficient input sanitization and output escaping. Impact: authenticated attackers with contribut...

CVE-2026-15648 Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

DEBIAN-CVE-2026-65706

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

UBUNTU-CVE-2026-65706

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

CVE-2026-65706

FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vfswaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filterframe function reuses a temporary row buffer sized for plane 0's...

CVE-2026-47714 libheif has integer overflow in inline mask size calculation that causes undersized buffer allocation

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in libheif/region.cc contains an integer overflow. Both width and height are unsigned int 32-bit values parsed from the HEIF file. Their product can exceed UINT32MAX, wrapping to...

EulerOS Virtualization 2.10.0 : glibc (EulerOS-SA-2026-2850)

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single...

GHSA-FJ7V-R99M-22GQ Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Summary Pillow's TGA RLE encoder reads past its row buffer when saving a mode "1" image. Adjacent process heap bytes can be copied into the generated TGA file. The bug is reachable through the public save API: python im.saveout, format="TGA", compression="tgarle" Older affected Pillow versions us...

TencentOS Server 3: glibc (TSSA-2026:0634)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0634 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...