Search: 10.4-5

llama.cpp versions before commit b3701 contain an out-of-bounds read vulnerability in the functions llama_decode_internal and llama_encode_internal. This flaw allows remote unauthenticated attackers to read memory or crash the process by sending integer-array prompts with token IDs outside the valid range to the llama-server /completion endpoint.

llama.cpp versions before commit b2731 have an out-of-bounds read vulnerability in the llama_model_loader component. This flaw allows attackers to craft GGUF model files with arbitrary 64-bit tensor offsets that can cause the process to crash or read adjacent process memory as model weights. The vulnerability arises from improper bounds checking on tensor offsets in the model loader.

Parse Server versions before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 contain a vulnerability where the owning object reference in $relatedTo relation queries is not properly validated. This allows a client with read access to at least one object of the owning class to bypass owning-object ACL checks by supplying a query operator instead of an object ID, potentially disclosing which readable objects are linked to owning objects it cannot read.

A security vulnerability (CVE-2026-94422) in xdg-dbus-proxy allows a message filtering bypass via reply serial, which can lead to sandbox escape. xdg-dbus-proxy is a filtering proxy for D-Bus connections, originally part of the flatpak project but now a standalone module. This issue has been addressed in version 0.1.5-4.el10_2.1 of the software.

Ignition is a utility used during system initialization to configure disks, files, and users based on a configuration source. A security vulnerability (CVE-2026-111943) in the golang crypto/x509 package used by Ignition allows man-in-the-middle attacks via untrusted intermediate certificates. This vulnerability affects Red Hat Enterprise Linux 10.0 Extended Update Support and related variants. Red Hat has released an important security update to address this issue.

A double free vulnerability exists in libyal libmsiecf through version 20260525 in the function libmsiecf_url_values_read_data(). This flaw allows attackers to corrupt heap memory by supplying a crafted MSIE cache index.dat file with an oversized unknown_offset in a partial URL record. The vulnerability can cause forensic tools processing such files to crash. The CVSS 3.1 base score is 5.5, indicating a medium severity impact primarily affecting availability.

libpff versions up to 20260926 contain an off-by-one bounds check vulnerability in the function libpff_table_read_6c_record_entries. This flaw allows attackers to trigger a heap out-of-bounds read by supplying crafted 6c table record entries in PST, OST, or PAB files. Applications using libpff, such as pffexport or pypff, may read adjacent heap memory or crash when processing malicious files.

gbsplay versions up to 0.0.103 contain an out-of-bounds read vulnerability in the mapper_map() function. This flaw allows crafted game files to cause the player to read beyond the allocated ROM buffer, resulting in a crash. The vulnerability arises from improper validation of ROM bank indexes, leading to an underflowed bank length and heap buffer overread.

A vulnerability in snappy-java prior to version 1.1.10.9 allows out-of-bounds memory access due to improper validation of array ranges passed to native memcpy. This can cause JVM crashes. The issue is fixed in version 1.1.10.9.

Kener versions 3.0.0 up to but not including 4.1.10 contain a critical authentication bypass vulnerability due to the use of a hard-coded cryptographic key fallback. If the environment variable KENER_SECRET_KEY is empty or unset, attackers who know an administrator's email can forge session tokens and gain full administrative access or create password-reset tokens. This flaw is fixed in version 4.1.10.

A vulnerability in crossbario autobahn-python versions 26.7.1 through 26.10.0 allows an unauthenticated WebSocket client to cause a memory exhaustion denial of service. The issue arises because the Brotli decompressor is called without an output limit, allowing a small, highly compressed frame to expand to hundreds of MiB before the server enforces the maximum message payload size. This flaw affects servers that enable the permessage-brotli feature via the compress extra. The vulnerability is fixed in version 26.10.1.

libosmocore versions through 1.14.1 contain an out-of-bounds read vulnerability in the iuup_rx_initialization() function located in src/gsm/iuup.c. This flaw allows a remote attacker to read memory beyond intended boundaries, potentially exposing sensitive information. The vulnerability affects multiple specific package versions of libosmocore. No CVSS score or public exploit code is available, and there is no indication of active exploitation in the wild.

libosmocore versions through 1.14.1 contain out-of-bounds read vulnerabilities in the GSM 04.80 supplementary-service component parsers located in src/gsm/gsm0480.c. This flaw allows a remote attacker to read memory beyond intended boundaries, potentially exposing sensitive information. The vulnerability affects multiple specific versions of libosmocore, including various builds from 0.9.0 through 1.11.0. There is no information provided about available patches or fixes.

The jose library versions before 1.11.13 accept ECDSA JWS signatures with non-canonical lengths due to improper signature length validation. This allows multiple distinct signature byte strings to verify as valid for the same token, causing signature malleability. While this does not enable forging new payloads or impersonation, it undermines security controls relying on signature uniqueness, such as token revocation by hash, replay protection, and deduplication.

A vulnerability in erlang-jose allows an unauthenticated remote attacker to cause a CPU exhaustion denial of service by submitting a crafted RSA JSON Web Key. The issue arises when parsing an RSA private key that omits Chinese Remainder Theorem parameters, triggering a costly factoring attempt of the modulus. This leads to excessive CPU consumption and potential denial of service. The flaw affects versions from 1.7.7 before 1.11.13.

A timing side-channel vulnerability in the pure-Erlang fallback implementation of X25519 in the jose library allows an attacker to recover a long-term private key by measuring decryption timing. The vulnerability arises because the scalar multiplication operation's execution time depends on the secret private key bits. This affects jose versions from 1.10.0 before 1.11.13. Exploitation compromises confidentiality and authenticity of data protected by the key.

The jose library versions from 10-2 through 14-2build2 use a password hashing scheme with insufficient computational effort when exporting password-encrypted private keys. The key derivation uses PBKDF2-HMAC-SHA256 with only 2048 iterations and a 64-bit salt, both significantly weaker than current security recommendations. This weakness allows an attacker who obtains an exported encrypted private key to perform an offline password-cracking attack and potentially recover the private key.

The jose_jwk:shared_secret/2 function in the jose library derives an ECDH shared secret from two JSON Web Keys (JWKs). A flaw in its implementation causes an unbounded tail-recursive loop when the two JWKs have differing key types, such as an EC key and an RSA key. This loop consumes 100% CPU on an Erlang scheduler, leading to denial of service when exploited repeatedly. The vulnerability affects jose versions from 1.5.0 before 1.11.13.

A vulnerability in the potatosalad jose (erlang-jose) library allows remote attackers to exhaust a node's memory by sending a crafted JWE token with highly compressed data. The decompression function does not limit output size, enabling data amplification that can crash the BEAM runtime and cause denial of service. This affects versions from 1.0.0 before 1.11.13.