74419 matches found
CVE-2026-120752
PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulne...
CVE-2026-29508
ReadyMedia formerly MiniDLNA versions 1.3.0 through 1.3.3 contain a...
CVE-2026-120831
A flaw was found in libslirp in ifoutput. When moving a session fro...
CVE-2026-120830
A flaw was found in libslirp in icmpforwarderror. When building an...
CVE-2026-120740
A flaw was found in hivex. By supplying a specially crafted Windows re...
CVE-2026-120689
HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in...
CVE-2026-120067
For updatable cursors, which are enabled by default, psqlODBC adds hid...
CVE-2026-120065
For an updatable cursor over a table without OIDs that has an auto-inc...
CVE-2026-120066
On Unix-like systems, when logging is enabled, psqlODBC creates its lo...
CVE-2026-120063
When psqlODBC quotes a schema or table name into a 128-byte stack buff...
CVE-2026-120064
Several psqlODBC entry points use an application-supplied column numbe...
CVE-2026-120061
The psqlODBC parser for ODBC escape sequences in application SQL text...
CVE-2026-120062
SQLSpecialColumns in psqlODBC splices the table and schema names it re...
CVE-2026-120059
For an updatable cursor over a table without OIDs that has an auto-inc...
CVE-2026-120060
psqlODBC trusts counts and lengths in server data in three places. SQL...
CVE-2026-120058
psqlODBC sizes its row cache from the column count of a cursor's first...
CVE-2026-120057
psqlODBC copies the reply to a large-object read loread into the app...
CVE-2026-116675
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...
CVE-2026-104062
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing ...
CVE-2026-104065
Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing...
CVE-2026-104066
Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing...
CVE-2026-104061
Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloaderpsd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code...
CVE-2026-104063
Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap...
CVE-2026-104064
Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloadertiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting...
CVE-2026-104067
Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code...
CVE-2026-99241
In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite ntfsfilemappagemkwrite calls iomappagemkwrite without holding mapping-invalidatelock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and...
CVE-2026-99222
In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...
CVE-2026-99219
In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in printrec printrec leaves 'modname' and 'offset' uninitialized and kallsymslookup only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname'...
CVE-2026-99230
In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: don't leave list poison in -hashnode iouringcmddelcancelable uses hlistdel to take a command off -cancelableuringcmd, which leaves LISTPOISON1/2 behind in -hashnode. Requests are recycled through the request cache...
CVE-2026-99234
In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so createfieldvarhist registers a second hist trigger on that event to provide it,...
CVE-2026-99236
In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicateparse's inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an...
CVE-2026-99238
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when updating modules in persistent instances tracemodulerecord walks ftracetracearrays from the module notifier without tracetypeslock. A concurrent rmdir of an instance removes it from the list and...
CVE-2026-99231
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...
CVE-2026-99242
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix race between fallocate and mmap reads The fallocate implementation only takes invalidatelock for punch hole, collapse range, and insert range operations. For standard allocation modes mode == 0, FALLOCFLKEEPSIZE, the lo...
CVE-2026-99220
In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...
CVE-2026-99223
In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTLREAD returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, deterministic hash of the type pointer,...
CVE-2026-99232
In the Linux kernel, the following vulnerability has been resolved: tracing/syscalls: Use copyfromuser for the faultable syscall buffer syscallcopyuserarray copies the buffer argument of faultable syscalls write, pwrite64, ... with copyfromuser, which skips accessok. Use copyfromuser instead so a...
CVE-2026-99237
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when resetting last boot data from readers updatelastdataifempty is called from tracingopen with OTRUNC, tracingreadpipe and tracingbuffersread without tracetypeslock. Two readers can both pass the...
CVE-2026-99239
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...
CVE-2026-99240
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damoscommitquotagoal for zero targetvalue Patch series "mm/damon: move zero damos quota targetvalue handling to the core layer". Having zero DAMOS quota target value can cause division by zero. DAMON API...
CVE-2026-99217
In the Linux kernel, the following vulnerability has been resolved: fork: release the files of a failed fork after schedcancelfork Reorder copyprocess cleanup so schedfork taking scxforkrwsem scxprefork is safe and isn't held around exiting files. Right now, a fork that fails while another thread...
CVE-2026-99228
In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. iowqexitworkers signals every worker, to get it out of an interruptible sleep, and wai...
CVE-2026-99218
In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish releases the parked threads by clearing -task in their corethread entry and calling wakeupprocess on each of them. It does that without holding a reference on the...
CVE-2026-99224
In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctldescribekey must keep the key type's name alive until kasprintf has consumed it. The retained key reference keeps the key and its description alive, but does not pin the...