CVE-2026-25272: Out-of-bounds Write

Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation...

CVE-2026-25270: Out-of-bounds Write

Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...

CVE-2026-25263: Out-of-bounds Write

Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters...

CVE-2026-105786: Missing Authentication for Critical Function

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...

CVE-2026-77178

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet Am79C970A network device model...

CVE-2026-106112: Out-of-bounds Write

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to...

PT-2026-106832

Name of the Vulnerable Software and Affected Versions ImageSharp versions 2.1.0 through 4.1.1 Description The TIFF CCITT Group 4 encoder in this 2D graphics library allocates memory based on Width times rowsPerStrip bytes. However, the T6BitCompressor.CompressStrip function can produce encoded ro...

Linux Distros Unpatched Vulnerability : CVE-2026-98232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: core: Validate MODE SENSE lengths in scsicdlenable scsicdlenable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byt...

CVE-2026-101258: Out-of-bounds Write

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...

macOS 27.x < 27.0 Multiple Vulnerabilities (149035)

The remote host is running a version of macOS / Mac OS X that is 27.x prior to the full release of 27.0. It is, therefore, affected by multiple vulnerabilities: - A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process...

PT-2026-106518

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An out-of-bounds write issue exists in the wilc wlan handle isr ext function. The function retrieves the RX transfer size from the device-reported interrupt status register and reads that...

PT-2026-106528

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the pmbus/core component of the hardware monitoring hwmon subsystem. The system previously limited the number of phases to 10, but certain drivers, such as mp2975 and...

PT-2026-106533

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An out-of-bounds read exists in the rmi smb write block function. When chunking writes into SMBus blocks, the loop incorrectly calculates block len using the original total length len inste...

PT-2026-106596

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the 9p filesystem implementation where the v9fs issue write function fails to correctly update i size and remote i size when a server file is enlarged. The fix ensures th...

PT-2026-106647

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where absolute native symlink targets are not validated before NT fixups. When symlinkroot is unset, an absolute target is copied without conversion to ...

PT-2026-106652

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write exists in the RDMA/siw component. The siw get hdr function may process an extended DDP/RDMAP header across multiple TCP callbacks. If the first callback receives...

PT-2026-106594

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the ALSA usb-audio component where the data ep set params function allocates data URBs for a specific number of isochronous frames. For implicit feedback sinks, the snd u...

PT-2026-107136

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository...

PT-2026-107170

Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previou...

Security Advisory 0195

Security Advisory 0195 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-102163 CVSSv3.1 Base Score: 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSSv4.0 Base Score: 8.7...