CVE-2026-91786 Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size

A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...

CVE-2026-91786

A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon...

postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer

A flaw was found in PostGIS. This out-of-bounds read vulnerability allows a remote attacker to cause memory disclosure or a server crash. This occurs when a malformed FlatGeobuf buffer is supplied, as the FlatGeobuf property metadata decoder fails to verify that the string body is contained withi...

BIT-GITLAB-2026-85706 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to...

kernel: security/keys: fix missed RCU read section on lookup

A flaw was found in the Linux kernel's keyring code. The assocarrayfind function, used for looking up keys, was called without holding the necessary Read-Copy-Update RCU read lock. This oversight allows for a memory corruption vulnerability, particularly affecting persistent key handling, as the...

kernel: netfilter: require Ethernet MAC header before using eth_hdr()

A flaw was found in the Linux kernel's netfilter component. Certain netfilter modules, including ip6teui64 and xtmac, accessed Ethernet MAC header data without first verifying that an Ethernet device was associated with the network packet or that the MAC header was present and of sufficient lengt...

SUSE-SU-2026:23740-1 Security update for pcre2

This update for pcre2 fixes the following issues: - CVE-2026-86145: missing size checks in pcre2dfamatch code can lead to an out-of-bounds write bsc1279893. - CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback bsc1280054. - CVE-2026-89157: out-of-bounds write via large...

SUSE-SU-2026:23840-1 Security update for pcre2

This update for pcre2 fixes the following issues: - CVE-2026-86145: missing size checks in pcre2dfamatch code can lead to an out-of-bounds write bsc1279893. - CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback bsc1280054. - CVE-2026-89157: out-of-bounds write via large...

CVE-2026-91770 IceHRM before 36.0.0 Broken Access Control via Employee ID

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoint...

SUSE CVE-2026-80931

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

SUSE CVE-2026-80933

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

SUSE CVE-2026-89574

In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...

SUSE CVE-2026-89691

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

SUSE CVE-2026-90616

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories e.g., /var/cache, /var/dat...

Chromium CVE-2026-87650: Out of bounds read in WebGL

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87604: Out of bounds read in ANGLE

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87602: Out of bounds read in ANGLE

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87596: Out of bounds read in ANGLE

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87586: Out of bounds read in ANGLE

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87525: Out of bounds read in Chromoting

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...