CVE-2026-113193

Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113098

Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-113341

Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-113341

Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-113341

Google Chrome on Android is vulnerable to a memory corruption issue in the Skia component in versions prior to 156.0.8078.47 . A remote attacker could exploit this by using a crafted HTML page to potentially read memory inside the sandbox . The Chromium security severity for this flaw is rated as...

CVE-2026-113341

Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: Critical...

kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

A flaw was found in the Linux kernel's Server Message Block SMB client. The coalescet2 function processes server-supplied DataOffset fields without proper validation against buffer boundaries. A remote attacker could exploit this by crafting malicious SMB responses. This could lead to out-of-boun...

kernel: xfrm: espintcp: do not reuse an in-progress partial send

A flaw was found in the Linux kernel. The espintcp component, responsible for handling encrypted network traffic, incorrectly reuses a partial data transmission state. This can lead to an out-of-bounds read, which may allow an attacker to access sensitive information or cause other memory...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

GHSA-PCHR-8J38-3X4P Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 ColorMap with 768 SHORT values:...

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 ColorMap with 768 SHORT values:...

EUVD-2026-104658

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read...

GHSA-462X-PGG6-55FP Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Summary Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using reallocstate-buffer, TIFFTileSizetiff. After each TIFFReadTile it then iterates tiley from 0 up to currenttilelength and calls the configured row unpacker here copy4 with the source...

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Summary Pillow's libImaging decodeTile decoder, used to decode tiled TIFF images, allocates a per-tile buffer using reallocstate-buffer, TIFFTileSizetiff. After each TIFFReadTile it then iterates tiley from 0 up to currenttilelength and calls the configured row unpacker here copy4 with the source...

EUVD-2026-104606

Pillow tiled-TIFF decoder reads past tile buffer in copy4 Unpack.c:1290...

GHSA-C6HW-5GRF-FF96 Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

============================================================================ OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels Location: src/libImaging/TiffDecode.c:483 in decodeTile Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

============================================================================ OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels Location: src/libImaging/TiffDecode.c:483 in decodeTile Commit: a707c6b21c313880d0771e54965d142dd42358b6...

EUVD-2016-10921

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd,...

CVE-2016-20104 EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd,...

CVE-2016-20104

The EyeLock nano NXT (versions 3.05.1193 , 3.04.1108 , 3.03.944 , and 3.01.646 ) is vulnerable to a path traversal vulnerability. An unauthenticated attacker can read arbitrary local system files by sending GET requests to /scripts/logdownload.php using the 'path' parameter with traversal sequenc...