Schwachstellen, die jetzt zählen.

Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an…

Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong…

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.

elasticsearch: elasticsearch: Denial of Service via deeply nested serialized payloads

github.com/mongodb/mongo-tools: mongorestore: Privilege escalation via crafted collection names in database dumps

hdf5: hdf5: Denial of Service via heap buffer over-read in external link traversal

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen() without validating the buffer against its stored size (udata_size, which was marked unused). A crafted HDF5 file containing an external link whose data is not NULL-terminated, or is too short to hold both strings…

Rsync: Schwachstelle ermöglicht Denial of Service

rsync: rsync: Denial of Service via crafted checksums during delta transfer

io.vertx/vertx-web-client: vertx-web-client: Information disclosure via shared web client cache

mistune: mistune: Denial of Service via quadratic-time emphasis delimiter processing

FreeRDP: FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate

freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads

ntpsec: ntpsec: Memory corruption via crafted NTS extension field

Mozilla Foundation Security Advisory 2026-128

firefox: thunderbird: Incorrect boundary conditions in the Layout: Block and Inline component

mongodb: MongoDB Node.js driver: Information disclosure via premature connection pool reuse

image-customization-controller: Unauthenticated plaintext image server with directory listing exposes Ignition images containing cluster pull secret

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

kernel: kernel: Arbitrary code execution via use-after-free in TIPC subsystem

org.apache.jclouds/jclouds-core: Apache jclouds: Denial of Service via XML entity expansion

qt: qt: Denial of Service via malformed CoAP message

PyMuPDF: PyMuPDF: Arbitrary code execution via stack-based buffer overflow in JM_set_annot_callout_line

go.temporal.io/server: Temporal Server: Arbitrary command execution via untrusted Kubernetes client configuration

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI.

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted SystemUI Quick Controls panel, and gain a Background Activity Launch (BAL) grant from SystemUI when the user interacts with the spoofed element.

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized…

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to `setExtendedInfo` and `getExtendedInfo`, potentially enabling code execution within the privileged HAL process.

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method.

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then exfiltrated back to the attacker, potentially leaking sensitive information like pointers and buffer handles.

ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack…

ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitored by ReadyMedia to trigger automatic parsing via inotify, achieving remote…

In multiple functions of base.c, there is a possible use-after-free due to a race condition.

In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of dma-buf.c, there is a possible use after free due to a race condition.

In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

postgresql-odbc: postgresql-odbc: SQL injection via unescaped column names in updatable cursors

psqlodbc: psqlodbc: Arbitrary code execution via unvalidated column and row indexes

postgresql-odbc: postgresql-odbc: arbitrary SQL execution via unescaped input in SQLSpecialColumns

PostgreSQL ODBC Treiber: Mehrere Schwachstellen ermöglichen Manipulation von Daten

postgresql-odbc: postgresql-odbc: Memory corruption via malformed SQL escape sequences

postgresql-odbc: postgresql-odbc: Arbitrary code execution via heap buffer overflow during cursor fetch