CVE-2026-105789 Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the executecommand tool in ufo/client/mcp/httpservers/linuxmcpserver.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output...

CVE-2026-105789

The Microsoft UFO open-source automation framework is vulnerable to an arbitrary file write in the Linux MCP execute_command tool (specifically within ufo/client/mcp/http_servers/linux_mcp_server.py) prior to version 3.0.9 . The root cause is that while sort and uniq are treated as read-only, an ...

CVE-2026-105789 Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the executecommand tool in ufo/client/mcp/httpservers/linuxmcpserver.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output...

CLSA-2026-1791292931 httpd: Fix of CVE-2026-56153

CVE-2026-56153: modcharsetlite: out-of-bounds write in finishpartialchar when a partial multibyte character straddles buckets; stop filling ctx-buf once it is full...

BIT-APACHE-2026-59685 Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM

Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

BIT-APACHE-2026-57941 Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

BIT-APACHE-2026-56449 Apache HTTP Server: mod_proxy_html: crash in dump_content

Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68...

AZL-105969 CVE-2026-75818 affecting package aspell 0.60.8.1-1

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to...

OPENSUSE-SU-2026:22025-1 Security update for gimp

This update for gimp fixes the following issues: Changes in gimp: - CVE-2026-96546: one-byte out-of-bounds heap read in the uncompressed DDS loader bsc1282601 - CVE-2026-97185: out-of-bounds write in GIMPressionist plugin via crafted preset file bsc1282596...

EUVD-2026-93364

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to...

CVE-2026-84854 Out of Bound Write on WibuKey for Windows

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent...

CVE-2026-84854

The WibuKey driver for Windows versions below 6.72 contains an out-of-bounds write vulnerability due to insufficient validation of user input when calculating the size of a kernel buffer. This flaw could lead to a system crash or, under unfavorable circumstances, the modification of adjacent kern...

CVE-2026-84854 Out of Bound Write on WibuKey for Windows

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent...

CVE-2026-98361

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

DEBIAN-CVE-2026-98361

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

DEBIAN-CVE-2026-98323

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98323

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

AZL-106458 CVE-2026-98323 affecting package kernel for versions less than 6.6.158.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

DEBIAN-CVE-2026-98312

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

CVE-2026-98312

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...