PT-2026-85234

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.82 Description A race condition in the V8 engine allows a remote attacker to execute arbitrary code within the sandbox by inducing the victim to open a specially crafted HTML page. A race condition...

PT-2026-85275

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

CVE-2026-85053: Exposure of Resource to Wrong Sphere

Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85051: Access of Resource Using Incompatible Type

Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85046: Access of Resource Using Incompatible Type

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85028: Creation of Temporary File in Directory with Insecure Permissions

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...

CVE-2026-83959: Heap-based Buffer Overflow

Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-76174: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...

CVE-2026-71221: Out-of-bounds Write

A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images...

CVE-2026-71220: Out-of-bounds Write

A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2edit, the diheight field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem image...

PT-2026-90903

A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2 edit, the di height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem...

PT-2026-90904

A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images...

Linux Distros Unpatched Vulnerability : CVE-2026-71220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2edit, the diheight field from on-disk inode metadata is used as an array index without...

PT-2026-95382

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.12.1 Description An issue exists in the apply trap of the bridge lib/bridge.js where a nullish this receiver is not correctly handled. When sandboxed code invokes a host-provided non-strict sloppy-mode function without ...

CVE-2026-85045: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-85017

Name of the Vulnerable Software and Affected Versions gfs2-utils affected versions not specified Description A stack out-of-bounds write issue exists in the gfs2 edit function. The di height field from on-disk inode metadata is used as an array index without proper bounds checking. This leads to ...

D-Link DIR-825M Firmware Code Execution

The vulnerability of the sub41802C function in the /boafrm/formLtefotaUpgradeFibocom file of the LTE Module Firmware Upgrade component of the D-Link DIR-825M router’s microprogramming system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability coul...

Oracle Linux 9 : nginx:1.24 (ELSA-2026-59490)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59490 advisory. - Resolves: RHEL-219310 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 - Resolves: RHEL-217962 -...

AlmaLinux 9 : freerdp (ALSA-2026:61379)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61379 advisory. FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders CVE-2026-67301 FreeRDP: FreeRDP: Denial of Service via crafted...

openSUSE 16: emacs / emacs-el / emacs-eln / emacs-games / emacs-info / emacs-nox / etc (openSUSE-SU-2026:21711-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21711-1 advisory. Security issues fixed: - Arbitrary code execution when opening a specially crafted file bsc1275941. - CVE-2026-77219: integer overflow in the...