PT-2026-96576

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

CVE-2026-89608: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfsparsepacketset receives a pointer into the file header, but it calculates the remaining packet buffer size from PAGESIZE - 8. For version 1 headers the packet set starts lat...

PT-2026-90467

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An off-by-one error exists in the port I/O handling of the x86 TDX implementation. The functions handle in and handle out in arch/x86/coco/tdx/tdx.c use an incorrect mask calculation via...

PT-2026-90547

Summary The Shopper Framework discount management functionality accepts negative discount values without server-side validation. It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the...

The vulnerability of the gf_opus_parse_packet_header() function in the media_tools/av_parsers.c file of the multimedia platform GPAC allows a hacker to cause a service failure.

The vulnerability of the gfopusparsepacketheader function in the mediatools/avparsers.c file of the multimedia platform GPAC is related to incorrect numerical calculations when processing values with a comma-separated format. Exploiting this vulnerability could allow an attacker to cause service...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107299)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107299 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Ensure index calculation will not overflow WHY & HOW Make sure vmid0p72idx,...

CVE-2026-89438: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

OSEC-2026-20 Cstruct indexing bugs can corrupt filtered output and reverse parsing results

Several functions in cstruct may use wrong data, leading to unexpected exceptions and return corrupted data. Impact - Cstruct.filtermap writes retained bytes at their original input positions, producing corrupted output when earlier bytes are dropped. - Cstruct.tail rev:true removes two bytes...

PT-2026-89718

Several functions in cstruct may use wrong data, leading to unexpected exceptions and return corrupted data. Impact - Cstruct.filter map writes retained bytes at their original input positions, producing corrupted output when earlier bytes are dropped. - Cstruct.tail rev:true removes two bytes...

CVE-2026-69598

Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network...

CVE-2026-86736

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requestscounter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...

Incorrect Calculation

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Calculation via the checkout request process. An attacker can manipulate the assets.requestscounter by repeatedly submitting duplicate checkout requests or calling...

CVE-2026-86736 snipe-it before 8.7.0 Checkout Request Counter Integrity Failure

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requestscounter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...

CVE-2026-86736 snipe-it before 8.7.0 Checkout Request Counter Integrity Failure

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requestscounter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...

CVE-2026-86736 snipe-it before 8.7.0 Checkout Request Counter Integrity Failure

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requestscounter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...

EUVD-2026-72872

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requestscounter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without...

CVE-2026-86736

snipe-it versions prior to 8.7.0 contain an incorrect calculation vulnerability in checkout request handling that affects the assets.requests_counter field. Authenticated users can corrupt this counter by repeatedly calling cancel endpoints without active requests (driving the counter negative) o...

Windows iSCSI Remote Code Execution Vulnerability

Incorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network...

kernel: dm-verity: fix buffer overflow in FEC calculation

A flaw was found in the dm-verity component of the Linux kernel. A buffer overflow occurs during Forward Error Correction FEC calculation, allowing an attacker to write past the end of an allocated buffer. This out-of-bounds write can corrupt the syndrome buffer, potentially leading to system...

PT-2026-87133

Name of the Vulnerable Software and Affected Versions snipe-it versions prior to 8.7.0 Description An incorrect calculation issue in checkout request handling allows authenticated users to corrupt the assets.requests counter. This occurs when users submit duplicate checkout requests or repeatedly...