https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:14:47.851663+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:3405 ALSA-2026:3405 — Important: libpng security update 2026-10-02T16:14:48.575148+00:00

Affected: AlmaLinux:9: libpng, AlmaLinux:9: libpng-devel

The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files.

Security Fix(es):

* libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API (CVE-2026-22801) * libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read (CVE-2026-22695) * libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-04960 bdu:2026-04960 2026-10-02T16:14:48.575258+00:00 bdu:2026-04960 https://cve.radiocsirt.org/vuln/bell-cve-2026-22801 BELL-CVE-2026-22801 2026-10-02T16:14:48.575284+00:00

Affected: Alpaquita:23: libpng, Alpaquita:25: libpng, Alpaquita:stream: libpng, BellSoft Hardened Containers:23: libpng, BellSoft Hardened Containers:25: libpng, BellSoft Hardened Containers:stream: libpng

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0199 certfr-2026-avi-0199 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq… 2026-10-02T16:14:48.575313+00:00 certfr-2026-avi-0199 https://cve.radiocsirt.org/vuln/cleanstart-2026-af52025 Withdrawn: CLEANSTART-2026-AF52025 — In libexpat before 2 2026-10-02T16:14:48.575330+00:00

Withdrawn by the publisher.

Affected: CleanStart: apache-zookeeper

Multiple security vulnerabilities affect the apache-zookeeper package. In libexpat before 2. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-265580 EUVD-2026-265580 2026-10-02T16:14:48.575351+00:00 EUVD-2026-265580 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22801 fkie_cve-2026-22801 2026-10-02T16:14:48.575362+00:00

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-22801 msrc_CVE-2026-22801 — LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_* 2026-10-02T16:14:48.575386+00:00 msrc_CVE-2026-22801 https://cve.radiocsirt.org/vuln/oesa-2026-1205 OESA-2026-1205 — libpng security update 2026-10-02T16:14:48.575402+00:00

Affected: openEuler:24.03-LTS: libpng, openEuler:24.03-LTS-SP1: libpng, openEuler:24.03-LTS-SP2: libpng, openEuler:24.03-LTS-SP3: libpng, openEuler:20.03-LTS-SP4: libpng, openEuler:22.03-LTS-SP4: libpng

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fix(es):

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.(CVE-2026-22695)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.(CVE-2026-22801)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10060-1 openSUSE-SU-2026:10060-1 — libpng16-16-1.6.54-1.1 on GA media 2026-10-02T16:14:48.575440+00:00

libpng16-16-1.6.54-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:12274 RHSA-2026:12274 — Red Hat Security Advisory: OpenShift Container Platform 4.12.88 bug fix and security update 2026-10-02T16:14:48.575457+00:00

libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API libpng: LIBPNG has a heap buffer overflow in png_set_quantize vim: Vim: Arbitrary code execution via 'helpfile' option processing vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin vim: Vim: Denial of service and information disclosure via crafted swap file vim: Vim: Arbitrary code execution via command injection in glob() function

 https://cve.radiocsirt.org/vuln/suse-su-2026:20127-1 SUSE-SU-2026:20127-1 — Security update for libpng16 2026-10-02T16:14:48.575488+00:00

Security update for libpng16

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-22801 UBUNTU-CVE-2026-22801 2026-10-02T16:14:48.575503+00:00

Affected: Ubuntu:Pro:18.04:LTS: libpng1.6, Ubuntu:Pro:20.04:LTS: libpng1.6, Ubuntu:22.04:LTS: libpng1.6, Ubuntu:24.04:LTS: libpng1.6, Ubuntu:25.10: libpng1.6, Ubuntu:26.04:LTS: libpng1.6

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0068 WID-SEC-W-2026-0068 — libpng (API-Funktionen): Mehrere Schwachstellen ermöglichen DoS und Offenlegung von Informationen 2026-10-02T16:14:48.575531+00:00

Ein lokaler Angreifer kann mehrere Schwachstellen in libpng ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.