CVE-2026-98668

A flaw was found in the Linux kernel's Industrial I/O IIO subsystem. This vulnerability allows information disclosure when the kernel processes unaligned data buffers with timestamps enabled. Because the allocated buffer is not properly cleared before being shared with user space, a local user ca...

CVE-2026-98661

A flaw was found in the Linux kernel's ROHM BU27034 ambient light sensor driver. When reading the sensor integration time fails, the driver improperly uses the returned error code to calculate sleep duration. A local user interacting with the sensor interface during a read failure can cause the...

CVE-2026-114501

A flaw was found in Pillow. This vulnerability can lead to information disclosure when exporting images to Apache Arrow format with memory alignment enabled, as the library assumes image rows are contiguous in memory. Consequently, exported buffers may incorporate uninitialized padding or residua...

CVE-2026-98674

A flaw was found in the Linux kernel's Analog Devices AXI ADC driver. This vulnerability can lead to a denial of service DoS due to an uninitialized synchronization lock mutex used during register access operations. A local user could trigger this issue during device interactions, causing imprope...

CVE-2026-98667

A flaw was found in the Linux kernel's ADF4377 clock driver. Due to uninitialized data structures during device registration, the driver may attempt to access invalid memory pointers under certain kernel memory configurations. A local user could exploit this flaw to cause a kernel crash, leading ...

CVE-2026-98669

A flaw was found in the Linux kernel's Industrial I/O IIO subsystem. During device unregistration, the kernel disables and deactivates device buffers without acquiring the required lock to synchronize teardown with active buffer-mode claims. A local user could exploit this race condition to cause...

CVE-2026-98672

A flaw was found in the Linux kernel's STM32 Analog-to-Digital Converter ADC driver. When an ADC conversion fails or returns a zero value, subsequent calculation on the channel data can trigger a division by zero. A local user could exploit this vulnerability to crash the system, leading to a...

CVE-2026-98673

A flaw was found in the Linux kernel's PAC1934 driver. This vulnerability can result in a Denial of Service DoS due to a kernel crash caused by an invalid memory access. When the driver processes device configuration labels from the ACPI Advanced Configuration and Power Interface firmware tables,...

CVE-2026-98666

A flaw was found in the Linux kernel's Industrial I/O IIO adis16136 gyroscope driver. The driver fails to properly synchronize debugfs read operations during device unbinding, allowing an active read to continue after the underlying device data structures have been freed. A local user with access...

CVE-2026-98665

A flaw was found in the Linux kernel's MAX30102 sensor driver. This vulnerability allows a local user to cause a Denial of Service DoS through a system crash. The issue occurs when a device interrupt is triggered while no data buffer is active, causing the interrupt handler to access uninitialize...

CVE-2026-98664

A flaw was found in the Linux kernel's ADIS16400 driver. A local user with access to the debug file system debugfs could cause a Denial of Service DoS or kernel memory corruption due to a use-after-free condition. This issue occurs because the driver creates its serial number debugfs file without...

CVE-2026-98663

A flaw was found in the Linux kernel's ADIS16480 Industrial I/O IIO driver. The driver fails to protect debug file system debugfs read operations against concurrent device removal. A local attacker with access to debugfs can exploit this race condition by reading firmware attributes while unbindi...

CVE-2026-98660

A flaw was found in the Linux kernel's BMP280 pressure sensor driver. An incorrect table boundary calculation during sampling frequency configuration allows an out-of-bounds memory read. A local user with permissions to configure device settings can exploit this flaw to cause a system crash,...

CVE-2026-96636

A flaw was found in Pillow. A remote attacker could exploit this vulnerability by enticing an application or user to process a specially crafted multi-frame image file. Because decompression bomb protections are bypassed when navigating subsequent image frames, decoding the file allocates excessi...

CVE-2026-98659

A flaw was found in the Linux kernel's ROHM BM1390 Industrial I/O IIO sensor driver. The driver fails to propagate error status codes when a read operation fails, unconditionally returning success. A local user querying the sensor can receive invalid or uninitialized measurement data without an...

CVE-2026-98658

A flaw was found in the Linux kernel's aw96103 proximity sensor driver. This vulnerability can lead to a Denial of Service DoS or kernel information disclosure via an out-of-bounds memory read. The issue occurs because the driver's firmware parser does not properly validate the data length...

CVE-2026-96642

A flaw was found in Pillow. When an application processes tar archives using the TarIO component, an archive containing an invalid negative member size causes the parser to enter an infinite loop by repeatedly reading the same header. An attacker could exploit this by providing a specially crafte...

CVE-2026-96641

A flaw was found in Pillow. When processing text dimensions with certain fonts, negative character spacing values are not properly validated during text-width calculation, causing an integer overflow. A remote attacker could exploit this vulnerability by providing crafted text or font data to an...

CVE-2026-96638

A flaw was found in Pillow. When processing run-length encoded RLE bitmap images, the decoder fails to properly limit memory allocation for certain escape sequences and data runs. A remote attacker could exploit this flaw by supplying a specially crafted BMP image file to an application, causing...

CVE-2026-96778

A flaw was found in Pillow. A remote attacker could exploit a heap buffer overflow vulnerability to achieve arbitrary code execution or cause a Denial of Service DoS. This issue occurs when an application re-encodes an untrusted image into JPEG format while preserving specially crafted color...

CVE-2026-96644

A flaw was found in Pillow. When processing Windows Metafile WMF or Enhanced Metafile EMF images on Windows systems, the image parser improperly handles dimension values, allocating an undersized buffer while reading full dimensions. A remote attacker could exploit this vulnerability by enticing ...

CVE-2026-96643

A flaw was found in Pillow. When processing a specially crafted image with repeated Exchangeable Image File Format EXIF metadata headers, the library repeatedly copies and parses the data. A remote attacker could exploit this vulnerability by providing a malicious image file to an application tha...

CVE-2026-96637

A flaw was found in Pillow. When processing multi-frame SPIDER images, decompression bomb safeguards are not reapplied when navigating to subsequent frames that declare excessively large dimensions. A remote attacker could exploit this vulnerability by providing a specially crafted image file,...

CVE-2026-98657

A flaw was found in the Linux kernel's PulsedLight LIDAR sensor driver. When device initialization fails during power management setup, the driver fails to properly unregister the device before releasing its allocated memory. This leaves active system interfaces pointing to released memory,...

CVE-2026-98656

A flaw was found in the Linux kernel's Industrial I/O IIO subsystem. A race condition occurs when deferred background tasks are not canceled prior to releasing trigger device structures, allowing a worker thread to access memory after it has been freed. A local user could exploit this flaw during...

CVE-2026-114145

A flaw was found in GitPython. This vulnerability allows an attacker to achieve arbitrary code execution by supplying an untrusted submodule path. Because the library fails to properly validate destination paths before cloning repository data, an attacker can plant a malicious executable script...

CVE-2026-114141

A flaw was found in toml. A remote attacker can trigger a Denial of Service DoS by supplying a crafted TOML document containing a large number of array-of-tables headers. Processing these unpruned headers causes repetitive path scanning that blocks the event loop, rendering the application...

CVE-2026-114143

A flaw was found in toml-node. A remote attacker could cause a Denial of Service DoS by providing specially crafted TOML input containing long dotted keys or deeply nested table headers. Processing these complex paths causes inefficient repetitive operations, consuming excessive CPU and memory...

CVE-2026-114144

A flaw was found in toml-node. A remote attacker can cause a Denial of Service DoS by submitting a specially crafted TOML document containing excessively long numeric sequences. When parsing these unbounded values, the application consumes excessive CPU resources and blocks the main execution...

CVE-2026-114138

A flaw was found in djangorestframework. An unauthenticated remote attacker can cause a Denial of Service DoS by sending HTTP requests with a specially crafted Accept header containing an excessive number of media types with complex parameters. Because the framework performs unbounded and...

CVE-2026-114140

A flaw was found in nbconvert. This flaw allows an attacker to perform an arbitrary file write by enticing a user to convert a maliciously crafted Jupyter notebook. Due to improper path validation in ExtractOutputPreprocessor, attacker-controlled cell output metadata can traverse outside the targ...

CVE-2026-114137

A flaw was found in Django REST Framework. When an application attempts to revoke authentication credentials using the TokenProxy component, the deletion query targets an incorrect identifier, causing the deletion to silently fail without raising an error. Consequently, revoked credentials remain...

CVE-2026-109710

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Text component...

CVE-2026-98655

A flaw was found in the Linux kernel. An unprivileged local user could exploit this vulnerability to cause an information disclosure, bypassing Kernel Address Space Layout Randomization KASLR, a security feature that randomizes kernel memory addresses to hinder exploitation. By opening performanc...

CVE-2026-98653

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM subsystem on s390 architectures. In nested virtualization environments, the kernel can erroneously pass an unhandled memory fault error to host userspace when shadowing nested guest memory pages that are not yet mapped. A gue...

CVE-2026-98652

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM subsystem for the s390 architecture. A missing synchronization lock during status storing operations allows a local user with virtual machine management privileges to trigger a race condition. This flaw can lead to kernel...

CVE-2026-109741

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Storage: Bucket File System component...

CVE-2026-113326

A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by enticing a user to load a specially crafted HTML page, triggering memory corruption. This issue allows the attacker to read memory within the browser's restricted sandbox environment, potentially leading t...

CVE-2026-113246

A flaw was found in the iOSWebView component of Google Chrome. A remote attacker could exploit this memory corruption vulnerability by tricking a user into viewing a specially crafted HTML page. Successful exploitation can lead to information disclosure by allowing the attacker to read memory...

CVE-2026-113325

A flaw was found in the SignIn component of Google Chrome on iOS. A remote attacker could exploit this memory corruption vulnerability by persuading a user to visit a specially crafted HTML page. Successful exploitation allows the attacker to read process memory inside the application sandbox,...

CVE-2026-113304

A flaw was found in chromium-browser. A memory corruption vulnerability in the Graphics Processing Unit GPU component can lead to information disclosure. A remote attacker could exploit this flaw by convincing a user to visit a specially crafted HTML page, potentially allowing the attacker to rea...

CVE-2026-113333

A flaw was found in the Extensions component of chromium-browser. A remote attacker could exploit this vulnerability by enticing a user to view a specially crafted HTML page, triggering memory corruption. This issue allows the attacker to read memory contents within the sandbox environment, leadi...

CVE-2026-113296

A flaw was found in chromium-browser. A remote attacker could exploit a memory corruption vulnerability in the Actor component by convincing a user to open a specially crafted HTML page. Successful exploitation allows the attacker to read memory within the sandbox an isolated security environment...

CVE-2026-113322

A flaw was found in chromium-browser. This memory corruption vulnerability in the Dawn graphics component can result in information disclosure. A remote attacker can exploit this flaw by enticing a user to view a specially crafted HTML page. Successful exploitation allows the attacker to read...

CVE-2026-113209

A flaw was found in the Navigation component of Google Chrome. A remote attacker can exploit a memory corruption vulnerability by convincing a user to open a specially crafted HTML page, leading to information disclosure. A successful attack enables the adversary to read sensitive memory contents...

CVE-2026-113142

A flaw was found in the Extensions component of Chromium. This vulnerability allows a remote attacker to cause information disclosure by reading process memory inside the browser sandbox. To exploit the flaw, an attacker must convince a user to load a specially crafted HTML page, triggering memor...

CVE-2026-113225

A flaw was found in chromium-browser. This vulnerability allows a remote attacker to cause information disclosure by triggering memory corruption through a specially crafted HTML page. By convincing a user to open the malicious page, an attacker can read memory contents within the browser's...

CVE-2026-113196

A flaw was found in chromium-browser. This vulnerability allows information disclosure by enabling a remote attacker to bypass the web origin policy, which normally prevents scripts on one website from accessing data on another. By convincing a user to open a specially crafted HTML page, an...

CVE-2026-113193

A flaw was found in chromium-browser. This flaw leads to information disclosure due to a memory corruption issue in the V8 JavaScript engine. A remote attacker can exploit this vulnerability by enticing a user to view a specially crafted HTML page. Successful exploitation allows the attacker to...

CVE-2026-113297

A flaw was found in the Ozone component of Chromium. An improper access control issue allows a remote attacker to obtain sensitive information by convincing a user to visit a specially crafted HTML page. Successful exploitation may lead to unauthorized data disclosure...