PT-2026-90721

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.18.1 Description A malicious sandboxed application can obtain arbitrary read and write access to files on the host, potentially leading to arbitrary code execution. This occurs because Flatpak creates app data...

CVE-2026-89633

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

DEBIAN-CVE-2026-89489

In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1katomic syscall sysor1katomic syscall 244 in the "or1k" ABI takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0r4 l.lwz...

DEBIAN-CVE-2026-81017

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number in-sensornum. crosecsensorhubringhandler validates the FIFO event count, the per-read count and the ring bound, but...

EUVD-2026-76545

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

CVE-2026-89489

CVE-2026-89489 affects the Linux kernel on the openrisc (or1k) architecture. The sys_or1k_atomic() syscall (number 244) swaps two user-supplied words via hand-written assembly without validating the pointers with access_ok() and without exception table entries for the four memory accesses. An unp...

SUSE-SU-2026:23706-1 Security update for clamav

This update for clamav fixes the following issues: - CVE-2026-20337: Improper boundary checks for content in zip archive parser bsc1274597. - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records bsc1274598. - CVE-2026-20339: integer overflow in the PESpin...

CVE-2026-89633: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

CVE-2026-89489: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1katomic syscall sysor1katomic syscall 244 in the "or1k" ABI takes two user pointers, v1 and v2, and swaps the words they point to in hand-written assembly. l.lwz r29,0r4 l.lwz...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : libEBML vulnerability (USN-8746-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8746-1 advisory. It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a...

PT-2026-90092

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dm-pcache component where geometry fields from on-disk cache info are not properly validated. The cache segs init function iterates based on the n segs value to...

PT-2026-90349

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the coalesce t2 function computes data pointers using server-supplied DataOffset fields without validating them against buffer bounds. A small...

PT-2026-96443

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl used against rl count in refcount block validator ocfs2 find refcount rec in rl walks the on-disk refcount record array with: for ; i rf records.rl used; i++ rec = &rb-rf records.rl recsi; ... rl recs lives in ...

Palo Alto Networks PAN-OS 10.0.x / 10.2.x / 11.0.x / 8.1.x / 9.0.x / 9.1.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 8.1.x, 9.0.x, 9.1.x, 10.0.x, 10.2.x, or 11.0.x. It is, therefore, affected by a vulnerability. A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a malicious...

USN-8746-1: libEBML vulnerability

It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service...

USN-8746-1 libebml vulnerability

It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service...

CVE-2026-88937 knowns through 0.33.0 Path Traversal via Template Engine

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal...

AZL-101730 CVE-2026-59679 affecting package libXfont2 for versions less than 2.0.9-1

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

CVE-2026-64836: Improper Limitation of a Pathname to a Restricted Directory

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...