CVE-2026-63635: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid colormode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled...

DEBIAN-CVE-2026-93090

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Clean up channels on setup failure scmichannelssetup can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing...

AZL-102260 CVE-2026-93090 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Clean up channels on setup failure scmichannelssetup can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing...

CVE-2026-90255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

AZL-102869 CVE-2026-90255 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

DEBIAN-CVE-2026-90255

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

CVE-2026-93093

CVE-2026-93093 affects the Linux kernel's firmware/arm_scmi driver. The root cause is an ordering flaw: transport setup routines (mailbox_chan_setup() and smc_chan_setup()) can enable interrupt delivery or register callbacks before the SCMI channel state (the cinfo pointer and cinfo->handle) i...

CVE-2026-93090

CVE-2026-93090 affects the ARM SCMI (System Control and Management Interface) firmware driver in the Linux kernel . The root cause is a failure-handling defect in scmi_channels_setup(): if this function fails after the common BASE channel or earlier protocol channels have already been registered ...

EUVD-2026-82198

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Clean up channels on setup failure scmichannelssetup can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing...

CVE-2026-92952

vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omi...

CVE-2026-92962 vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js

vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its output array using prototype-walking index assignment lineslines.length = value rather than a prototype-bypassing...

CVE-2026-92962 vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js

vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its output array using prototype-walking index assignment lineslines.length = value rather than a prototype-bypassing...

CVE-2026-92962 vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js

vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its output array using prototype-walking index assignment lineslines.length = value rather than a prototype-bypassing...

CVE-2026-92962

vm2 is a JavaScript sandbox for running untrusted code. In versions up to and including 3.11.3 , the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its output array using prototype-walking index assignment (lines[lines.length] = value) instead of a prototype-bypassing Ref...

EUVD-2026-81603

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions = 3.10.0 and = 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handle...

CVE-2026-92954 vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions = 3.10.0 and = 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handle...

CVE-2026-92952

vm2 (Node.js sandboxing library) versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The fixed symbol lists in lib/setup-sandbox.js and lib/bridge.js omit nodejs.stream.disturbed and nodejs.stream.errored , exposed on host WebStream ...

CVE-2026-92860

A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. Th...

CVE-2026-92860

CVE-2026-92860 affects rcourtman Pulse versions up to 6.0.4/6.1.0-rc.4 . The vulnerability resides in the Quick Security Setup Handler component, specifically the fmt.Sprintf function within /api/security/quick-setup. Manipulating the Username argument triggers improper input validation , enablin...

CVE-2026-92860 rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation

A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. Th...