PT-2026-120788

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0 Description The experimental tsmemcache plugin...

PT-2026-120494

In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled size, paddingSize, and dataOffset fields during DataDescriptor message deserialization. An unauthenticated remote attacker can send a crafted network payload that...

Linux Distros Unpatched Vulnerability : CVE-2026-113304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Browser in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-113329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-113322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Dawn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML pag...

PT-2026-120441

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an...

ROS-20261021-73-0025

The vulnerability in freerdp3 is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261021-73-0031

The vulnerability in freerdp3 is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261021-73-0067

The vulnerabilities of the updateprocessglyphfragments and glyphcachefragmentput functions in the libfreerdp/cache/glyph.c file of the RDP client FreeRDP are related to reading beyond the allowed range of memory. Exploiting these vulnerabilities could allow a remote attacker to cause service...

PT-2026-120717

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.6 Electron versions prior to 43.7.3 Electron versions prior to 44.4.3 Electron versions prior to 45.0.0-alpha.9 Description In the main process for macOS offscreen rendering, frame data received from the GPU...

PT-2026-120845

In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview data management pipeline capability or edit data management pipeline job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope. The vulnerability is possible...

PT-2026-120741

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...

Linux Distros Unpatched Vulnerability : CVE-2026-113137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HT...

Apache bRPC buffer error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a buffer error vulnerability. This vulnerability arises from an out-of-bounds read during URL parsing and case-insensitive header lookup on platforms where plain char is unsigned e.g., ARM64, potentially allowing remote attackers to cause process...

ROS-20261021-73-0015

The vulnerability in freerdp3 is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

Red Hat: CVE-2026-92824: libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an...

Red Hat: CVE-2026-114038: device-mapper-multipath: device-mapper-multipath: Information disclosure via malformed format string

A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure...