CVE-2026-113672

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory...

Security update for busybox

This update for busybox fixes the following issues: CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message bsc1282575. CVE-2026-88831: httpd silently fails open when IP deny...

SUSE-SU-2026:4773-1 Security update for busybox

This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message bsc1282575. - CVE-2026-88831: httpd silently fails open when IP...

CVE-2026-89855

A flaw was found in the Linux kernel's scsi: qla2xxx component. A local attacker could exploit a race condition in the flash version read handler. By concurrently triggering a sysfs reset operation and other flash operations, an attacker could corrupt flash register reads. This could lead to data...

CVE-2026-105772 Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId

Path Traversal CWE-22 in FileArtifactService in Google ADK TypeScript @google/adk versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files when an agent tool invokes saveArtifact outside the intended artifact storage...

CVE-2026-105772

A Path Traversal (CWE-22) vulnerability exists in the FileArtifactService of Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 . A remote unauthenticated attacker can use crafted relative or percent-encoded path traversal sequences (e.g., ../ or ..%2F) in the userId or sessionId par...

CVE-2026-105772 Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId

Path Traversal CWE-22 in FileArtifactService in Google ADK TypeScript @google/adk versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files when an agent tool invokes saveArtifact outside the intended artifact storage...

CVE-2026-105772 Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId

Path Traversal CWE-22 in FileArtifactService in Google ADK TypeScript @google/adk versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files when an agent tool invokes saveArtifact outside the intended artifact storage...

CVE-2026-93234

A flaw was found in the Linux kernel's Generic USB Display GUD driver. When reading television mode names from an attached device, the driver does not verify that the returned data contains a terminating null byte within its fixed-size buffer. A local attacker could attach a crafted device to cau...

CVE-2026-93213

A flaw was found in the Linux kernel. An out-of-bounds read vulnerability exists in the ofaliasscan function's stem parser. This issue occurs because the parser checks for a digit before verifying if it's within the valid memory bounds, potentially allowing it to read one byte before the intended...

CVE-2026-98602

A flaw was found in the Linux kernel's Bluetooth Network Encapsulation Protocol BNEP implementation. Insufficient length validation when processing network frames allows out-of-bounds memory read operations. An attacker can exploit this vulnerability by transmitting malformed or truncated network...

CVE-2026-98499

A flaw was found in the Linux kernel's Wacom Human Interface Device HID driver. When processing a device report descriptor with mismatched usage and count configurations, the driver can calculate an invalid memory offset and perform an out-of-bounds read beyond the allocated report buffer. A loca...

CVE-2026-98495

A flaw was found in the Linux kernel. A local user can trigger a Denial of Service DoS or potentially expose sensitive memory due to an out-of-bounds read flaw in the Address Resolution Protocol ARP networking interface. By supplying a network device request containing a device name that lacks...

CLSA-2026-1792515944 Fix CVE(s): CVE-2026-14673, CVE-2026-19385

SECURITY UPDATE: Out-of-bounds read in pgdump on long protrftypes. dumpFunc parsed pgproc.protrftypes into a fixed FUNCMAXARGS array that is not zero-terminated when the server reports exactly FUNCMAXARGS entries, so the TRANSFORM loop read past the buffer; a function with more entries made pgdum...

CLSA-2026-1792490933 hplip: Fix of 7 CVEs

CVE-2026-91097: bound LEDM HTTP response copies in httpread of the SANE hpaio backend stack buffer overflow backport of HPLIP 3.26.6 and RHEL c9s - CVE-2026-91098: bound device-supplied data in the LEDM scan backend resolution lists, job Location header, BinaryURL and chunk size parsing...

Buffer Under-read

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Buffer Under-read in the AJP process. An attacker can cause the response body to be split between requests, potentially leading to failure of subsequent requests...

Buffer Under-read

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Buffer Under-read in the AJP process. An attacker can cause the response body to be split between requests, potentially leading to...

CVE-2026-94202

The Module Manager's block-pool create dispatcher proved that two ALIGNTYPE words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words is read by the dispatcher's own buffer...

CVE-2026-95109

The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating one address — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and...

CVE-2026-92843

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...