CVE-2026-63267: Server-Side Request Forgery (SSRF)

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...

CVE-2026-28648: Undefined Security Weakness

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55286: Improper Restriction of Operations within the Bounds of a Memory Buffer

In stpropnciprocess of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-20533: Integer Overflow or Wraparound

In display, there is a possible escalation of privilege due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11296678; Issue ID: MSV-9167...

CVE-2026-63268: Exposure of Sensitive Information to an Unauthorized Actor

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

CVE-2026-55270: Unintended Proxy or Intermediary

In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-104693

Name of the Vulnerable Software and Affected Versions Display affected versions not specified Description An integer overflow in display allows for a local escalation of privilege. This occurs if a malicious actor has already obtained System privilege. Exploitation does not require user...

PT-2026-104744

A weakness has been identified in vgmstream up to r2117. This impacts the function make group random of the file src/meta/txtp process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name:...

PT-2026-106157

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An incorrect bounds check in multiple locations allows for a possible out of bounds write, which is a condition where data is written outside the intended memory...

CVE-2026-58815: Improper Restriction of Operations within the Bounds of a Memory Buffer

In multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-104707

Name of the Vulnerable Software and Affected Versions mtee affected versions not specified Description A type confusion issue exists in mtee, which may allow a local escalation of privilege. This occurs if a malicious actor has already obtained System privilege. Exploitation does not require user...

CVE-2026-20532: Double Free

In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249024; Issue ID: MSV-9168...

PT-2026-104703

In Modem, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01645293; Issue ID: MSV-6761...

PT-2026-104705

Name of the Vulnerable Software and Affected Versions vdec affected versions not specified Description A type confusion issue in vdec allows for an out-of-bounds write, which occurs when a program writes data past the end of a buffer. This can lead to local escalation of privilege if a malicious...

CVE-2026-20579: Out-of-bounds Write

In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9800...

CVE-2026-20537: Use After Free

In aidl, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11185225; Issue ID: MSV-9024...

PT-2026-106173

Name of the Vulnerable Software and Affected Versions sssd affected versions not specified Description A flaw allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the...

CVE-2026-105683: Path Traversal: '.../...//'

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0...

CVE-2026-20588: Out-of-bounds Write

In mtee, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9607...

CVE-2026-58856: Improper Restriction of Operations within the Bounds of a Memory Buffer

In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...