CVE-2026-110774: Authorization Bypass Through User-Controlled Key

Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp...

CVE-2026-105107: Improper Neutralization of Special Elements used in an SQL Command

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-110598: Out-of-bounds Read

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

CVE-2026-110597: Out-of-bounds Read

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

CVE-2026-110618: Missing Authentication for Critical Function

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or...

CVE-2026-109439: Missing Authentication for Critical Function

Lantronix XPress-DR and XPress-DR-I CoBos-family firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718...

CVE-2026-106464: Out-of-bounds Read

nxsecurex509parsesignaturedata computes the certificate signature's length as tlvlength - 1 without first checking that tlvlength is non-zero. A certificate whose signature is an empty ASN.1 BIT STRING therefore parses successfully and leaves the certificate holding a signature length of 0xFFFFFF...

CVE-2026-19673: Out-of-bounds Read

ethernetrecv in subsys/net/l2/ethernet/ethernet.c validates only that the first netbuf of a received frame holds a plain 14-byte struct netethhdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct netethvlanhdr without...

CVE-2026-102980: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...

CVE-2024-58392: Out-of-bounds Read

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

CVE-2026-101946: Out-of-bounds Read

An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent low-privilege attacker to disclose limited rpd process memory and disrupt an LDP adjacency via an IPv6 LDP message...

CVE-2025-71433: Missing Authorization

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links,...

CVE-2026-103946: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus...

CVE-2026-0317: Improper Check for Unusual or Exceptional Conditions

A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service DoS condition by sending a specially crafted API request. The security risk posed by this issue is significantly minimized by...

CVE-2026-100236: Out-of-bounds Write

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...

PT-2026-114107

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.9 OpenSIPS versions prior to 4.0.2 Description A remote attack can trigger an out-of-bounds read within the rtpproxy component. This issue occurs specifically in the rtpproxy offer and rtpproxy answer functions...

CVE-2026-110606: Out-of-bounds Read

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

CVE-2026-110679: Out-of-bounds Read

A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxyoffer/rtpproxyanswer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resol...

ROS-20261014-73-0218

The vulnerability in the kernel-lt is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

AlmaLinux 10 : tftp (ALSA-2026:82280)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:82280 advisory. tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine CVE-2026-85234 Tenable has extracted the preceding description block directly...