CVE-2026-106290: Use of Uninitialized Resource

Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

ROS-20261006-73-0315

The vulnerability in the drivers/pmdomain/imx/imx8m-blk-ctrl.c component of the Linux operating system is related to reading data from beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-98204: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...

PT-2026-106616

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatm send, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

PT-2026-106691

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpi dvfs recalc rate dvfs get idx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past...

PT-2026-106948

Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Low...

Security Advisory 0196

Security Advisory 0196 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-102164 CVSSv3.1 Base Score: 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSSv4.0 Base Score: 2.3...

PT-2026-107251

A heap-based buffer over-read in H5Z filter scaleoffset in src/H5Zscaleoffset.c in HDF5 through 2.2.0 lets an attacker cause a denial of service application crash with a crafted HDF5 file. When the stored minimum bits equal the full precision of the datatype, the decoder copies d nelmts size byte...

PT-2026-106741

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove all and /api/mount to read cached KV data with use...

ALSA-2026:76747 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command...

PT-2026-107137

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository...

PT-2026-106723

libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT ConvertTrack to read pas...

CVE-2026-98247: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

PT-2026-106710

Name of the Vulnerable Software and Affected Versions GNU Aspell versions prior to 0.60.8.3 Description An out-of-bounds read exists in the ReadOnlyDict::load function within readonly ws.cpp. The issue occurs when loading a binary .rws dictionary file, as the software uses offset fields from the...

Linux Distros Unpatched Vulnerability : CVE-2026-98190

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That...

Linux Distros Unpatched Vulnerability : CVE-2026-98241

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is...

SUSE SLED15 / SLES15 Security Update : python-msgpack (SUSE-SU-2026:4443-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4443-1 advisory. This update for python-msgpack fixes the following issue - CVE-2026-57585: Unpacker reuse after a caught error can lead...

Linux Distros Unpatched Vulnerability : CVE-2026-98170

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to...

Linux Distros Unpatched Vulnerability : CVE-2026-98287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, b...

Linux Distros Unpatched Vulnerability : CVE-2026-98187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: p54: require a full expif record in PDRINTERFACELIST The PDRINTERFACELIST loop only checks that the record start is within the entry before reading an...