CVE-2026-93213

A flaw was found in the Linux kernel. An out-of-bounds read vulnerability exists in the ofaliasscan function's stem parser. This issue occurs because the parser checks for a digit before verifying if it's within the valid memory bounds, potentially allowing it to read one byte before the intended...

CVE-2026-98602

A flaw was found in the Linux kernel's Bluetooth Network Encapsulation Protocol BNEP implementation. Insufficient length validation when processing network frames allows out-of-bounds memory read operations. An attacker can exploit this vulnerability by transmitting malformed or truncated network...

CVE-2026-98499

A flaw was found in the Linux kernel's Wacom Human Interface Device HID driver. When processing a device report descriptor with mismatched usage and count configurations, the driver can calculate an invalid memory offset and perform an out-of-bounds read beyond the allocated report buffer. A loca...

CVE-2026-98495

A flaw was found in the Linux kernel. A local user can trigger a Denial of Service DoS or potentially expose sensitive memory due to an out-of-bounds read flaw in the Address Resolution Protocol ARP networking interface. By supplying a network device request containing a device name that lacks...

CLSA-2026-1792515944 Fix CVE(s): CVE-2026-14673, CVE-2026-19385

SECURITY UPDATE: Out-of-bounds read in pgdump on long protrftypes. dumpFunc parsed pgproc.protrftypes into a fixed FUNCMAXARGS array that is not zero-terminated when the server reports exactly FUNCMAXARGS entries, so the TRANSFORM loop read past the buffer; a function with more entries made pgdum...

CLSA-2026-1792490933 hplip: Fix of 7 CVEs

CVE-2026-91097: bound LEDM HTTP response copies in httpread of the SANE hpaio backend stack buffer overflow backport of HPLIP 3.26.6 and RHEL c9s - CVE-2026-91098: bound device-supplied data in the LEDM scan backend resolution lists, job Location header, BinaryURL and chunk size parsing...

Buffer Under-read

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Buffer Under-read in the AJP process. An attacker can cause the response body to be split between requests, potentially leading to failure of subsequent requests...

Buffer Under-read

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Buffer Under-read in the AJP process. An attacker can cause the response body to be split between requests, potentially leading to...

CVE-2026-95109

The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating one address — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and...

CVE-2026-94202

The Module Manager's block-pool create dispatcher proved that two ALIGNTYPE words of the extra-parameter array a memory-protected module supplies lay inside the module's data, and then used indices 0 through 3 of that array. One of the two unproved words is read by the dispatcher's own buffer...

CVE-2026-92843

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

CVE-2026-92853

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to 0xFFFFFFFF, which makes the bounds check that follows...

CVE-2026-91057

gxmultilinetextviewdisplayinfoget reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return \r. The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in...

CVE-2026-113681

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

DEBIAN-CVE-2026-113681

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

CVE-2026-112950

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...

CVE-2026-112948

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-111764

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.getString taskId returns the...

NTPsec buffer error vulnerability

Versions NTPsec 1.1.4 through 1.2.5 contain a buffer error vulnerability. This vulnerability stems from an out-of-bounds read during the parsing of NTS extension fields. Remote attackers can exploit this by providing an NTS Authenticator and Encrypted Extension Fields AEEF field with an excessive...

NTPsec buffer error vulnerability

Versions prior to NTPsec 1.2.6 contain a buffer error vulnerability. This vulnerability stems from an out-of-bounds read in the Motorola Oncore refclock driver. Attackers can control the serial data of the GPS receiver; by sending PPS Control @@Gc responses containing pattern bytes outside their...