TI-2026-27657 CVE-2026-35547 · GHSA-wq83-w9r6-h456
Heap overflow in libnv
Priority LOW 37
When processing the header of an incoming message, libnv failed to properly validate the message size.
Vulnerabilities
6 records
TI-2026-28432 CVE-2026-39457 · GHSA-gfv8-jx4x-32h7
Stack overflow via select() file descriptor set overflow
Priority LOW 35
When exchanging data over a socket, libnv uses select(2) to wait for data to arrive.
TI-2026-30795 CVE-2026-42512 · GHSA-6r9j-w82p-v45p
Remotely triggerable out-of-bounds heap write in dhclient
Priority MEDIUM 40
As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers.
TI-2026-06287 CVE-2026-7164 · GHSA-7vxr-7vxq-j68j
pf can overflow the stack parsing crafted SCTP packets
Priority LOW 39
Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters.
TI-2026-06384 CVE-2026-7270 · GHSA-7jcv-x7mf-56q8
Local privilege escalation via execve()
Priority LOW 35
An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers.
TI-2026-30794 CVE-2026-42511 · GHSA-xg3v-hpwh-q32x
Remote code execution via malicious DHCP options
Priority LOW 38
The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives.