CVE-2026-106399: Out-of-bounds Read

Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. Chromium security severity: Low...

CVE-2026-98348: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

CVE-2026-98193: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipwmichaelmicverify assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michaelmic to read past the skb...

PT-2026-106499

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move smb2 ea to cifs In move smb2 ea to cifs, the while src size 0 loop condition is insufficient. It allows iteration to continue even if the remaining src size is too small to contain ...

PT-2026-106512

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211 mesh preq size ok derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header. ieee80211 mesh hwmp...

PT-2026-106576

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci codec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check include...

CVE-2026-98168: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

PT-2026-106515

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiex search oui in ie reads a pairwise-cipher PTK count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs,...

CVE-2026-106231: Use of Uninitialized Resource

Uninitialized resource in Dawn in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-106219: External Control of File Name or Path

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...

CVE-2026-106223: Use of Uninitialized Resource

Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106261: Use of Uninitialized Resource

Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106729

tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite string in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump rule to crash the forked in.tftpd request...

CVE-2026-98279: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enableverity hits the qgroup limit, rollbackverity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesyst...

CVE-2026-98186: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiexsearchouiinie reads a pairwise-cipher PTK count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs, comparing...

PT-2026-106497

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs query reparse point In cifs query reparse point, the start = end check before casting to struct reparse data buffer only ensures the start pointer is within the response. It fails to...

PT-2026-106692

In the Linux kernel, the following vulnerability has been resolved: firmware: arm scpi: reject DVFS OPP count above MAX DVFS OPPS scpi dvfs get info already rejected a zero opp count, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAX DVFS OPPS entrie...

ROS-20261006-73-0315

The vulnerability in the drivers/pmdomain/imx/imx8m-blk-ctrl.c component of the Linux operating system is related to reading data from beyond the allowed buffer size. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106678

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipw process probe response and the libipw network init call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and...

ROS-20261006-73-0046

The vulnerability of the verifydfa function in the Linux operating system’s kernel involves reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...