# HG changeset patch
# User Sebastien Jodogne <s.jodogne@gmail.com>
# Date 1786699357 -7200
# Node ID ae6345f0884d26049dd9e3903aa2d2111f415495
# Parent  d850970fb101f74226a72040e74099b173623200
NEWS

diff -r d850970fb101 -r ae6345f0884d NEWS
--- a/NEWS	Fri Aug 14 11:08:48 2026 +0200
+++ b/NEWS	Fri Aug 14 11:22:37 2026 +0200
@@ -121,7 +121,9 @@
 * Fix a Denial of Service via Deeply Nested DICOM Sequences (CVE-2026-10528):
   https://orthanc.uclouvain.be/bugs/show_bug.cgi?id=258
   Security issue reported by Jose Lopez Martinez (aka elpe_pinillo) from Deloitte
-* Fixed various OOB read/write (TODO: still waiting for CVE ID)
+* Fixed various OOB read/write, currently without CVE ID, but derived from older vulnerabilities
+  (CVE-2026-5437, CVE-2026-5438, CVE-2026-5439, CVE-2026-5440, CVE-2026-5441, CVE-2026-5442,
+  CVE-2026-5443, CVE-2026-5444, CVE-2026-5445)
 * Improved preview and rendering of multiframe instances a with a Color Lookup Table; 
   notably, some cardiac US instances
 * Lua: Fix the "ReceivedCStoreInstanceFilter()" callback whose return value was not taken into account