CVE-2026-13326: Out-of-bounds Read

An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag...

CVE-2026-88914: Integer Overflow or Wraparound

A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an integer overflow in 32-bit unsigned arithmetic can bypass a bounds check in the caption parser. This leads to an out-of-bounds heap read o...

CVE-2026-89250: Missing Authentication for Critical Function

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to downlo...

CVE-2026-81011: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

CVE-2026-80959: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cacheposdecode takes the persisted keytail and dirtytail segoff from the cache device and addresses within the segment with it. A segoff at or past the segment datasize,...

CVE-2026-89457: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device-private, either directly or through the DASDDEFINEATTR macro. Duri...

CVE-2026-81013: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validatepasswordinput computes length = strlenbuf and then checks buflength - 1 to strip a trailing newline, without checking that length is nonzero first. Writi...

CVE-2026-89481: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it:...

CVE-2026-89443: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...

CVE-2026-89726: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

CVE-2026-89633: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

CVE-2026-89634: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlinkdata" compared the post-ALIGN length against the remaining...

CVE-2026-89588: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: GHES: fix ARM section length accounting after header In gheshandlearmhwerror, after skipping the cpersecprocarm header with err + 1, the remaining length was reduced by sizeoferr pointer size instead of sizeoferr...

CVE-2026-89722: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pciwritelegacyio pciwritelegacyio loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if count != 1 && count != 2 && count != 4 return -EINVAL; return...

Linux Distros Unpatched Vulnerability : CVE-2026-89160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject. CVE-2026-89160 Note that Nessus relie...

Linux Distros Unpatched Vulnerability : CVE-2026-79522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in the gfdmgetchunkdata function src/utils/downloader.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via sending a...

PT-2026-90089

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cache pos decode takes the persisted key tail and dirty tail seg off from the cache device and addresses within the segment with it. A seg off at or past the segment data size,...

PT-2026-89845

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the json decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php ...

PT-2026-90299

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eir get service data eir get service data walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eir len -= dlen; eir get data reports dle...

PT-2026-90367

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs name decode in handle session handle session decodes the MDSCapAuth records carried by a CEPH SESSION OPEN message msg version = 6. For each record the match.path and match.fs name byte strings...