CVE-2026-88358

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...

CVE-2026-88358

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...

EUVD-2026-86284

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...

PT-2026-98067

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvme component where FDP Flexible Data Placement configuration descriptor sizes are not properly validated. When walking the FDP configurations log, a dsze value o...

PT-2026-97717

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.26 Description The plugin fails to verify ownership or authorization before returning a campaign's stored configuration and run log. This allows users with contributor-level access and above to...

CVE-2026-26054: Out-of-bounds Read

SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MO...

CVE-2026-97433

In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor sizes Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer...

PT-2026-98194

Name of the Vulnerable Software and Affected Versions DBHub versions prior to 0.22.5 Description DBHub exposes an unauthenticated HTTP MCP endpoint when started in HTTP transport mode. The server attempts to prevent browser-origin access by verifying that the Origin hostname matches the Host...

CVE-2026-97059: Out-of-bounds Read

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97428

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

PT-2026-104990

In the Linux kernel, the following vulnerability has been resolved: coresight: perf: Retrieve path and source from event data ETM perf callbacks currently use the per-CPU csdev src pointer, which can race with updates during device registration and unregistration. The AUX setup already builds and...

CVE-2026-88358

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...

CVE-2026-88358

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument to access buflen after the input buffer has been...

PT-2026-98286

Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description The function php openssl matches wildcard name in ext/openssl/xp ssl.c contains an integer underflow in the length argument passed to memchr. This occurs when a TLS server certificate uses a...

CVE-2026-88358

The simdjson library version 4.6.1 is susceptible to a one-byte out-of-bounds read vulnerability within the dom::parser::parse_unpadded() function. A specially crafted truncated JSON document, where the final structural token closes a nested array or object, can cause json_iterator::walk_document...

CVE-2026-61788: Incomplete List of Disallowed Inputs

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting readonly = true on the executesql tool does not make the connection read-only. The connectors are written to set PostgreSQL defaulttransactionreadonly=on and open SQLite in...

PT-2026-98291

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An out-of-bounds read occurs in the HTTP stream wrapper when following a redirect where the response contains a Location header with an empty value. The redirect...

CVE-2026-18870: Out-of-bounds Read

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...

PT-2026-97829

Name of the Vulnerable Software and Affected Versions Altera Trusted Firmware on HPS versions prior to socfpga v2.14.0 Description An out-of-bounds read issue exists where unvalidated SiP v2 mailbox pointers allow non-secure EL1 access to arbitrary physical addresses through EL3. This can lead to...

PT-2026-97820

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...