Linux Distros Unpatched Vulnerability : CVE-2026-111147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedbrecordgetmultivalue that allows attackers to read past buffers via...

Linux Distros Unpatched Vulnerability : CVE-2026-111140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libregf through 20260526 contains a heap out-of-bounds read in libregfvalueitemreadvaluedata because it bounds value data size without subtracting the 4-byte...

Linux Distros Unpatched Vulnerability : CVE-2026-110917

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity:...

Linux Distros Unpatched Vulnerability : CVE-2026-85745

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STArea reads beyond the...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc (CENTOS7:CLSA-2026:1791855215)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1791855215 advisory. - Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache...

Adobe Substance 3D Designer <= 16.0.5 Multiple Vulnerabilities (APSB26-169)

The version of Adobe Substance 3D Designer installed on the remote host is prior or equal to 16.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-169 advisory. - Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in...

Linux Distros Unpatched Vulnerability : CVE-2026-110877

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by...

SUSE CVE-2026-93683

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...

SUSE CVE-2026-100236

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...

SUSE CVE-2026-110598

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

SUSE CVE-2026-110606

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

SUSE CVE-2026-110716

unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshieldgetfiletable that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range filetableoffset or large file counts to...

CVE-2026-111272

A flaw was found in LibRaw. A heap-based out-of-bounds read vulnerability occurs in the Nikon metadata parser when handling image files with malformed tag data. An attacker could exploit this issue by convincing a user or automated process to decode a specially crafted Nikon image file, causing...

CVE-2026-111269

A flaw was found in libical. When decoding calendar input ending with a trailing backslash, the library can read beyond allocated memory boundaries in the icalvaluedecodeicalstring function. An attacker could supply specially crafted iCalendar data to cause an application crash, leading to a Deni...

CVE-2026-111364

MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to...

CVE-2026-111363

BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary fileid values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/filebbox to...

CVE-2026-111354

crmebjava through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/orderId or /api/front/order/apply/refund/orderId to view victims' tracking numbers,...

CVE-2026-111355

zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService...

CVE-2026-111359

CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in giftdetail to harvest buyer identities and the giftkey, the...

CVE-2026-111346

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and...