PT-2026-106641

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6fire pcm in urb handler sizes each outgoing isochronous packet as actual length - 4 / in n analog buffer, a 4832-byte object from kcallocPCM MAX PACKET SIZE, PCM N...

PT-2026-106349

Memory Corruption when processing camera operations due to out-of-bounds write during driver updates...

PT-2026-106652

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw get hdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

PT-2026-106850

TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected...

PT-2026-106518

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilc wlan handle isr ext wilc wlan handle isr ext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and...

PT-2026-106731

🚨 CVE-2026-77178 CVSS 8.8 High An out-of-bounds write in Oracle VM VirtualBox's PCNet device model enables guest OS attackers to corrupt host memory and escape virtualization. https://t.co/GhdNlEPmY2 https://t.co/Fs6WHY8fRj...

TeamViewer Desktop Clients Before 15.81.5 Path Traversal

TeamViewer Desktop Clients before version 15.81.5 contain a path traversal flaw in file transfer that may allow an authenticated remote session participant to write files outside the selected download directory...

Linux Distros Unpatched Vulnerability : CVE-2026-98232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: core: Validate MODE SENSE lengths in scsicdlenable scsicdlenable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byt...

Linux Distros Unpatched Vulnerability : CVE-2026-98189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status regist...

PT-2026-107073

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An out-of-bounds write issue exists in the Media component. This flaw allows a remote attacker to potentially execute arbitrary code outside the sandbox by inducing the user to visit a...

PT-2026-106596

In the Linux kernel, the following vulnerability has been resolved: 9p: Fix v9fs issue write to update i size and remote i size Fix v9fs issue write to update i size and remote i size to the new size of the server file if we made it larger, using the start fpos and the count returned by p9 client...

PT-2026-106690

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMM PFN WRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxe check pagefault and left only HMM PFN VALID. A page...

PT-2026-107212

An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met. Successful exploitation could allow a local attacker to execute...

CVE-2026-95140

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create...

PT-2026-107106

Name of the Vulnerable Software and Affected Versions Google Android affected versions not specified Description An out-of-bounds write exists in the wacom hid set device mode function within wacom sys.c due to a missing bounds check. This flaw allows for physical escalation of privilege without...

Linux Distros Unpatched Vulnerability : CVE-2026-49878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In wpashandlerobustavscsrecvaction of robustav.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code...

AlmaLinux 9 : gimp (ALSA-2026:75575)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:75575 advisory. gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file CVE-2026-90947 gimp: gimp: heap-based buffer overflow in ICO loader vi...

Linux Distros Unpatched Vulnerability : CVE-2026-98312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-98181

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/gud: fix out-of-bounds write in gudplaneatomiccheck The plane property loop uses req-propertiesnumproperties + i as write index while simultaneously...

Linux Distros Unpatched Vulnerability : CVE-2026-98222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If...