CVE-2026-111148: Out-of-bounds Read

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs reads...

ALSA-2026:83525 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

PT-2026-115066

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie init file in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num pages field as the loop bound for byte-swapping page sizes entries. A crafted file can make the loo...

CVE-2026-111230: External Control of File Name or Path

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

PT-2026-115154

Name of the Vulnerable Software and Affected Versions libsidplayfp versions prior to 3.1.2 Description A heap out-of-bounds read occurs when the software processes a PSID/RSID file with an unchecked data offset. An attacker can set the header data offset beyond the file size, causing the length...

UBUNTU-CVE-2026-109782

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5...

PT-2026-114969

A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption...

CVE-2026-105032: Unrestricted Upload of File with Dangerous Type

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper...

Linux Distros Unpatched Vulnerability : CVE-2026-110830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.0 fails to close prior serial handles in serialprocessirpcreate, allowing a malicious RDP server to exhaust file descriptors. Attackers can...

PT-2026-114976

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

UBUNTU-CVE-2026-92877

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...

PT-2026-115024

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

UBUNTU-CVE-2026-110777

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

UBUNTU-CVE-2026-109763

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

UBUNTU-CVE-2026-109741

Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Cisco Secure Email Gateway Advanced Malware Protection Privilege Escalation

The vulnerability of the Advanced Malware Protection module of the Cisco Secure Email Gateway protection tool is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain write access to arbitrary files and execute...

Linux Distros Unpatched Vulnerability : CVE-2026-107814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages...

Linux Distros Unpatched Vulnerability : CVE-2026-90954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and...

Improper exception handling vulnerability in QNAP File Station 5

Versions 5.5.x prior to QNAP File Station 5 5.5.6.5243 contain an improper exception handling vulnerability. This vulnerability stems from a null pointer dereference issue; remote attackers can exploit it after gaining access to user accounts to carry out denial-of-service attacks...

Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2026-130398)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130398 advisory. A NULL pointer dereference in the getminbuffersize function /libswscale/slice.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via...