CVE-2026-102761: Out-of-bounds Write

NetX Duo's WebSocket client resets the unmasking cursor to the first NXPACKET each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drive...

CVE-2026-96440: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...

CVE-2026-91012: Improper Limitation of a Pathname to a Restricted Directory

org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...

PT-2026-102796

Mounting an attacker-controlled NAND flash image lx nand flash open triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

PT-2026-102761

Name of the Vulnerable Software and Affected Versions NetX Duo TFTP server affected versions not specified Description The TFTP server fails to validate the upper bound of DATA datagram sizes, ignoring the protocol maximum of 4 + NX TFTP FILE TRANSFER MAX. This lack of validation leads to two...

PT-2026-102945

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description An issue exists in the SAML single sign-on session handling samld where untrusted data is deserialized. An attacker who has already obtained the ability to write files on the...

PT-2026-109102

Issue summary: A TLS server that calls SSL set SSL CTX to switch a connection to a different SSL CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was...

PT-2026-109087

Issue summary: A TLS server that calls SSL set SSL CTX to switch a connection to a different SSL CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was...

PT-2026-109067

Issue summary: A TLS server that calls SSL set SSL CTX to switch a connection to a different SSL CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was...

PT-2026-109052

Issue summary: A TLS server that calls SSL set SSL CTX to switch a connection to a different SSL CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was...

PT-2026-102653

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A TLS server may experience an out-of-bounds read and a fixed-value out-of-bounds write on the server heap when calling the SSL set SSL CTX function to switch a connection to a different SSL...

CVE-2026-102474: Out-of-bounds Write

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write o...

ROS-20260929-73-0044

The vulnerability of the ebtsnattg function in the net/bridge/netfilter/ebtsnat.c module, which implements networking functions in the Linux kernel, is related to the issue of data being written outside of the buffer. Exploiting this vulnerability could allow an attacker to compromise the...

ROS-20260929-73-0112

The vulnerability of the detectstreamformats function in the sound/firewire/dice/dice-extension.c module of the Linux kernel’s sound subsystem is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, an...

PT-2026-102461

Name of the Vulnerable Software and Affected Versions Apache Karaf affected versions not specified Description An issue exists in the org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties function, which supports the config MBean and config shell commands. The software deriv...

PT-2026-102831

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

CVE-2026-102730: Out-of-bounds Write

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

Medium: ImageMagick

Issue Overview: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This...

CVE-2026-71974: Out-of-bounds Write

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...

CVE-2026-74225: Out-of-bounds Write

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6parseoptions that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the...