CVE-2026-103262

A flaw was found in Tornado. A remote malicious server can cause a Denial of Service DoS when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly...

CVE-2026-103680

A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...

CVE-2026-86095

A flaw was found in netcdf-c. An attacker can craft a malicious HDF5 Hierarchical Data Format 5 file with an oversized attribute name. When an application processes this file and attempts to enumerate attribute names, the oversized name can cause an out-of-bounds write, leading to memory corrupti...

CVE-2026-103679

A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format TNEF file containing multiple message bodies. During extraction, improper memory management triggers a use-after-free and double-free condition,...

CVE-2026-103678

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format RTF data. Because the application fails to properly validate input buffer boundaries before copying data in getrtfdatafrombuf, reading beyond the...

CVE-2026-47516

A flaw was found in the NVIDIA GPU Display Driver. An unprivileged local user can trigger a use-after-free condition, which occurs when the driver accesses memory that has already been released. Successful exploitation could allow the attacker to execute arbitrary code, escalate privileges, tampe...

CVE-2026-102314

A flaw was found in chromium-browser. A remote attacker could spoof user interface UI elements by convincing a user to visit a specially crafted HTML page. This vulnerability stems from a UI misrepresentation issue within the TabStrip feature, which can be leveraged to mislead users into trusting...

CVE-2026-102305

A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by convincing a user to view a specially crafted HTML page. Successful exploitation leads to user interface UI misrepresentation within the sign-in component, allowing the attacker to spoof UI elements and...

CVE-2026-102302

A buffer overflow flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=563716534 https://code.google.com/p/chromium/issues/detail?id=102302...

CVE-2026-102303

An uninitialized resource flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=559727039 https://code.google.com/p/chromium/issues/detail?id=102303...

CVE-2026-102312

An ui misrepresentation flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=551668264 https://code.google.com/p/chromium/issues/detail?id=102312...

CVE-2026-102317

A flaw was found in chromium-browser. An improper privilege management issue exists within the Mojo inter-process communication IPC framework. A local attacker could exploit this flaw by running a crafted local program to bypass the browser's sandbox security boundary. Successful exploitation cou...

CVE-2026-103531

A flaw was found in OpenSC. A stack-based buffer overflow vulnerability exists in the SetCOS smart card driver during the handling of file control information in the setcosconstructfci44 function. By supplying manipulated card attributes, an attacker could trigger memory corruption, potentially...

CVE-2026-103641

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader. Mitigation Do not open untrusted Radiance HDR...

CVE-2026-103001

A flaw was found in pyjwt. This vulnerability allows a remote attacker to bypass token validation checks when an application reuses an options configuration across multiple token decoding requests. Because the library unintentionally modifies the caller's shared configuration dictionary when...

CVE-2026-80792

A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the ip6finishoutput2 function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive...

CVE-2026-103387

A flaw was found in uri-js. A remote attacker can cause a Denial of Service DoS by providing a specially crafted mailto URI to the parsing function. Improper handling of mailto header arguments triggers an uncaught exception, resulting in an application crash...

CVE-2026-102993

A flaw was found in pypdf. An attacker can provide a specially crafted PDF document containing unusually large Roman numeral page labels. When an application retrieves these page labels, the library generates excessively large numeral strings, resulting in substantial memory consumption and a...

CVE-2026-102995

A flaw was found in pypdf. A remote attacker could exploit this vulnerability by submitting a specially crafted PDF document containing unusually large tokens in font mapping streams. When the library parses this data during operations such as text extraction, it decodes and retains oversized...

CVE-2026-102938

A flaw was found in virtualenv. An attacker capable of influencing environment configuration or prompt settings can inject unauthorized configuration entries into the environment configuration file by providing values containing line boundaries. This flaw allows the attacker to override core...

CVE-2026-103432

A flaw was found in apcupsd. A remote attacker could exploit a stack-based buffer overflow vulnerability in the web monitoring interface by supplying specially crafted data during variable parsing. A successful attack could allow the attacker to execute arbitrary code on the system or cause a...

CVE-2026-103000

A flaw was found in pypdf. By supplying a specially crafted PDF file containing unusually large alphabetical page-label values, a remote attacker can trigger excessive memory allocation when an application retrieves document page labels. This uncontrolled memory consumption can cause the...

CVE-2026-102999

A flaw was found in pypdf. An attacker can cause a Denial of Service DoS by supplying a specially crafted PDF document containing a large number of embedded files. When an application accesses the attachment mapping, the library repeatedly reparses the entire attachment list for each lookup. This...

CVE-2026-102998

A flaw was found in pypdf. A remote attacker can exploit this issue by submitting a specially crafted PDF document with specific form field values. When an application updates these fields with flattening enabled, redundant computational operations are repeated inside a loop during appearance...

CVE-2026-102996

A flaw was found in pypdf. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted PDF document with an oversized font character width array. When processing the document during operations such as text extraction, the library allocates excessive...

CVE-2026-102997

A flaw was found in pypdf. A remote attacker can exploit this vulnerability by providing a crafted PDF document containing a partially malformed FlateDecode data compression stream. When processing the malformed stream, the application triggers an inefficient recovery routine that consumes...

CVE-2026-102994

A flaw was found in pypdf. By supplying a specially crafted PDF document containing excessively long indirect object identifiers or generation tokens without whitespace, a remote attacker can trigger unbounded input scanning during parsing. This issue causes significant processing delays and...

CVE-2026-102990

A flaw was found in basic-ftp. A malicious or compromised FTP server can cause a Denial of Service DoS by returning specially crafted Unix directory listings to the client. Inefficient regular expression processing during directory parsing leads to excessive CPU consumption, blocking the...

CVE-2026-47512

A flaw was found in the NVIDIA GPU display driver. A local user can trigger an out-of-bounds read within the kernel mode layer to access sensitive kernel memory. This flaw may allow an attacker to escalate privileges, execute arbitrary code, cause a Denial of Service DoS, or tamper with system da...

CVE-2026-47511

A flaw was found in the NVIDIA GPU display driver. An out-of-bounds write vulnerability in the kernel mode layer allows a local user with basic privileges to write data beyond allocated memory boundaries. Successful exploitation could allow an attacker to achieve arbitrary code execution, escalat...

CVE-2026-47510

A flaw was found in the NVIDIA GPU display driver. A local user can trigger an integer overflow in the kernel mode layer, leading to an out-of-bounds write to graphics processing unit GPU memory. A successful exploit could allow an attacker to execute arbitrary code, escalate privileges, cause a...

CVE-2026-47508

A flaw was found in the NVIDIA GPU Display Driver. An issue in the kernel mode layer allows a local user to cause an incorrect conversion between numeric types. A successful exploit can allow an attacker to execute arbitrary code, escalate privileges, cause a denial of service DoS, or disclose...

CVE-2026-47507

A flaw was found in nvidia-driver. A local user can trigger an out-of-bounds array access in the driver's kernel mode layer. This vulnerability could allow an attacker to escalate privileges, execute arbitrary code, cause a denial of service DoS, or access and modify sensitive system data...

CVE-2026-47504

A flaw was found in nvidia-driver. The driver's NGX updater relies on an outdated embedded cryptographic library that is susceptible to type confusion, an issue where data of one type is incorrectly treated as another. A local attacker with low privileges can exploit this vulnerability to achieve...

CVE-2026-47500

A flaw was found in nvidia-driver. The kernel mode layer fails to properly clean up memory reference counts during error recovery paths, leading to a use-after-free condition where memory is accessed after it has been released. A local attacker with standard user privileges could exploit this fla...

CVE-2026-47494

A flaw was found in the NVIDIA GPU Display Driver for Linux. A local user can exploit this vulnerability by providing crafted input that triggers a format string flaw. Successful exploitation may lead to arbitrary code execution, privilege escalation, a Denial of Service DoS, or unauthorized...

CVE-2026-91106

A flaw was found in HPLIP. A heap-based buffer overflow could potentially allow an attacker to achieve remote code execution, escalate privileges, cause a denial of service, disclose sensitive information, or perform unauthorized file modifications under certain conditions. Mitigation To mitigate...

CVE-2026-91104

A flaw was found in HPLIP. A heap-based buffer overflow could potentially allow an attacker to achieve remote code execution, escalate privileges, cause a denial of service, disclose sensitive information, or perform unauthorized file modifications under certain conditions. Mitigation To mitigate...

CVE-2026-98082

A flaw was found in the Linux kernel's Btrfs file system. Under specific error handling conditions, such as storage input/output I/O errors or failures during RAID extent operations, the kernel fails to release allocated block I/O tracking memory. A local user capable of triggering these file...

CVE-2026-93126

A flaw was found in the Linux kernel's remoteproc subsystem, specifically within the qcomq6v5adsp driver. When the adspmapcarveout function is called, it fails to properly release a device node reference. This oversight can lead to a reference leak, potentially causing resource exhaustion over ti...

CVE-2026-90178

A flaw was found in the Linux kernel's hwmon coretemp module. On systems with CPUs that do not support X86FEATUREPTS, the coredata array, which is allocated to manage temperature data, is not properly released. This memory leak can occur when the coretemp module is loaded and unloaded, potentiall...

CVE-2026-93151

A flaw was found in the Linux kernel's nvmet-rdma component. When an NVMe Non-Volatile Memory Express target using RDMA Remote Direct Memory Access transport is removed while input/output operations are still active, certain response resources are not properly released. This oversight results in...

CVE-2026-90361

A flaw was found in the Linux kernel's ath11k Wi-Fi driver. During the ath11kservicereadyextevent processing, a memory allocation for svcrdyext.macphycaps is not released if an error occurs during TLV Type-Length-Value parsing. This can lead to a memory leak, potentially causing resource exhausti...

CVE-2026-103500

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by convincing a user to open an email that is 2GB or larger, triggering a heap buffer overflow. This flaw allows an attacker to corrupt memory, which may cause an application crash, resulting in a Denial of Servic...

CVE-2026-102676

A flaw was found in Electron. This vulnerability allows untrusted guest content loaded inside an embedded web view to run background worker tasks with elevated privileges. By enabling Node.js integration within background web workers, an attacker can bypass security restrictions set by the host...

CVE-2026-47505

A flaw was found in nvidia-driver. A local user can exploit a use-after-free condition in the kernel mode layer, which occurs when memory is improperly accessed after it has been released. A successful exploit could allow an attacker to achieve arbitrary code execution, privilege escalation, Deni...

CVE-2026-47501

A flaw was found in the NVIDIA GPU Display Driver. A local user can exploit an out-of-bounds write vulnerability in the kernel mode layer by supplying mismatched memory buffers during event buffer setup. Successful exploitation could lead to privilege escalation, arbitrary code execution, denial ...

CVE-2026-47491

A flaw was found in nvidia-driver. A local unprivileged attacker can trigger the improper release of memory resources in the kernel mode layer, leaving a memory mapping accessible after the underlying memory is reused. A successful exploit could allow an attacker to achieve privilege escalation,...

CVE-2026-47489

A flaw was found in the NVIDIA GPU display driver. The driver's kernel mode layer does not properly preserve permissions on read-only memory. A local user can exploit this vulnerability to achieve privilege escalation or arbitrary code execution. Successful exploitation may also lead to data...

CVE-2026-90125

A flaw was found in the SMB client of the Linux kernel. In the smb2newreadreq function, a request buffer is allocated but not properly released when certain error conditions occur during an asynchronous read operation. A remote attacker could repeatedly trigger these error conditions, leading to ...