CVE-2026-98206 Input: cyttsp5 - clamp the HID report size before memcpy

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into responsebuf, which is CYMAXINPUT bytes...

CVE-2026-98189

The Linux kernel contains an Out-of-Bounds (OOB) write vulnerability in the wilc1000 wifi driver within the wilc_wlan_handle_isr_ext() function. The driver fails to validate the RX transfer size reported by the device's interrupt status register (up to 131,068 bytes) against the rx_buffer size, w...

CVE-2026-98185 wifi: mwifiex: validate scan response extents

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiexret80211scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size without first proving that either extent fits. A short response or oversize...

CVE-2026-98184 wifi: mwifiex: prevent authentication frame length truncation

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiexcfg80211authenticate derives the authentication frame length from req-ielen and req-authdatalen, both of type sizet, but stores it in a u16. NL80211ATTRAUTHDATA...

CVE-2026-98184

The Linux kernel contains a heap buffer overflow in the mwifiex driver. The mwifiex_cfg80211_authenticate() function incorrectly stores the sum of req->ie_len and req->auth_data_len (both size_t) into a u16 variable. Because NL80211_ATTR_AUTH_DATA lacks a maximum length policy, the sum can ...

CVE-2026-98184 wifi: mwifiex: prevent authentication frame length truncation

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiexcfg80211authenticate derives the authentication frame length from req-ielen and req-authdatalen, both of type sizet, but stores it in a u16. NL80211ATTRAUTHDATA...

EUVD-2026-93112

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiexcfg80211authenticate derives the authentication frame length from req-ielen and req-authdatalen, both of type sizet, but stores it in a u16. NL80211ATTRAUTHDATA...

CVE-2026-98170 smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...

CVE-2026-98168

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

CVE-2025-9961

CVE-2025-9961 ثغرة تجاوز سعة المخزن المؤقت في CWMP لأجهزة TP-Link AX10/AX1500 وتنفيذ تعليمات برمجية عن بُعد نظرة عامة تجاوز سعة المخزن المؤقت المستند إلى المكدس في CWMP TR-069 مما يؤدي إلى تنفيذ تعليمات برمجية عن بُعد. الحقل| القيمة ---|--- المنتج| TP-Link AX10, AX1500 الإصدارات المتأثرة| AX10...

CVE-2025-21333

CVE-2025-21333 Hyper-V NT Kernel Integration VSP vkrnlintvsp.sys Paged Pool ढेर ओवरफ्लो → स्थानिक विशेषाधिकार वृद्धि LPE। यह निर्देशिका प्रयोगशाला के लिए PoC स्रोत कोड है MrAle98/CVE-2025-21333-POC पर आधारित, स्थानीय पैच सहित। 1. भेद्यता सारांश मद| सामग्री ---|--- CVE| CVE-2025-21333 प्रकार|...

CVE-2026-25272

Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation...

CVE-2026-25270

Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...

CVE-2026-25269

Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size...

CVE-2026-25274

Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization...

CVE-2026-105778

A vulnerability has been found in Tenda AC5 02.03.01.111multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack...

EUVD-2026-92987

A vulnerability has been found in Tenda AC5 02.03.01.111multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack...

OPENSUSE-SU-2026:22023-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 154.0.8037.97 boo1284015 CVE-2026-103628: Out of bounds write in WebGL CVE-2026-103626: Incorrect authorization in FileSystem CVE-2026-103621: Integer overflow in Compositing CVE-2026-103630: Use after free in...

CVE20264893poc

الطوبولوجيا: https://medium.com/@yanyuyingshu/reproduction-journal-dnsmasq-ecs-validation-and-buffer-overflow-flaws-e0fe0f66f60c الخطوات​ 1.vi /etc/dnsmasq.conf​ port=5353​ listen-address=xxx.xxx.xxx.x bind-interfaces​ no-resolv​ no-hosts​ no-poll​ cache-size=1000​ log-queries​ log-facility=-​...

CVE-2026-48095

CVE-2026-48095 7-Zip एक फ़ाइल आर्काइवर है जिसमें उच्च संपीड़न अनुपात होता है। संस्करण 26.00 और उससे पहले के संस्करणों में NTFS संपीड़ित स्ट्रीम बफ़र GetCuSize shift UB में कम आवंटन के कारण हीप बफ़र ओवरफ़्लो की भेद्यता है, जो संभावित रूप से हमलावरों को मनमाना कोड निष्पादन या एप्लिकेशन क्रैश का कार...