CVE-2026-15390: Out-of-bounds Write

Das U-Boot with CONFIGIPDEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit...

CVE-2026-96440: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95304): chromium -- security fixes

Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-98164: Always-Incorrect Control Flow Implementation

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces kvmgfniswritetracked checks only the supplied memslot, but page tracking is per-address-space and shadow pages are shared across all address spaces. With SMM, a GFN can...

Important: bubblewrap

Issue Overview: A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts...

Medium: ImageMagick

Issue Overview: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95331): chromium -- security fixes

Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Important: rclone

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

PT-2026-109354

io/channel-socket: do not treat a zero length write as an error...

PT-2026-102761

Name of the Vulnerable Software and Affected Versions NetX Duo TFTP server affected versions not specified Description The TFTP server fails to validate the upper bound of DATA datagram sizes, ignoring the protocol maximum of 4 + NX TFTP FILE TRANSFER MAX. This lack of validation leads to two...

PT-2026-102945

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description An issue exists in the SAML single sign-on session handling samld where untrusted data is deserialized. An attacker who has already obtained the ability to write files on the...

ROS-20260929-73-0044

The vulnerability of the ebtsnattg function in the net/bridge/netfilter/ebtsnat.c module, which implements networking functions in the Linux kernel, is related to the issue of data being written outside of the buffer. Exploiting this vulnerability could allow an attacker to compromise the...

Important: crash

Issue Overview: A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in...

PT-2026-102746

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95329): chromium -- security fixes

Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

Important: cjose

Issue Overview: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW, A256KW does not validate the length of the attacker-supplied...

PT-2026-102469

Name of the Vulnerable Software and Affected Versions dash affected versions not specified Description A flaw exists in the printf builtin where it reserves only four bytes before converting a Unicode u or U escape sequence. Because multi-byte tokens may require five or six bytes, a local user ca...

PT-2026-102796

Mounting an attacker-controlled NAND flash image lx nand flash open triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95322): chromium -- security fixes

Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

PT-2026-102512

Name of the Vulnerable Software and Affected Versions Google Merchant Center Feed gmfeed module for PrestaShop versions prior to 2.3.9 Description An unauthenticated arbitrary file write exists in the 'feed.php' endpoint. An attacker can send a crafted request to control the output file name, pat...