Linux Distros Unpatched Vulnerability : CVE-2026-112056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by...

Linux Distros Unpatched Vulnerability : CVE-2026-112282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpiaccesspoint that allows attackers to crash applications by supplying a...

AlmaLinux 9 : webkit2gtk3 (ALSA-2026:84583)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84583 advisory. chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read CVE-2026-87596 chromium-browser: angle: ANGLE in Google...

PT-2026-117447

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that...

PT-2026-117428

libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to le...

PT-2026-117422

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process raw bmpcache in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy to read pas...

PT-2026-117618

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description Opening a specially crafted XCF file containing a malformed text-layer parasite can trigger a heap out-of-bounds read. This issue allows adjacent heap data to be disclosed into the layer text an...

RHEL 8 : kernel (RHSA-2026:84793)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84793 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: netfilter: nfnetlinkcthelper:...

PT-2026-129106

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved...

SUSE CVE-2026-98454

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2parsecontexts validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes...

SUSE CVE-2026-98457

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

SUSE CVE-2026-98461

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...

SUSE CVE-2026-98481

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which checksums le16tocpuframe-datalen bytes of frame-data. datalen is a...

SUSE CVE-2026-98486

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a coherent DMA buffer for MMIO read responses. The normal removal path...

SUSE CVE-2026-98495

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arpdev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to devgetbynamercu o...

SUSE CVE-2026-98499

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacomwacpenserialenforce The 'wacomwacpenserialenforce' function may calculate and pass an invalid offset to hidfieldextract, resulting in memory reads at incorrect addresses -- possibly beyond the end...

SUSE CVE-2026-98532

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

SUSE CVE-2026-98575

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

SUSE CVE-2026-98604

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

SUSE CVE-2026-98611

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...