Huawei HarmonyOS out-of-bounds read vulnerability

Huawei HarmonyOS is a distributed operating system developed independently by Huawei, designed for various scenarios. Huawei HarmonyOS has a out-of-bounds read vulnerability. This vulnerability stems from an issue with out-of-bounds reading in the graphics module. Attackers can exploit this...

CVE-2026-85569: Improper Privilege Management

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it...

ROS-20260916-73-0088

The vulnerability of the decodechoice function in the net/netfilter/nfconntrackh323asn1.c module of the netfilter kernel in the Linux operating system is related to reading data beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or...

ROS-20260916-73-0026

The vulnerability of the t7xxport EnumMsgHandler function in the Linux operating system is related to reading beyond the buffer boundaries. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information or cause service failures...

CVE-2026-76434: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the certificate import functionality of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read arbitrary files from the affected system. To exploit this vulnerability, the attacker must have valid administrative...

CVE-2026-76427: Improper Restriction of XML External Entity Reference

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controlled feed metadata with an XML parser that does not disable...

CVE-2026-82125: Authorization Bypass Through User-Controlled Key

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam...

RHEL 9 : gstreamer1-plugins-ugly-free (RHSA-2026:67882)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67882 advisory. GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is n...

Linux Distros Unpatched Vulnerability : CVE-2026-89846

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by...

Fedora 44 : php-pecl-mongodb2 (2026-358d3ccdfe)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-358d3ccdfe advisory. Version 2.1.9 - PHPC-2744 Fix out-of-bounds read when building BSON field path by @paulinevos & @GromNaN in 2081 CVE-2026-84968 Tenable has extracted the...

MiracleLinux 9 : rust-1.92.0-2.el9_8 (AXSA:2026-1853:10)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1853:10 advisory. libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server CVE-2026-53587 Tenable has extracted the preceding description...

Oracle Linux 10 : coreutils (ELSA-2026-67886)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67886 advisory. - uniq: fix CVE-2026-56391 RHEL-216794 - fix read overrun with -w Tenable has extracted the preceding description block directly from the Oracle Linu...

Linux Distros Unpatched Vulnerability : CVE-2026-90016

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD &&...

RHEL 9 : gstreamer1-plugins-ugly-free (RHSA-2026:67930)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67930 advisory. GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is n...

PT-2026-93391

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the NTFS3 file system. The functions ntfs reparse init and ntfs objid init parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles. Thes...

CVE-2026-92475: Out-of-bounds Read

A weakness has been identified in GPAC 26.08-DEV. This impacts the function waitforheaderandparse of the file src/utils/downloader.c. This manipulation of the argument Content-Range causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and...

CVE-2026-90018: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr rtwgetwpsattr walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte...

CVE-2026-92595: External Control of File Name or Path

Nodemailer npm package nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent using the documented legacy three-argument signature resolveContentdata,...

CVE-2026-89999: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacomintuospro2btirq wacomintuospro2btirq receives the wire report length in len but never consults it before parsing. After the report-id gate it unconditionally calls wacomintuospro2btpen a...

CVE-2026-89792: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config responses Validate IPC share configuration payload sizes before consuming variable-length fields. Bound veto list parsing and account for the separator byte when deriving the pat...