CVE-2026-0194

CVE-2026-0194 is a local privilege escalation vulnerability in the Trusted Execution Environment (TEE) of Google Pixel devices, caused by an integer overflow that permits a permission bypass . No additional execution privileges or user interaction are required for exploitation. The Pixel Update B...

CVE-2026-91962

A flaw was found in FreeRDP. An integer overflow in the audin Apple backends, specifically when processing FramesPerPacket values from MSGSNDINOPEN messages, allows a malicious RDP Remote Desktop Protocol server to supply crafted values. This can cause the AudioQueueAllocateBuffer size computatio...

CVE-2026-91960

A flaw was found in FreeRDP. A remote attacker, specifically a malicious RD Gateway peer, could send a crafted WebSocket Ping frame with an extended payload length. This action triggers an an integer overflow in the StreamEnsureRemainingCapacity function, leading to an integer wraparound and a...

CVE-2026-53941 Inspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.27.0 until 0.53.1, the uprobe library resolver can allow an unprivileged container to consume excessive CPU and block other containers from starting...

DEBIAN-CVE-2026-91962

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSGSNDINOPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer...

CVE-2026-91962

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSGSNDINOPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer...

DEBIAN-CVE-2026-91960

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

CVE-2026-91960

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

CVE-2026-91962 FreeRDP before 3.31.0 Integer Overflow via audin Apple backends

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSGSNDINOPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer...

CVE-2026-91962

FreeRDP before 3.31.0 is affected by an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. A malicious RDP server can supply crafted values that cause the AudioQueueAllocateBuffer size computation to wrap, resulting in an undersized b...

CVE-2026-91962

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSGSNDINOPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer...

EUVD-2026-78638

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSGSNDINOPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer...

CVE-2026-91960 FreeRDP before 3.31.0 Integer Overflow Double Free

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

EUVD-2026-78636

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer...

CVE-2026-91960

FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length, triggering integer wraparound that leads to a double free and crashes the FreeR...

Security Bulletin: Enterprise Content Managemant System Monitor for August 2026 - multiple CVEs

Summary Enterprise Content Management System Monitor is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details...

kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

A flaw was found in the Linux kernel's Fibre Channel FC transport component. An adjacent Fibre Channel fabric actor, such as a compromised switch or fabric controller, can send a specially crafted FPIN ELS Fabric Performance Incentive Notification Extended Link Service frame. This malformed frame...

CVE-2026-54992-PoC

CVE-2026-54992 PoC Microsoft Message Queuing のリモート読み取り整数オーバーフロー（CVE-2026-54992 として追跡）の概念実証。 この PoC は 2 台の Windows VM を使用します。脆弱なターゲット上の通常のユーザーが、ローカルの MSMQ サービスに対して、ヘルパーがホストするキューから読み取るよう要求します。ヘルパーが不正な形式の MS-MQRR 応答を返し、ターゲット上の mqsvc.exe がクラッシュします。この PoC はサービス拒否を実証します。コード実行は実証しません。 Root cause mqqm.dl...

kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32

A flaw was found in the Linux kernel's Fibre Channel FC transport component. An adjacent Fibre Channel fabric actor, such as a compromised switch or fabric controller, can send a specially crafted FPIN ELS Fabric Performance Incentive Notification Extended Link Service frame. This malformed frame...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...