PT-2026-99959

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution RCE. Authentication...

VulnCheck KEV: CVE-2026-86950

Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution...

Important: runfinch-finch

Issue Overview: A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

macOS 26.x < 26.7.1 (149228)

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.7.1. It is, therefore, affected by a vulnerability: - An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe...

RHEL 9 : tesseract (RHSA-2026:72280)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:72280 advisory. A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was...

Important: crash

Issue Overview: A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in...

Important: gdb

Issue Overview: A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in...

Input Leap Arbitrary File Write

Input Leap versions through 3.0.3 the final release and master, on Windows and macOS, allow a connected peer to write a file outside the configured drop-target directory...

CVE-2026-18414: Out-of-bounds Write

The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffersize field of struct adcsequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the limit and it must return an error if the...

PDF writing buffer overflow Code Execution

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat, Adobe Acrobat Reader, and Adobe Acrobat Reader 2024 is related to writing outside the buffer. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PDF writing buffer overflow Code Execution

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat, Adobe Acrobat Reader, and Adobe Acrobat Reader 2024 is related to writing outside the buffer. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PDF writing buffer overflow Code Execution

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat, Adobe Acrobat Reader, and Adobe Acrobat Reader 2024 is related to writing outside the buffer. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: fbcon: Set fbdisplayi-mode to NULL when the mode is released CVE-2025-40323 kernel: ext4: fix e4b bitmap inconsistency reports...

PT-2026-102337

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.7.1 iPadOS versions prior to 26.7.1 macOS Sequoia versions prior to 15.8.1 macOS Tahoe versions prior to 26.7.1 Description An out-of-bounds write issue exists in the Apple CoreGraphics framework, which is used for 2D...

ALSA-2026:72467 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: fbcon: Set fbdisplayi-mode to NULL when the mode is released CVE-2025-40323 kernel: ext4: fix e4b bitmap inconsistency reports...

CVE-2026-101202: Out-of-bounds Write

A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipulation can lead to out-of-bounds write. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure b...

About the security content of iOS 26.7.1 and iPadOS 26.7.1

About the security content of iOS 26.7.1 and iPadOS 26.7.1 This document describes the security content of iOS 26.7.1 and iPadOS 26.7.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...

About the security content of macOS Sequoia 15.8.1

About the security content of macOS Sequoia 15.8.1 This document describes the security content of macOS Sequoia 15.8.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

About the security content of macOS Tahoe 26.7.1

About the security content of macOS Tahoe 26.7.1 This document describes the security content of macOS Tahoe 26.7.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

PT-2026-99857

Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6201 Description An authenticated arbitrary file write issue exists during the HA Failover Config sync upload process, which can lead to remote code execution. Remote code execution is a type of attac...