PT-2026-90441

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32 rx done appends each received CEC byte to rx msg.msg using rx msg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without...

PT-2026-90349

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce t2 coalesce t2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data area of tgt = char...

PT-2026-90187

In the Linux kernel, the following vulnerability has been resolved: power: supply: cros usbpd-charger: bound the EC-reported port count cros usbpd charger probe reads two port counts from the EC and uses one of them, num charger ports, as the loop bound when populating a fixed-size array: struct...

PT-2026-90394

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsd direct write nfsd direct write walks a list of write segments and, after each vfs iocb iter write, tries to detect a short write so the loop can stop before placing the next segment at a...

PT-2026-90446

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in altera cvp send block dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...

PT-2026-90203

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb tx error a packet we are about to drop queue userspace packet borrows the packet skb -- it only copies it into a private netlink message user skb and does not own it; on return do execute actions keeps...

CVE-2026-89652: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname, rinfo-dname, rinfo-dnamelen and then writes namerinfo-dnamelen = 0,...

PT-2026-90445

In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensor hub get feature sensor hub get feature clamps its return value to the caller's buffer size, but the copy loop still copies field-report size / 8 bytes for each report value. A...

CVE-2026-78547: Out-of-bounds Write

Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2603.11 Current Release CR, before 2507.1 LTSR CU3, and before LTSR 2607...

CVE-2026-89622: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

ROS-20260911-73-0073

The vulnerability in Chromium is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-88051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independe...

PT-2026-90275

In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in nd label validate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. nd label validate bounds it against the config area size, but sizeof namespa...

Palo Alto Networks PAN-OS 10.0.x / 10.2.x / 11.0.x / 8.1.x / 9.0.x / 9.1.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 8.1.x, 9.0.x, 9.1.x, 10.0.x, 10.2.x, or 11.0.x. It is, therefore, affected by a vulnerability. A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a malicious...

Oracle Linux 10 : glibc (ELSA-2026-500297)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500297 advisory. - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing RHEL-180652, RHEL-185612 - CVE-2026-5928: Fix ungetwc operating on byte stream...

PT-2026-89878

CVE-2026-82583 CVSS 8.3 impacts Mirth Connect 4.7.1 and earlier. Authenticated users can execute arbitrary SQL via Database Connector, risking stored credential disclosure. Update if deployed. via NVD Recent High CVSS CyberSecurity InfoSec Vulnerability https://t.co/xBS3E6mUo3...

CVE-2026-86087

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system...

CVE-2026-81551

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability...

DEBIAN-CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...