PT-2026-106832

Name of the Vulnerable Software and Affected Versions ImageSharp versions 2.1.0 through 4.1.1 Description The TIFF CCITT Group 4 encoder in this 2D graphics library allocates memory based on Width times rowsPerStrip bytes. However, the T6BitCompressor.CompressStrip function can produce encoded ro...

CVE-2026-101258: Out-of-bounds Write

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...

CVE-2026-25273: Out-of-bounds Write

Memory Corruption when processing camera operations due to out-of-bounds write during driver updates...

PT-2026-107136

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository...

PT-2026-107170

Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previou...

CVE-2026-104036: Out-of-bounds Write

A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can trigger this vulnerability by requesting identity lookups that resolve to...

EUVD-2026-93418

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet Am79C970A network device model...

CVE-2026-101154: Improper Limitation of a Pathname to a Restricted Directory

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository...

PT-2026-107106

Name of the Vulnerable Software and Affected Versions Google Android affected versions not specified Description An out-of-bounds write exists in the wacom hid set device mode function within wacom sys.c due to a missing bounds check. This flaw allows for physical escalation of privilege without...

CVE-2026-106100: Authorization Bypass Through User-Controlled Key

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to...

CVE-2026-106103: Improper Limitation of a Pathname to a Restricted Directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

CVE-2026-102163: Out-of-bounds Write

On affected Arista access points with Wireless Intrusion Prevention System WIPS active, an unauthenticated attacker within radio frequency RF proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution...

CVE-2026-98312: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

PT-2026-115673

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to...

PT-2026-115755

In the Linux kernel, the following vulnerability has been resolved: Input: rmi smbus - fix out-of-bounds read in rmi smb write block When chunking writes into SMBus blocks in rmi smb write block, the loop calculates block len using the original total length len instead of the remaining length cur...

AlmaLinux 8 : libpcap (ALSA-2026:76045)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:76045 advisory. libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access CVE-2026-0799 Tenable has extracted the preceding description block...

SUSE SLES16: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:23984-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23984-1 advisory. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. -...

Oracle Linux 9 : vim (ELSA-2026-75768)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-75768 advisory. - RHEL-257027 CVE-2026-73073 vim: arbitrary Ex command execution during C omni-completion via crafted typeref - RHEL-253669 CVE-2026-28420 vim: buffer overflow...

Cisco ASA Improper Input Validation (CVE-2020-3166)

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to read or write arbitrary files on the underlying operating system OS. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-98232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: core: Validate MODE SENSE lengths in scsicdlenable scsicdlenable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byt...