PT-2026-125105

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

PT-2026-125100

A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure...

PT-2026-125077

A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN 0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this...

PT-2026-123163

A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver...

PT-2026-123157

A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The...

PT-2026-125481

Name of the Vulnerable Software and Affected Versions libdwarf versions prior to 2.3.4 Description A heap out-of-bounds read occurs in the dwarf debug addr table function when the table starting offset is omitted during the validation of the .debug addr unit length. An attacker can provide a...

PT-2026-125484

Name of the Vulnerable Software and Affected Versions libpff versions prior to 20260927 Description An off-by-one bounds check in the libpff table read 6c record entries function allows for a heap out-of-bounds read. This occurs when the software processes specially crafted 6c table record entrie...

PT-2026-125477

Name of the Vulnerable Software and Affected Versions libfvde versions prior to 20260924 Description A heap out-of-bounds read occurs in the libfvde encrypted metadata read type 0x0024 function because the xml plist data size variable is not validated against the source metadata block. An attacke...

PT-2026-125478

Name of the Vulnerable Software and Affected Versions libfvde versions prior to 20260923 Description A heap out-of-bounds read occurs in the libfvde encrypted metadata read type 0x001a function due to an unbounded strlen operation on embedded XML plist data. An attacker can trigger this by...

CVE-2026-115754

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped /script. Attackers controlling a function's source via a spoofed toString can combine...

CVE-2026-99007

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdevprobe fails, not just on -EAGAIN drmfbhelperinitialconfigandunlock calls drmclientmodesetprobe first, which already fills in each modeset-mode/numconnectors for every connected output, and onl...

UBUNTU-CVE-2026-99036

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same device...

PT-2026-125487

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line,...

UBUNTU-CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes plyreadlistproperty call an out-of-bounds handler, crashing ASCII parsing or...

UBUNTU-CVE-2026-99018

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

PT-2026-125475

Name of the Vulnerable Software and Affected Versions gbsplay versions 0.0.1 through 0.0.103 Description A heap out-of-bounds read occurs in the gbr open function within gbs.c because the software fails to verify the file length before scanning the GBR ROM title field. An attacker can provide a...

CVE-2026-116124

A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function oleinforeadmetabat of the file gsf/gsf-infile-msole.c of the component OLE2 Parser. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The...

CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes plyreadlistproperty call an out-of-bounds handler, crashing ASCII parsing or...

PT-2026-125381

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268 B20221104. This affects the function setCloudUpgradeFW of the file lib/cste modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely...

UBUNTU-CVE-2026-99058

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-currentpwq is populated only...