PT-2026-94876

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cxlctl set feature function where the output buffer size is determined by the user-provided fwctl rpc.out len without verifying if it is large enough to accommodat...

PT-2026-94877

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds write exists in the cxlctl get feature function. The issue occurs because the output buffer is sized based on the fwctl rpc.out len value provided by the user, while...

PT-2026-94940

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the check ptr to btf access function allows btf struct access callbacks to validate write operations before the default...

PT-2026-94765

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/cxgb4 component where the write tpt entry function fails to properly manage the preallocated skb socket buffer during fatal error states or allocation failure...

PT-2026-94803

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the RDMA bnxt re component, the bnxt re mmap function rejects VM WRITE flags for DBR PAGE and TOGGLE PAGE memory mappings. However, a read-only mapping may still retain the VM MAYWRIT...

PT-2026-94851

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write occurs in the help init function when building the letter offsets array. The function uses the first byte of each function name as an index via the calculation sta...

PT-2026-94747

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stride mismatch exists in the ath12k wmi mac phy caps parse function. The kzalloc function sizes the mac phy caps buffer using a clamped length, but the subsequent memcpy operation...

PT-2026-94848

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Multiple issues occur in the ipoctal component when a device is removed while a tty session remains active. These include a Use-After-Free UAF of struct ipoctal because the remove callba...

SUSE CVE-2026-18938

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to...

EUVD-2026-44650

Grav: XSS Blueprint Validation Bypass via Twig String Concatenation...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the parsing process of text models due to insufficient validation of child and split array values. An attacker can achieve arbitrary memory writes by supplying a specially crafted model file with invalid node...

CVE-2026-92816

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-92800

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

CVE-2026-92787

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write...

CVE-2026-92786

LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen...

CVE-2026-92748

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...

CVE-2026-76432

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

CVE-2026-20282

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafte...

EUVD-2026-81074

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

EUVD-2026-81060

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...