https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-120830/https://vulnfeed.org/cve/CVE-2026-120830/Tue, 03 Nov 2026 00:17:18 +0000A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.https://vulnfeed.org/cve/CVE-2026-120194/https://vulnfeed.org/cve/CVE-2026-120194/Sat, 31 Oct 2026 10:16:38 +0000A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.https://vulnfeed.org/cve/CVE-2026-119777/https://vulnfeed.org/cve/CVE-2026-119777/Fri, 30 Oct 2026 18:17:27 +0000A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.https://vulnfeed.org/cve/CVE-2026-119528/https://vulnfeed.org/cve/CVE-2026-119528/Fri, 30 Oct 2026 14:16:45 +0000A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.https://vulnfeed.org/cve/CVE-2026-103963/https://vulnfeed.org/cve/CVE-2026-103963/Fri, 30 Oct 2026 05:16:57 +0000A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).https://vulnfeed.org/cve/CVE-2026-115486/https://vulnfeed.org/cve/CVE-2026-115486/Fri, 23 Oct 2026 01:16:53 +0000A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.