A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

CVE Database V5

CVE-2026-92824: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.

CVE-2026-92823: Improper Handling of Highly Compressed Data (Data Amplification) in Red Hat Red Hat Enterprise Linux 10

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.

CVE-2026-92822: Uncontrolled Recursion in Red Hat Red Hat Enterprise Linux 10

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-114039: SQL Injection in projectworlds Advanced Library Management System

This entry is a daily update from the SANS Internet Storm Center (ISC) Stormcast podcast dated October 21, 2026. It provides general information about the ISC handlers and links to educational content but does not describe any specific security threat or vulnerability.

The provided content is a routine ISC Stormcast podcast announcement referencing the date and links to classes taught by a handler. There are no technical details, vulnerability information, or threat indicators included in the source content.

SANS ISC Handlers Diary

Original Source

ISC Stormcast For Wednesday, October 21st, 2026 https://isc.sans.edu/podcastdetail/10144, (Wed, Oct 21st)

acrobat-for-edge

CVE-2026-75751 is an out-of-bounds write vulnerability in Adobe Acrobat for Edge that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires the victim to open a malicious file, involving user interaction. The vulnerability has a high severity with a CVSS score of 8.8.

Adobe Acrobat for Edge contains an out-of-bounds write vulnerability (CWE-787) that allows an attacker to execute arbitrary code in the context of the current user. Successful exploitation depends on user interaction, specifically opening a crafted malicious file. The vulnerability affects versions from 0 up to and including 154.0.4258.37. No known exploits are reported in the wild. The CVSS v3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

CVE-2026-75751 is an out-of-bounds write vulnerability in Adobe Acrobat for Edge that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires the victim to open a malicious file, involving user interaction. The vulnerability has a high severity with a CVSS

CVE-2026-75751 has been rejected

Official rejection reason