CVE-2026-92477: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: debugfs: Reserve space for a string terminator ufssavederrwrite copies user input into a zero-initialized stack buffer and passes it to kstrtoint. A write that fills the entire buffer overwrites its only terminator...

CVE-2026-90231: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitio...

CVE-2026-90823: Stack-based Buffer Overflow

FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/authuserpass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that...

CVE-2026-25283: Stack-based Buffer Overflow

Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size...

CVE-2026-81546: Stack-based Buffer Overflow

The Affinity by Canva application before 3.3.0 September 2026 release did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based buffer overflow. A threat actor could craft a Affinity document that when opened by a user in Affinity could result in...

PT-2026-95163

Name of the Vulnerable Software and Affected Versions redis-parser versions prior to 3.0.1 Description A denial of service issue exists in the RESP Redis Serialization Protocol parser. Malicious Redis endpoints can crash the client process by sending crafted RESP byte streams containing repeated...

PT-2026-94764

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack out-of-bounds read exists in the RDMA/mlx5 cc params debugfs. The get param function reads a congestion parameter as a u32 but formats it using a signed %d into an 11-byte stack...

PT-2026-95187

Name of the Vulnerable Software and Affected Versions go-openapi/swag jsonutils versions prior to 0.27.1 Description A stack overflow issue exists in ordered JSON parsing and serialization caused by unbounded recursion without a depth limit. Remote unauthenticated attackers can exploit this by...

CVE-2026-81480: Stack-based Buffer Overflow

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

RHEL 10 : rrdtool (RHSA-2026:68702)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:68702 advisory. The round robin database RRD system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load...

PT-2026-94245

Name of the Vulnerable Software and Affected Versions FatPipe MPVPN version 10.1.2r60p100 FatPipe WARP version 10.1.2r60p100 FatPipe IPVPN version 10.1.2r60p100 Description A stack-based buffer overflow exists in the /usr/sbin/auth user pass function. An unauthenticated remote attacker with acces...

PT-2026-94305

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.8 Description NodeVM exposes the host util module to the sandbox as an unfiltered shallow copy in defaultBuiltinLoaderUtil, and the deprecated sys builtin is exposed through the generic builtin loader. When running o...

CVE-2026-90416: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

CVE-2026-93372: Stack-based Buffer Overflow

Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-93067: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: clamp the reported AUX read size to the request tcauxtransfer clamps an AUX read to the payload limit: sizet size = mintsizet, DPAUXMAXPAYLOADBYTES - 1, msg-size; After the transfer it replaces size with the...

CVE-2026-93190: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosectypec: Reject out-of-bounds PD cap count crostypecregisterpartnerpdos copies the partner PDOs from the EC TYPECSTATUS response into the fixed capsdesc.pdoPDOMAXOBJECTS array. memcpycapsdesc.pdo,...

CVE-2026-93164: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Move optimized uprobe from nop5 to nop10 Andrii reported an issue with optimized uprobes 1 that can clobber redzone area with call instruction storing return address on stack where user code may keep temporary data...

CVE-2026-90358: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

CVE-2026-92933: Exposure of Sensitive Information to an Unauthorized Actor

vm2 is a sandbox for running untrusted Node.js code. In versions = 22.9 this hands sandboxed code util.getCallSites, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and...

CVE-2026-92936: Generation of Error Message Containing Sensitive Information

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...