V8 SuperIC Type Confusion

V8 contains a SuperIC receiver confusion issue. Included proof of concept and exploitation snippets demonstrate object address disclosure, fake objects, arbitrary memory access, and WebAssembly RWX memory access. https://packetstorm.news/download/235617...

PT-2026-114110

Name of the Vulnerable Software and Affected Versions OAID Tengine versions prior to 1.12.0 Description An out-of-bounds read can be triggered remotely within the tmfile Model Loader component. The issue exists in the get tm file model function located in the source file...

CVE-2026-75085: Out-of-bounds Read

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...

PT-2026-114107

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.9 OpenSIPS versions prior to 4.0.2 Description A remote attack can trigger an out-of-bounds read within the rtpproxy component. This issue occurs specifically in the rtpproxy offer and rtpproxy answer functions...

PT-2026-114101

CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI read node header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI stridx c to scan past disk node dat...

PT-2026-114235

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.18.0 Description FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens. This process allows distinct folders, such as team/docs and team-docs, to share a...

ROS-20261014-73-0222

The vulnerability in the kernel-lt is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-114095

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses...

CVE-2026-110774: Authorization Bypass Through User-Controlled Key

Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp...

PT-2026-114138

Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a basename plus millisecond-timestamp...

CVE-2026-110658: Out-of-bounds Read

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msgmultipartparse that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length...

PT-2026-114048

Name of the Vulnerable Software and Affected Versions LibreCAD versions prior to 2.2.1.5 libdxfrw versions prior to LC2.2.0 Description A stack-based out-of-bounds read occurs in the dwgReader18::readFileHeader function when strlen is called on buffers that are not NUL-terminated. An attacker can...

CVE-2026-110766: Improper Limitation of a Pathname to a Restricted Directory

Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars...

ROS-20261014-73-0160

The vulnerability in the kernel-lt is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-110715: Out-of-bounds Write

MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Apsortcmp and...

CVE-2026-98405

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

CVE-2026-110841: Authorization Bypass Through User-Controlled Key

n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent...

PT-2026-114384

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the parse posix sids function fails to validate the server-supplied out len against the actual length of the received iov iov len. If a server...

CVE-2026-109439: Missing Authentication for Critical Function

Lantronix XPress-DR and XPress-DR-I CoBos-family firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718...

CVE-2026-103946: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus...