CVE-2026-112005: Improper Limitation of a Pathname to a Restricted Directory

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use readtext, readblob, COPY ... ...

PT-2026-116862

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the BPF sock ops. When a sockops program reads the rtt min variable during the tcp conn request path, the system fails to verify the socket type...

PT-2026-116906

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the thunderbolt driver where the tb xdp properties request function allocates a 252-byte response buffer intended for 45 data dwords. A malicious peer can manipulate t...

PT-2026-117062

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfs read gaps function where gaps around a streaming write's dirty region remain unread on the server side. If a short or EOF End Of File response occurs, stale...

PT-2026-128435

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in read unconf index list read unconf index list counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hci dev list lock stabilizes list...

PT-2026-128624

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp dev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to dev get by name...

PT-2026-116821

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Multiple out-of-bounds reads exist in the Bluetooth BNEP frame processing. In the functions bnep rx frame and bnep ctrl frame, the system fails to properly verify the existence of the BN...

MLflow 3.17.1 and Prior StartTrace Path Traversal

MLflow version 3.17.1 and prior versions using the FileStore tracking backend contain a path traversal vulnerability in the StartTraceV3 API. The proof of concept submits a traversal trace ID and demonstrates trace files written outside the intended trace directory...

PT-2026-128615

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sock: validate event length before filtering is filtered packet reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command...

PT-2026-128507

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6 ATTR DST In seg6 genl policy, SEG6 ATTR DST is defined with .type = NLA BINARY and .len = sizeofstruct in6 addr. For NLA BINARY, .len only enforces the maximum payload length and...

PT-2026-116943

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the host controls the length of a Scatter Gather List SGL segment. When a nonzero length is provided that is smaller than one SGL descriptor, the nr descs variable...

PT-2026-116639

wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past...

CVE-2026-98582: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

CVE-2026-98623: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

CVE-2026-98457: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

PT-2026-128439

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bnep rx frame and bnep ctrl frame net/bluetooth/bnep/core.c, use ps...

PT-2026-116643

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3 Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA...

CVE-2026-112058: Out-of-bounds Read

VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in setPTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with titl...

PT-2026-128471

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste selection In paste selection, the loop copies min tunsigned int, vc sel.buf len - pasted,tty-receive room bytes per iteration into tty ldisc receive buf a...

Linux Distros Unpatched Vulnerability : CVE-2026-98711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for...