Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Ipados

CVE-2026-64788 — IOGPUFamily Use-After-Free Component: IO...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Ipados

CVE-2026-64788 — IOGPUFamily Use-After-Free Component: IO...

CVE-2026-80586

A flaw was found in the Linux kernel's Multipath TCP mptcp implementation. A remote attacker could send specially crafted Data Sink Selection DSS options with an unexpected size. This could lead to data inconsistency or the access of uninitialized data, potentially resulting in information...

CVE-2026-80543

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Pad trailing CCA or EP11 message with zeros The both functions xcrbmsgtotype6cprbmsgx and xcrbmsgtotype6ep11cprbmsgx copy the user space message into a kernel buffer based on the message length. But on further...

CVE-2026-80543

CVE-2026-80543 affects the Linux kernel on s390 architectures, specifically the s390/zcrypt subsystem. The vulnerable functions xcrb_msg_to_type6cprb_msgx() and xcrb_msg_to_type6_ep11cprb_msgx() copy a user-space message into a kernel buffer based on its length, but subsequent processing requires...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098785)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098785 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use the existing master conntrac...

Linux Distros Unpatched Vulnerability : CVE-2026-80543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Pad trailing CCA or EP11 message with zeros The both functions...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098931)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098931 advisory. In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record getsymlinkchunk and the SL handling i...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-099003)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099003 advisory. In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: restrict usage in unprivileged domU The Xen privcmd driver allows to issue arbitrary...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098937)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098937 advisory. In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with...

CVE-2026-64705

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or write kernel memory...

CVE-2026-64705

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or write kernel memory...

CVE-2026-64705

CVE-2026-64705 is a buffer overflow in the HFS (Hierarchical File System) component of macOS, addressed with improved bounds checking. An app may be able to cause unexpected system termination or write kernel memory . The vulnerability is rated CVSS 5.5 (MEDIUM) with a local attack vector and low...

CVE-2026-64705

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or write kernel memory...

CVE-2026-13215

The Zephyr ext2 filesystem driver fails to validate the slogblocksize field of the on-disk superblock when mounting a filesystem. ext2verifydisksuperblock in subsys/fs/ext2/ext2impl.c checks the magic number, revision, inode size and group counts, but never bounds slogblocksize. On a successful...

CVE-2026-13215 Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image

The Zephyr ext2 filesystem driver fails to validate the slogblocksize field of the on-disk superblock when mounting a filesystem. ext2verifydisksuperblock in subsys/fs/ext2/ext2impl.c checks the magic number, revision, inode size and group counts, but never bounds slogblocksize. On a successful...

CVE-2026-64705: Buffer Copy without Checking Size of Input

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or write kernel memory...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

CVE-2026-74641

A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...

CVE-2026-9728

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...