CVE-2026-73638: Out-of-bounds Read

Imager versions from 0.4502 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiffloadifd. tiffloadifd validates an IFD entry's data by checking that entry-offset + entry-size stays within the EXIF block, and never checks the start offset itself. Where that sum is n...

CVE-2026-24081: Buffer Over-read

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled...

CVE-2026-93201: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate segid fields from persistent memory cacheposdecode, cachekeydecode and the last-kset branches of cachereplay, the writeback worker and the GC worker take a cache segment id from the cache device metadata and...

PT-2026-94559

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem on s390 architecture where a Read-Modify-Write RMW atomic operation on an arena pointer fails to clear the destination register during a fault over a...

CVE-2026-93061: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

PT-2026-94916

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the usb gadget configfs component. The function os desc qw sign show incorrectly uses OS STRING QW SIGN LEN as the input length for utf16s to utf8s. Becau...

PT-2026-94460

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The unified ROM parser in the qlcnic driver fails to properly validate directory, product, and data-descriptor fields within firmware files. The validation process uses unchecked additio...

PT-2026-94605

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the Bluetooth virtio bt component. The virtbt setup zephyr function sends a Zephyr vendor command 0xfc08 to read build information and processes the...

PT-2026-94662

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the remoteproc component due to the use of a signed offset in the rsc table for each entry function. The table-offseti value, provided as a u32 from...

CVE-2026-54546: Server-Side Request Forgery (SSRF)

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to 13.22.1, the authenticated PUT /api/basemap endpoint passes an attacker-controlled URL through importBasemapURL in api/routes/basemap.ts to fetchurl without resolved-address...

CVE-2026-90314: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...

CVE-2026-90982: Improper Handling of Case Sensitivity

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path...

CVE-2026-25282: Out-of-bounds Read

Transient DOS when processing unverified data from a neighboring system causes out of bound memory access...

PT-2026-94416

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An off-by-one error exists in the ASoC ALSA System on Chip DAPM Dynamic Audio Power Management component. The function snd soc dapm put enum double fails to properly validate the second...

CVE-2026-24075: Buffer Over-read

Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions...

PT-2026-94375

Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.27.3 Description Authenticated attackers can read arbitrary files by exploiting missing path validation. By providing absolute file paths in the file path parameter, users with valid access tokens can access any fil...

PT-2026-94374

Name of the Vulnerable Software and Affected Versions vgmstream versions prior to r2118 Description A weakness in the EA SCHl parser component allows for remote exploitation. The issue occurs within the vadpcm read coefs be function located in the src/coding/vadpcm decoder.c file. Manipulation of...

CVE-2026-90408: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix overreads in ath12kwmiprocesscsaswitchcountevent There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally...

CVE-2026-93013: Improper Limitation of a Pathname to a Restricted Directory

RAGFlow through 0.27.2 contains a path traversal vulnerability in the devinsertchunksfromfile and devinsertmetadatafromfile endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the filepath parameter. Attackers with valid access tokens can...

CVE-2026-52836: Out-of-bounds Read

OpenDDS is an open source C++ implementation of the Object Management Group OMG Data Distribution Service DDS. Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes...