CVE-2026-73074

Vim is an open source, command line text editor. Prior to 9.2.0841, propaddone in src/textprop.c uses the proplen value from gettextprops to increment a uint16t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for non...

CVE-2026-72745 FreeRDP before 3.30.0 Out-of-Bounds Read via Kerberos GSS Wrap-token EC

FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberosDecryptMessage winpr/libwinpr/sspi/Kerberos/kerberos.c. The 16-bit EC extra count field of a peer-supplied GSS Wrap token RFC 4121 is used directly in pointer arithmetic to locate the encrypted regions without being...

CVE-2026-72745

...

CVE-2026-72745

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73242...

CVE-2026-72745

CVE-2026-72745 is a duplicate of CVE-2026-73242 for FreeRDP. Technical details in connected docs describe an out-of-bounds vulnerability in kerberos_DecryptMessage() within winpr/libwinpr/sspi/Kerberos/kerberos.c, where a peer-supplied 16-bit EC (extra count) in a GSS Wrap token can move decrypt ...

exec: fix unsigned loop counter wrap in transfer_args_to_stack()

...

PT-2026-70249

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0841 Description The prop add one function in src/textprop.c uses the proplen value from get text props to increment a uint16 t property count. If the count exceeds 0xffff, it wraps around to zero, leading to a heap...

CVE-2026-68187

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

UBUNTU-CVE-2026-68187

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

CVE-2026-68187 exec: fix unsigned loop counter wrap in transfer_args_to_stack()

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

CVE-2026-68187 exec: fix unsigned loop counter wrap in transfer_args_to_stack()

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

PT-2026-69596

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the wilc1000 wifi driver where the wilc parse assoc resp info function fails to validate the length of a received association response before subtracting the header...

CVE-2026-68187: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

Alibaba Cloud Linux 3 : 0247: php:7.4 (ALINUX3-SA-2026:0247)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0247 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-14355: In PHP versions 8.2. before 8.2.32,...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3514-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3514-1 advisory. Update to version 8.2.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded...

Mermaid allows CSS injection applying to sibling elements of the diagram

Summary Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with mermaid-X, sibling and + combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram . Most users of mermaid would not be affected by this...

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

Security update for php8

This update for php8 fixes the following issues: Update to version 8.2.33. Security issues fixed: CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. CVE-2026-9672: security issues in libgd bsc1273078. CVE-2026-17543:...

SUSE-SU-2026:3514-1 Security update for php8

This update for php8 fixes the following issues: Update to version 8.2.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. - CVE-2026-9672: security issues in libgd bsc1273078. -...

CVE-2026-71202: Integer Underflow (Wrap or Wraparound)

The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height...