Tagged “csaf”
CVEs tagged csaf, newest first.
7670 CVEsRSS
CVE-2026-98613Medium· 4.4kernel: bpf: Bound ownership depth through local kptrs and graph roots (CVE-2026-98613)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A local user with permissions to load BPF programs can trigger a Denial of Service (DoS) by creating deeply nested or cyclical object references using local ker…
CVE-2026-98616Medium· 4.1kernel: eth: fbnic: reset num_napi when the napi vectors are freed (CVE-2026-98616)
A flaw was found in the Linux kernel's fbnic driver. This flaw allows a local user to trigger a kernel crash, resulting in a Denial of Service (DoS). During power management suspend or failed resume operations, the driver frees interrupt v…
CVE-2026-98615Medium· 4.4kernel: eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox (CVE-2026-98615)
A flaw was found in the Linux kernel's fbnic network driver. A local user with administrative privileges could trigger a Denial of Service (DoS) by initiating a reset or teardown of the firmware mailbox. Because the driver fails to properl…
CVE-2026-98639Medium· 5.8kernel: kernel: Incorrect TLB flushing in RISC-V KVM via improper nested acceleration update order (CVE-2026-98639)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the RISC-V architecture. During nested virtualization acceleration, control flags are written before the target page parameters are properly committed …
CVE-2026-98642Medium· 4.7kernel: kernel: Denial of Service via race condition in BPF memory allocator (CVE-2026-98642)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) memory allocator. A race condition occurs when bulk memory allocation and memory cleanup run concurrently without adequate synchronization. A local attacker could exploit …
CVE-2026-98650Medium· 4.7kernel: kernel: Denial of Service via race condition in s390 KVM storage key handling (CVE-2026-98650)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the s390 architecture. A race condition occurs when storage key management functions process large memory pages that are simultaneously split by anothe…
CVE-2026-112046Medium· 5.5org.ow2.asm/asm: OW2 ASM: Denial of Service via infinite loop in Label.resolve() (CVE-2026-112046)
A flaw was found in OW2 ASM. An attacker can cause a Denial of Service (DoS) by supplying a specially crafted Java class file with methods that grow beyond 64 kilobytes during transformation. When processing this file, an offset truncation…
CVE-2026-112048Medium· 6.1PoClibspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLi…
CVE-2026-112052Medium· 6.1PoClibspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing
libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BL…
CVE-2026-112059Medium· 6.1PoClibLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variabl…
CVE-2026-112062Medium· 5.9PoClwip: lwIP: Denial of Service via stack buffer overflow in mDNS response handling (CVE-2026-112062)
A flaw was found in lwIP. An adjacent attacker on the local network can cause a Denial of Service (DoS) by sending specially crafted multicast Domain Name System (mDNS) responses with invalid domain names or record lengths. Processing thes…
CVE-2026-112057Medium· 5.5PoClibdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a craft…
CVE-2026-112058Medium· 5.5PoClibdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT
VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc…
CVE-2026-112063Medium· 5.9PoClibstrophe: libstrophe: Denial of Service via oversized SCRAM salt (CVE-2026-112063)
A flaw was found in libstrophe. A malicious XMPP (Extensible Messaging and Presence Protocol) server can exploit a stack-based buffer overflow in the SCRAM (Salted Challenge Response Authentication Mechanism) authentication handler by send…
CVE-2026-112007Medium· 6.1PoCSchism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader
Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES. Attackers can supply a crafted .ult module that overwrite…
CVE-2026-112006Medium· 6.5OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the…
CVE-2026-112008Medium· 6.1PoClibmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr
libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. …
CVE-2026-112020Medium· 6.1PoCLodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()
LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declar…
CVE-2026-111880High· 7.4FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward s…
CVE-2026-111881High· 7.6PoCFreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard
FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-…
CVE-2026-89096Medium· 5.9Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocat…
CVE-2026-89085Medium· 6.6PoCParted: parted: heap-based buffer overflow via crafted fat32 filesystem image
A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user …
CVE-2026-89088Medium· 5.5PoCParted: parted: denial of service via heap buffer overflow during fat16 resize
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malfo…
CVE-2026-62439High· 7.0PoCGimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker ca…
CVE-2026-62438Medium· 6.1Gimp: gimp: paa integer overflow out-of-bounds read
A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an int…
CVE-2026-17591Low· 3.6Libarchive: libarchive: use-after-free via aliased mac metadata copy
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issu…
CVE-2026-111802Medium· 6.6Nautilus: nautilus: arbitrary file deletion via trash symlink
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this…
CVE-2026-110752High· 7.5Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before …
CVE-2026-110754Medium· 6.5Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the …
CVE-2026-110758High· 7.5Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted …