CVE-2026-103896: Improper Limitation of a Pathname to a Restricted Directory

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

CVE-2026-111728: Improper Neutralization of Argument Delimiters in a Command

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...

UBUNTU-CVE-2026-111380

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

PT-2026-115912

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a craft...

Important: mariadb123

Issue Overview: A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the allocated stack buffer. This flaw could lead to arbitrary code execution or cause the...

CVE-2026-105958: Out-of-bounds Write

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

Red Hat: CVE-2026-111382: freerdp: freerdp: Arbitrary code execution via crafted display frames

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

Red Hat: CVE-2026-110758: perl-text-csv_xs: Text::CSV_XS: Denial of Service via out-of-bounds write during whitespace stripping

Text::CSVXS versions before 1.65 for Perl read before the start of an all-blank field under allowwhitespace in striptrailwhitespace. Under allowwhitespace, striptrailwhitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of onl...

Ubuntu: (CVE-2026-111380): freerdp3 vulnerability

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

Red Hat: CVE-2026-105958: spice-server vulnerability

A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICEMSGCMIGRATEDATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via...

CVE-2026-111380

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

PT-2026-116026

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT USER administrators to perform write actions while impersonating the protected ROOT USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never...

Wazuh security monitoring and threat detection Platform Arbitrary File Access

The vulnerability of the uploadlistfile, uploadrulefile, and uploaddecoderfile functions of the Wazuh security monitoring and threat detection platform is related to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow a malicious actor to gain access t...

PT-2026-115628

Name of the Vulnerable Software and Affected Versions Seanime versions 3.7.0 through 3.10.3 Description Improper authorization allows unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard. By setting transcodeHwAccel to custom and providing attacker-controlled...

CVE-2026-111382

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

UBUNTU-CVE-2026-111154

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

PT-2026-125062

When decompression fails inside a legacy zstd v0.4 to v0.7 frame, the bundled zstd library reports the output buffer as fully written although nothing was written. DCtx::decompress stream committed that position even on error, and for a Vec destination this extended the vector's length over...

UBUNTU-CVE-2026-111157

SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsxmsadpcmblockexpandi in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit samp...

WNLTK WekaClassifier File Read Write

The vulnerability of the WekaClassifier module in the NLTK library for symbolic and statistical processing of natural language is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to read...

Linux Distros Unpatched Vulnerability : CVE-2026-111151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row...