Monthly
Out-of-bounds write in the Linux kernel's AMD Cryptographic Coprocessor (ccp) driver allows a local low-privileged user to overrun a caller-supplied IV buffer by 8 bytes when issuing rfc3686(ctr(aes)) requests through the AF_ALG socket interface. The ccp_aes_complete() handler unconditionally copies AES_BLOCK_SIZE (16 bytes) back into the IV buffer, but RFC3686 skciphers expose only an 8-byte IV, corrupting adjacent memory. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and the EPSS probability is low (0.18%, 7th percentile).
Heap buffer overflow in GNOME localsearch (formerly tracker-miners) tracker-extract-mp3 component on Red Hat Enterprise Linux 8/9/10, Ubuntu, Debian, and SUSE allows remote attackers to trigger an out-of-bounds heap read by delivering a malformed MP3 file with crafted ID3 performer tags, leading to crashes (DoS) or disclosure of process memory contents. No public exploit identified at time of analysis, and the EPSS score of 0.19% (9th percentile) plus CISA SSVC 'Exploitation: none' indicate low real-world exploitation activity despite the 8.1 CVSS rating. Vendor patches are available across Red Hat (RHSA), Ubuntu USN-8019-1, Debian, and SUSE-SU-2026:0780/21854.
Out-of-bounds reads in the X.Org X server's XKB (X Keyboard Extension) modifier-map handling allow an authenticated X11 client to drive memory reads past the intended buffer, disclosing server memory or crashing the server for a denial of service. Affected deployments include the upstream X.Org X server and the Red Hat Enterprise Linux 6, 7, 8, 9 and 10 streams plus SUSE Linux Enterprise packages covered by the SUSE-SU-2026 advisories. Exposure is gated by reachability: on default modern RHEL and SUSE installations the X server does not listen on TCP, so realistic attackers are local users, already-authorized X sessions, or malicious/compromised X clients rather than a remote unauthenticated network actor; no integrity or code-execution impact is indicated. EPSS is 0.01% (2nd percentile) and SSVC records no exploitation, so no public exploit has been identified at time of analysis, while vendor errata are already published and the provider priority label is act_now.
Cisco Nexus 9000 Series Fabric Switches in ACI mode contains a vulnerability that allows attackers to cause the device to reload unexpectedly, resulting in a DoS condition (CVSS 7.4).
Cisco NX-OS devices can be forced to reload through a crafted LLDP packet sent by an adjacent, unauthenticated attacker, causing a denial of service condition. The vulnerability stems from improper frame field validation in the LLDP process, exploitable only from directly connected network segments. No patch is currently available for affected systems.
A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.
Denial of service in Cisco Snort 3 allows unauthenticated remote attackers to restart the Snort 3 Detection Engine by sending crafted SMTP packets with malformed MIME header fields over an established connection. The defect is missing error checking during SMTP MIME header parsing (CWE-805), and successful exploitation only affects availability, forcing a restart that can briefly interrupt inspection. Affected deployments include Cisco Open Source Snort3, Secure Firewall Threat Defense (FTD) software, and UTD Snort IPS Engine software that actively inspect SMTP traffic; no public exploit has been identified at time of analysis.
Local attackers with low-level privileges can cause buffer overflows and memory corruption in AMI AptioV UEFI firmware by supplying malformed length values to a firmware interface, potentially leading to arbitrary code execution within the BIOS/SMM environment. The vulnerability (CWE-805) affects AptioV-based firmware across OEM platforms and requires local access plus existing OS-level privileges; no public exploit identified at time of analysis. Due to the local attack vector and dependency on OEM firmware updates, this is assessed as a credible but second-tier priority.
Denial of service in Cisco Secure Firewall Threat Defense (FTD) can be triggered remotely without authentication when the legacy Snort 2 Detection Engine parses a crafted SSL/TLS certificate during connection setup, causing the engine to restart unexpectedly. The flaw affects FTD releases running Snort 2 and processing SSL policy inspection; the provided assessment rates it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), so impact is limited to a transient availability loss rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE.
Heap-based out-of-bounds write in GIMP's PAA (Paint Shop Pro Array) file format plugin allows a remote attacker to potentially execute arbitrary code on a victim's system by tricking the user into opening a specially crafted PAA image. The flaw resides in the decode_lzss() decompression function, which writes data beyond the bounds of the allocated heap buffer, enabling heap metadata corruption. No public exploit or CISA KEV listing exists at time of analysis, but the RCE-tagged impact and buffer-write primitive make this a higher-severity risk than the CVSS 5.5 score suggests; the CVSS impact metrics reflect only availability (A:H) while the description and tags indicate arbitrary code execution potential - a notable discrepancy to investigate.
Out-of-bounds write in the Linux kernel's AMD Cryptographic Coprocessor (ccp) driver allows a local low-privileged user to overrun a caller-supplied IV buffer by 8 bytes when issuing rfc3686(ctr(aes)) requests through the AF_ALG socket interface. The ccp_aes_complete() handler unconditionally copies AES_BLOCK_SIZE (16 bytes) back into the IV buffer, but RFC3686 skciphers expose only an 8-byte IV, corrupting adjacent memory. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and the EPSS probability is low (0.18%, 7th percentile).
Heap buffer overflow in GNOME localsearch (formerly tracker-miners) tracker-extract-mp3 component on Red Hat Enterprise Linux 8/9/10, Ubuntu, Debian, and SUSE allows remote attackers to trigger an out-of-bounds heap read by delivering a malformed MP3 file with crafted ID3 performer tags, leading to crashes (DoS) or disclosure of process memory contents. No public exploit identified at time of analysis, and the EPSS score of 0.19% (9th percentile) plus CISA SSVC 'Exploitation: none' indicate low real-world exploitation activity despite the 8.1 CVSS rating. Vendor patches are available across Red Hat (RHSA), Ubuntu USN-8019-1, Debian, and SUSE-SU-2026:0780/21854.
Out-of-bounds reads in the X.Org X server's XKB (X Keyboard Extension) modifier-map handling allow an authenticated X11 client to drive memory reads past the intended buffer, disclosing server memory or crashing the server for a denial of service. Affected deployments include the upstream X.Org X server and the Red Hat Enterprise Linux 6, 7, 8, 9 and 10 streams plus SUSE Linux Enterprise packages covered by the SUSE-SU-2026 advisories. Exposure is gated by reachability: on default modern RHEL and SUSE installations the X server does not listen on TCP, so realistic attackers are local users, already-authorized X sessions, or malicious/compromised X clients rather than a remote unauthenticated network actor; no integrity or code-execution impact is indicated. EPSS is 0.01% (2nd percentile) and SSVC records no exploitation, so no public exploit has been identified at time of analysis, while vendor errata are already published and the provider priority label is act_now.
Cisco Nexus 9000 Series Fabric Switches in ACI mode contains a vulnerability that allows attackers to cause the device to reload unexpectedly, resulting in a DoS condition (CVSS 7.4).
Cisco NX-OS devices can be forced to reload through a crafted LLDP packet sent by an adjacent, unauthenticated attacker, causing a denial of service condition. The vulnerability stems from improper frame field validation in the LLDP process, exploitable only from directly connected network segments. No patch is currently available for affected systems.
A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.
Denial of service in Cisco Snort 3 allows unauthenticated remote attackers to restart the Snort 3 Detection Engine by sending crafted SMTP packets with malformed MIME header fields over an established connection. The defect is missing error checking during SMTP MIME header parsing (CWE-805), and successful exploitation only affects availability, forcing a restart that can briefly interrupt inspection. Affected deployments include Cisco Open Source Snort3, Secure Firewall Threat Defense (FTD) software, and UTD Snort IPS Engine software that actively inspect SMTP traffic; no public exploit has been identified at time of analysis.
Local attackers with low-level privileges can cause buffer overflows and memory corruption in AMI AptioV UEFI firmware by supplying malformed length values to a firmware interface, potentially leading to arbitrary code execution within the BIOS/SMM environment. The vulnerability (CWE-805) affects AptioV-based firmware across OEM platforms and requires local access plus existing OS-level privileges; no public exploit identified at time of analysis. Due to the local attack vector and dependency on OEM firmware updates, this is assessed as a credible but second-tier priority.
Denial of service in Cisco Secure Firewall Threat Defense (FTD) can be triggered remotely without authentication when the legacy Snort 2 Detection Engine parses a crafted SSL/TLS certificate during connection setup, causing the engine to restart unexpectedly. The flaw affects FTD releases running Snort 2 and processing SSL policy inspection; the provided assessment rates it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L), so impact is limited to a transient availability loss rather than code execution or data compromise. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE.
Heap-based out-of-bounds write in GIMP's PAA (Paint Shop Pro Array) file format plugin allows a remote attacker to potentially execute arbitrary code on a victim's system by tricking the user into opening a specially crafted PAA image. The flaw resides in the decode_lzss() decompression function, which writes data beyond the bounds of the allocated heap buffer, enabling heap metadata corruption. No public exploit or CISA KEV listing exists at time of analysis, but the RCE-tagged impact and buffer-write primitive make this a higher-severity risk than the CVSS 5.5 score suggests; the CVSS impact metrics reflect only availability (A:H) while the description and tags indicate arbitrary code execution potential - a notable discrepancy to investigate.