28885 matches found
netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
...
scsi: qla2xxx: Fix bsg_done() causing double free
...
romfs: check sb_set_blocksize() return value
...
platform/x86: classmate-laptop: Add missing NULL pointer checks
...
fbdev: smscufx: properly copy ioctl memory to kernelspace
...
Bytes is vulnerable to integer overflow in BytesMut::reserve
...
An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
...
Vim has stack-buffer-overflow in build_stl_str_hl()
...
Vim has Heap-based Buffer Underflow in Emacs tags parsing
...
Vim has Heap-based Buffer Overflow in Emacs tags parsing
...
Vim has Heap-based Buffer Overflow and OOB Read in :terminal
...
Vim has a heap-buffer-overflow and a segmentation fault
...
Vim has OS Command Injection in netrw
...
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
...
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
...
net/sched: sch_qfq: do not free existing class in qfq_change_class()
...
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
...
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
...
net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
...
libceph: return the handler error from mon_handle_auth_done()
...
libceph: make free_choose_arg_map() resilient to partial allocation
...
libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
...
libceph: prevent potential out-of-bounds reads in handle_auth_done()
...
net: mscc: ocelot: Fix crash when adding interface under a lag
...
nfsd: provide locking for v4_end_grace
...
net: fix memory leak in skb_segment_list for GRO packets
...
wifi: avoid kernel-infoleak from struct iw_point
...
net: sock: fix hardened usercopy panic in sock_recv_errqueue
...
net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
...
dmaengine: idxd: fix device leaks on compat bind and unbind
...
dm-verity: disable recursive forward error correction
...
netfilter: nf_tables: avoid chain re-validation if possible
...
net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
...
net: dsa: properly keep track of conduit reference
...
ksmbd: Fix refcount leak when invalid session is found on session lookup
...
KEYS: trusted: Fix a memory leak in tpm2_load_cmd
...
HID: uclogic: Correct devm device reference for hidinput input_dev name
...
nats-server websockets are vulnerable to pre-auth memory DoS
...
Vitess users with backup storage access can write to arbitrary file paths on restore
...
Vitess users with backup storage access can gain unauthorized access to production deployment environments
...
Chromium: CVE-2026-3063 Inappropriate implementation in DevTools
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-3062 Out of bounds read and write in Tint
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-3061 Out of bounds read in Media
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
net/mlx5e: Fix crash on profile change rollback failure
...
Malformed Valkey Cluster bus message can lead to Remote DoS
...
Valkey Affected by RESP Protocol Injection via Lua error_reply
...
libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.
...
libtiff up to v4.7.1 was discovered to contain a NULL pointer dereference via the component libtiff/tif_open.c.
...
This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
...