SUSE CVE-2026-93280

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...

SUSE CVE-2026-93281

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen = 11 before...

SUSE CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

SUSE CVE-2026-93803

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipwrx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

SUSE CVE-2026-93805

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...

SUSE CVE-2026-93807

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers rsihalloadkey copies txmickey and rxmickey from data16 and data24 whenever key data is present. Those offsets are only part of the 32-byte TKIP key layout. Shorter keys...

SUSE CVE-2026-97059

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

SUSE CVE-2026-97428

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

SUSE CVE-2026-97433

In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor sizes Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer...

SUSE CVE-2026-97437

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfsdiremit and hdrfinde The bounds check in ntfsdiremit compares fname-namelen a character count against e-size a byte count without accounting for the 2-byte-per-character UTF-16LE encoding or t...

[SECURITY] [DLA 4794-1] redis security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4794-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb September 24, 2026 https://wiki.debian.org/LTS -...

com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect

A flaw was found in zstd-jni. Attackers can exploit this by supplying oversized per-sample lengths to the Zstd.trainFromBufferDirect function, which fails to validate the samples buffer capacity. This allows for reading past buffer boundaries, leading to out-of-bounds memory access and ultimately...

zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read

A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parse...

com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress

A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading t...

com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service

A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the ZstdDictCompress constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of...

CVE-2026-48072

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated...

WordPress SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin SSL Zen versions = 4.7.42...

CVE-2026-93543

A flaw was found in libXi. An out-of-bounds read vulnerability in the X Input 2 XI2 class parser allows a malicious X server to cause a Denial of Service DoS by crashing connected client applications. When an application receives and processes specially crafted input from the server, insufficient...

CVE-2026-48072 Docmost: Public image fileName path traversal leads to unauthorized local file read

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated...

CVE-2026-48072

Docmost , an open-source collaborative wiki and documentation software, is vulnerable to a path traversal flaw in versions prior to 0.80.1 . The public avatar and logo image endpoints fail to confine file path segments to the intended directory, allowing an unauthenticated attacker to traverse ou...