Adobe Substance 3D Stager 3.0.0 < 3.1.9 Multiple Vulnerabilities (APSB26-170) (macOS)

The version of Adobe Substance 3D Stager installed on the remote macOS host is prior to 3.1.9. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-170 advisory. - Substance3D - Stager is affected by a Use After Free vulnerability that could result in arbitrary code...

ROS-20261014-73-0154

The vulnerability in the kernel-lt is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791973636)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791973636 advisory. - Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the...

ROS-20261014-73-0079

The vulnerability of the vcnv30decmsg function in the drivers/gpu/drm/amd/amdgpu/vcnv30.c driver for AMD GPU cores in Linux operating systems is related to reading beyond the buffer boundaries. Exploiting this vulnerability may allow an attacker to access protected information or cause service...

ROS-20261014-73-0218

The vulnerability in the kernel-lt is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-98405

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

PT-2026-114101

CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI read node header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI stridx c to scan past disk node dat...

PT-2026-114098

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg multipart parse that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body...

PT-2026-114117

MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap sort cmp and Ap...

PT-2026-114039

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

Google Chrome Buffer Overflow DoS

The vulnerability in the Google Chrome web browser relates to reading protected information beyond the allowed buffer size. Exploiting this vulnerability could allow a malicious actor to cause a service failure through a specially created HTML page...

PT-2026-113688

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

CVE-2026-75085: Out-of-bounds Read

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...

CVE-2026-101946: Out-of-bounds Read

An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent low-privilege attacker to disclose limited rpd process memory and disrupt an LDP adjacency via an IPv6 LDP message...

CVE-2026-19673: Out-of-bounds Read

ethernetrecv in subsys/net/l2/ethernet/ethernet.c validates only that the first netbuf of a received frame holds a plain 14-byte struct netethhdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct netethvlanhdr without...

CVE-2026-103946: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus...

PT-2026-113731

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description When built with GnuTLS, a malicious WebSocket server can cause curl to send memory beyond its send buffer. This occurs because of an out-of-bounds read that happens when the gnutls record send...

PT-2026-114048

Name of the Vulnerable Software and Affected Versions LibreCAD versions prior to 2.2.1.5 libdxfrw versions prior to LC2.2.0 Description A stack-based out-of-bounds read occurs in the dwgReader18::readFileHeader function when strlen is called on buffers that are not NUL-terminated. An attacker can...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130120)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130120 advisory. rsync before 3.5.0contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing...

Linux Distros Unpatched Vulnerability : CVE-2026-109677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerability in smartcardLocateCardsByATRACall because the ATR pattern cbAtr byte count i...