CVE-2026-106219: External Control of File Name or Path

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...

ROS-20261006-73-0044

The vulnerability of the matchchar function in the Linux operating system’s kernel is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

ROS-20261006-73-0191

The vulnerability of the nlattrtosctp function in Linux operating systems is related to reading data beyond the permitted range of memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2026-106289

A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a deni...

PT-2026-106621

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtk hci wmt evt and read its op/flag fields without checking the event is...

PT-2026-106570

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 XFRM implementation where the functions xfrm6 local rxpmtu and xfrm6 local error dereference skb-sk assuming it always points to a full IPv6 socket. In certai...

PT-2026-106608

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enable verity hits the qgroup limit, rollback verity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole...

PT-2026-106522

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipw michael mic verify assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michael mic to read past the...

PT-2026-106723

libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT ConvertTrack to read pas...

PT-2026-106741

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove all and /api/mount to read cached KV data with use...

PT-2026-106701

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfs skb reset frag walk iptfs skb reset frag walk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

PT-2026-106678

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipw process probe response and the libipw network init call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and...

PT-2026-106515

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiex search oui in ie reads a pairwise-cipher PTK count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs,...

PT-2026-106499

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move smb2 ea to cifs In move smb2 ea to cifs, the while src size 0 loop condition is insufficient. It allows iteration to continue even if the remaining src size is too small to contain ...

PT-2026-106498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the smb3 enum snapshots function. When snapshot array size is smaller than GMT TOKEN SIZE, the function sets ret data len to the size of struct smb snapsh...

PT-2026-106517

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54 convert rev0 and p54 convert rev1 read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken...

PT-2026-106494

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only The BAR0 fallback read path was introduced as a workaround for SR-IOV VFs where the VRAM aperture is not available during early init. Restrict this workaround to only...

PT-2026-106297

A flaw was found in SSSD. A local attacker with access to the Name Service Switch NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the...

CVE-2026-106119: Improper Neutralization of Special Elements in Data Query Logic

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...

PT-2026-106496

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-total read for compound encrypted PDUs In receive encrypted standard, server-total read is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result, cifs handl...