CVE-2026-105840: Improper Limitation of a Pathname to a Restricted Directory

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

PT-2026-106827

Name of the Vulnerable Software and Affected Versions ImageSharp versions 2.0.0 through 4.1.1 Description The TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. The TiffCcittCompressor.Initialize function fails to reserve sufficient space for row da...

CVE-2026-79814: External Control of File Name or Path

An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow a local attacker to execute...

CVE-2026-101155: Improper Limitation of a Pathname to a Restricted Directory

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository...

CVE-2026-56936: Improper Restriction of Operations within the Bounds of a Memory Buffer

In wacomhidsetdevicemode of wacomsys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-106401: Out-of-bounds Write

Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106118: Out-of-bounds Write

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. TiffDecoderCore.DecodeTilesChunky can therefore...

CVE-2026-77178: Out-of-bounds Write

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet Am79C970A network device model...

CVE-2026-84854: Out-of-bounds Write

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent...

CVE-2026-98265: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity dataepsetparams allocates each data URB for exactly u-packets isochronous frames, so urb-isoframedesc has u-packets slots and ctx-packets is the driver's only...

CVE-2026-98239: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743xrxprocessbuffer adds each non-first receive buffer to the head skb's fraglist. On the last descriptor, lan743xrxtrimskb linearizes the head and frees the fragment skb metadata...

CVE-2026-95105: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR...

CVE-2026-25272: Out-of-bounds Write

Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation...

CVE-2026-25270: Out-of-bounds Write

Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...

CVE-2026-25269: Out-of-bounds Write

Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size...

CVE-2026-25263: Out-of-bounds Write

Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters...

CVE-2026-105786: Missing Authentication for Critical Function

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...

CVE-2026-77178

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet Am79C970A network device model...

Linux Distros Unpatched Vulnerability : CVE-2026-98189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status regist...

CVE-2026-106112: Out-of-bounds Write

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to...