104903 matches found
CVE-2026-112257
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash...
GO-2026-6732 Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If thi...
CLSA-2026-1792443466 pixman: Fix of CVE-2022-44638
CVE-2022-44638: Integer overflow in pixmansamplefloory leading to heap out-of-bounds write in rasterizeedges8...
DEBIAN-CVE-2026-110680
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CVE-2026-76788
The Zephyr RTOS OSDP Control Panel reply parser contains a stack out-of-bounds write in cp_decode_response() within subsys/mgmt/osdp/src/osdp_cp.c. When processing REPLY_KEYPPAD or REPLY_RAW types, the parser fails to validate that the payload length stays within the fixed 64-byte OSDP_EVENT_MAX_...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...
CLSA-2026-1792442076 jasper: Fix of 4 CVEs
Add Amazon Linux 2 ELS support mirrors centos7els branch with .amzn2 dist via / leapfrog over stock 1.900.1-33.amzn2.0.1 - Import CVE-2020-27828 patch from amzn2 stock SRPM out-of-bounds write in jpc encoder; jasper-2.0.14-CVE-2020-27828.patch - Import CVE-2021-3443 patch from amzn2 stock SRPM...
hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request
A flaw was found in hostapd. An unauthenticated attacker within wireless range can send a specially crafted management frame during Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing. This crafted frame, containing a malformed Multi-Link Element or Per-STA Profile...
hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request
A flaw was found in hostapd. An unauthenticated attacker within wireless range can send a specially crafted management frame during Wi-Fi 7 IEEE 802.11be Multi-Link Operation MLO association request processing. This crafted frame, containing a malformed Multi-Link Element or Per-STA Profile...
CLSA-2026-1792440720 squashfs-tools: Fix of CVE-2021-40153
CVE-2021-40153: fix write outside destination directory in unsquashfs...
CLSA-2026-1792439424 squashfs-tools: Fix of CVE-2021-40153
CVE-2021-40153: fix write outside destination directory in unsquashfs...
AZL-109866 CVE-2026-110680 affecting package perl-Cpanel-JSON-XS 4.39-1
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...
CVE-2026-110680
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...
UBUNTU-CVE-2026-110680
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...
CVE-2026-110680
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...
CVE-2026-98532
A flaw was found in the Linux kernel. A remote attacker could cause a Denial of Service DoS or memory corruption by sending specially crafted IPv6 network packets. The IPv6 extension header parsing mechanism fails to verify that the declared length of a header fits within the received packet data...
CVE-2026-96233
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network...
CVE-2026-11319
TickTick Android application com.ticktick.task 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename vi...