CVE-2026-98456

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition in the readunconfindexlist function allows a local user to cause an out-of-bounds write during asynchronous controller setup. This issue occurs when device state flags change between response buffer sizing and data...

CVE-2026-70007

A flaw was found in .NET. An out-of-bounds write vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the target system over the network. By convincing a user to process specially crafted input, an attacker can trigger memory corruption and compromise the affected...

CVE-2026-10758

A flaw was found in LERC. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by submitting specially crafted image data to an application using the library. Processing the malicious input triggers an integer overflow that leads to an out-of-bounds memory...

OPENSUSE-SU-2026:22134-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: - Update to version 2.102.0, fixing four security issues GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, GHSA-wjmr-j3rp-mh2g: gh release/run/attestation download and repo read-file --output could write to an unintended...

CVE-2026-12660

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation...

CVE-2026-12660 IBM MQ Path Traversal

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation...

EUVD-2026-104466

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation...

CVE-2026-12660

The IBM MQ Web Console is vulnerable to a path traversal issue (CWE-22) caused by improper path validation . This flaw could allow an authenticated administrator to write files outside the intended directory. The CVSS 3.1 base score is 2.7 (Low) , with an integrity impact of low and no impact on ...

CVE-2026-111045

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

EUVD-2026-104412

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice

A flaw was found in xorg-x11-server. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request with an unvalidated modifier value. This lack of validation causes the server to perform an out-of-bounds write on the heap, resulting in memory corruption that...

xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling

A flaw was found in xorg-x11-server. In the X Keyboard Extension XKB, key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-bas...

xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes

A flaw was found in xorg-x11-server. In the Glamor 2D graphics acceleration module, a buffer allocation error occurs during color depth conversion when processing an image whose source dimensions exceed the destination dimensions. A local user can exploit this vulnerability to trigger an...

phpipam_1.4.4

CVE-2022-23046 phpIPAM 1.4.4 - SQL Injection phpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the subnet parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. This project currently prints out database information and host version...

xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling

A flaw was found in xorg-x11-server. In the X Keyboard Extension XKB, key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-bas...

xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice

A flaw was found in xorg-x11-server. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request with an unvalidated modifier value. This lack of validation causes the server to perform an out-of-bounds write on the heap, resulting in memory corruption that...

xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes

A flaw was found in xorg-x11-server. In the Glamor 2D graphics acceleration module, a buffer allocation error occurs during color depth conversion when processing an image whose source dimensions exceed the destination dimensions. A local user can exploit this vulnerability to trigger an...

CVE-2026-112275

Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder prloadimage in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past mdimage...

CVE-2026-112262

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posixfs sources and fs sinks. Attackers holding schema CREATE privilege can set posixfs.root or fs.path to any directory to read...

CVE-2026-112275

Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder prloadimage in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past mdimage...