UBUNTU-CVE-2026-47321

The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater than 1 thousand, leading to an...

UBUNTU-CVE-2026-61714

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index fluidplayert::channelisplaying outside its fixed-size heap allocation while tracking active channels. The resulting...

UBUNTU-CVE-2026-61723

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates ptbl chunks with the unsigned expression cues 4 + cbsize without checking whether the multiplication and addition fit in 32 bits. A crafted DLS file can supply a...

UBUNTU-CVE-2026-58264

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

UBUNTU-CVE-2026-61722

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articulation chunks using the unsigned expression cbsize + connblocks 12 without first ensuring that the multiplication and addition fit in 32 bits. A crafted DLS...

UBUNTU-CVE-2026-61721

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS loader assigns file-controlled wsmp.loopstart and wsmp.looplength values to samples without calling fluidsamplevalidate or fluidsamplesanitizeloop. A crafted DLS file can place...

UBUNTU-CVE-2026-61720

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SFMODSIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the...

UBUNTU-CVE-2026-61551

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...

UBUNTU-CVE-2026-61552

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL...

UBUNTU-CVE-2026-69184

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsnameparse enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource...

UBUNTU-CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

UBUNTU-CVE-2026-69186

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsparse trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because processanswer invokes parsing before transaction ID and...

UBUNTU-CVE-2026-73638

Imager versions from 0.4502 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiffloadifd. tiffloadifd validates an IFD entry's data by checking that entry-offset + entry-size stays within the EXIF block, and never checks the start offset itself. Where that sum is n...

UBUNTU-CVE-2026-73639

Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in readdirect8. With a tRNS chunk, readdirect8 adds an alpha channel to the image it creates but still sizes the row buffer from the original channel count...

UBUNTU-CVE-2026-54604

OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and openslidetiffreadtile to request a full-height destination for a partial bottom tile row, allowing uninitialized...

UBUNTU-CVE-2026-48977

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parselevel0xml processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memo...

UBUNTU-CVE-2026-59944

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...

UBUNTU-CVE-2026-42784

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

UBUNTU-CVE-2026-48785

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

UBUNTU-CVE-2026-47215

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...

UBUNTU-CVE-2026-25832

In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...

UBUNTU-CVE-2026-71198

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the importfilteringopts host restrictions. An authenticated user ca...

UBUNTU-CVE-2023-24291

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter...

UBUNTU-CVE-2023-24288

An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers to cause a Denial of Service DoS via creating an excessive amount of save states...

UBUNTU-CVE-2023-34854

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function...

UBUNTU-CVE-2023-24285

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed...

UBUNTU-CVE-2023-24287

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the "M" command...

UBUNTU-CVE-2023-24286

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter...

UBUNTU-CVE-2023-24284

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the ismarkable function...

UBUNTU-CVE-2023-24283

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of Service DoS via a crafted save file...

UBUNTU-CVE-2026-49838

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP...

UBUNTU-CVE-2026-49837

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded b...

UBUNTU-CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

UBUNTU-CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

UBUNTU-CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

UBUNTU-CVE-2026-84732

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow...

UBUNTU-CVE-2026-80230

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

UBUNTU-CVE-2026-19931

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

UBUNTU-CVE-2026-18924

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process...

UBUNTU-CVE-2026-82209

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...

UBUNTU-CVE-2026-13608

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle MITM attack can inject a premature or shortcut response that bypasses complete peer...

UBUNTU-CVE-2026-80255

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

UBUNTU-CVE-2026-80229

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

UBUNTU-CVE-2026-46636

Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a...

UBUNTU-CVE-2026-85508

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in outputdellsysteminfocmcipv6info in ipmi-oem/ipmi-oem-dell.c cmc-ipv6-info subcommand to dell get-system-info...

UBUNTU-CVE-2026-85507

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in outputdellsysteminfocmcinfo in ipmi-oem/ipmi-oem-dell.c cmc-info subcommand to dell get-system-info...

UBUNTU-CVE-2026-85504

FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses...

UBUNTU-CVE-2026-85509

FreeIPMI before 1.6.19 has a stack-based buffer overflow in readfrudata in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested...

UBUNTU-CVE-2026-85506

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in getdellsysteminfoidracinfo in ipmi-oem/ipmi-oem-dell.c idrac-info subcommand to dell get-system-info...

UBUNTU-CVE-2026-85505

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmioemfujitsugetselentrylongtext in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 which has different affected versions...