Linux Distros Unpatched Vulnerability : CVE-2026-111141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzipparserootdirectory in zzip/zip.c that allows attackers to read past the mapped centr...

Linux Distros Unpatched Vulnerability : CVE-2026-111143

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilovexbin in src/loaders/xbin.c that lacks bounds checks for compressed...

MiracleLinux 8 : OpenEXR-2.2.0-12.el8_10.3 (AXSA:2026-2069:07)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2069:07 advisory. OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files CVE-2026-59184 OpenEXR: OpenEXR: Heap out-of-bounds write via crafted tile...

Linux Distros Unpatched Vulnerability : CVE-2026-110758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace,...

Linux Distros Unpatched Vulnerability : CVE-2026-111125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed til...

Linux Distros Unpatched Vulnerability : CVE-2026-111148

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an...

Linux Distros Unpatched Vulnerability : CVE-2026-111274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse- zip.c due to an incorrect ZIP64 extra field length check...

Linux Distros Unpatched Vulnerability : CVE-2026-111272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-111147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedbrecordgetmultivalue that allows attackers to read past buffers via...

Amazon Linux 2023 : mariadb114, mariadb114-backup, mariadb114-client-utils (ALAS2023-2026-3235)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3235 advisory. A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131736)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-131736 advisory. In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in hdrdeletede Here is a BUG report from syzbot: BUG: KASAN...

CVE-2026-46471: Buffer Over-read

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...

UBUNTU-CVE-2026-111147

Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedbrecordgetmultivalue that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or...

Red Hat: CVE-2026-111376: freerdp: freerdp: Denial of Service via short clipboard response

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStreamNew that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTSSIZE request with a cbRequested of fewer...

UBUNTU-CVE-2026-111376

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStreamNew that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTSSIZE request with a cbRequested of fewer...

PT-2026-116142

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-111635: Improper Limitation of a Pathname to a Restricted Directory

Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension...

CVE-2026-111676: Authorization Bypass Through User-Controlled Key

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer...

CVE-2026-104769: Improper Limitation of a Pathname to a Restricted Directory

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

Linux Distros Unpatched Vulnerability : CVE-2026-111132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in pathgeometrystartelement that allows attackers to read past allocations via crafted...