CVE-2026-99094Published
Bluetooth: btintel_pcie: fix TX descriptor bounds check
cve-program ·
Vendor product: Linux · Vendor product: Linux
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
688320 source statements · aliases may refer to the same vulnerabilityCVE-2026-99093Published
mm: don't schedule deferred kernel page table freeing while booting
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-99092Published
riscv: patch: fix handling of bpf-jit execmem addresses
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-99091Published
Bluetooth: MGMT: Fix status of pending commands flushed on power off
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-99089Published
ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-99088Published
net: openvswitch: validate transport header presence in set_ipv6_addr
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-77057Published
Improper Restriction of Excessive Authentication Attempts in boneIO
cve-program ·
https://pypi.python.org: boneio
CVE-2026-77055Published
Improper Privilege Assignment in boneIO
cve-program ·
Vendor product: black_debian_images
CVE-2026-77053Published
Missing Authentication in Default Configuration in boneIO
cve-program ·
https://pypi.python.org: boneio
CVE-2026-77052Published
Missing Authentication for Node-RED in boneIO
cve-program ·
https://pypi.python.org: boneio
CVE-2026-116340Published
iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization
cve-program ·
Vendor product: astron-agent
GHSA-7cxh-94cf-mfp6Published
Talos Linux: Support bundle does not redact registry credentials
osv · CVE-2026-77564
Go: github.com/siderolabs/talos
GHSA-h895-cgqg-jf52Published
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
osv · CVE-2026-114142
npm: toml
CVE-2026-110748Published
Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.sis:sis-metadata
CVE-2026-84823Published
Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: pki-core:10.6/resteasy · https://access.redhat.com/downloads/content/package-browser/: pki-deps:10.6/resteasy · https://access.redhat.com/downloads/content/package-browser/: resteasy
CVE-2026-106781Published
An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges.
cve-program ·
Vendor product: n/a
CVE-2026-105930Published
Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
cve-program ·
Vendor product: Apache Pulsar
CVE-2026-114214Published
Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records
cve-program ·
https://repo.hex.pm: ash · https://github.com: ash-project/ash
CVE-2026-115635Published
AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
cve-program ·
https://repo.hex.pm: ash_postgres · https://github.com: ash-project/ash_postgres
CVE-2026-115627Published
AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
cve-program ·
https://repo.hex.pm: ash_postgres · https://github.com: ash-project/ash_postgres
CVE-2026-113345Published
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application ma…
cve-program ·
Vendor product: Electronic delivery item Inspection Support System
CVE-2026-107898Published
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affec…
cve-program ·
Vendor product: V-SFT
CVE-2026-107899Published
V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the a…
cve-program ·
Vendor product: V-SFT
CVE-2026-96581Published
An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
cve-program ·
https://repo.hex.pm: ash · https://github.com: ash-project/ash
CVE-2026-82943Published
Out-of-Bounds Read via Unchecked Length Values
cve-program ·
Vendor product: SOEM
CVE-2026-95628Published
Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-docling
CVE-2026-82945Published
Memory Corruption via FMMU Configuration Table Overflow
cve-program ·
Vendor product: SOEM
CVE-2026-82946Published
Null Pointer Dereference in Mailbox Error Handling
cve-program ·
Vendor product: SOEM
CVE-2026-113438Published
Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login…
cve-program ·
Vendor product: Pleasanter
CVE-2026-103377Published
Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha
cve-program ·
Vendor product: Video library of the Regional Parliament of Castile-La Mancha
CVE-2026-112250Published
Cleartext Storage of Windows Service Account Password in BRAIN2 Setup Log Files
cve-program ·
Vendor product: BRAIN2
CVE-2026-4316Published
Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio
cve-program ·
Vendor product: IsMyGym
CVE-2026-94380Published
Host Header Injection in HAVELSAN's Liman MYS
cve-program ·
Vendor product: Liman MYS
CVE-2026-96432Published
Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt
cve-program ·
Vendor product: qt
CVE-2026-105947Published
Arbitrary File Read in Innotim Software's Logsign SIEM
cve-program ·
Vendor product: Logsign SIEM
CVE-2026-92171Published
Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: infinispan-server-core
CVE-2026-105134Published
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
cve-program ·
Vendor product: AhsayCBS
CVE-2026-105133Published
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
cve-program ·
Vendor product: AhsayCBS
CVE-2026-115486Published
Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: iscsi-initiator-utils · https://access.redhat.com/downloads/content/package-browser/: iscsi-initiator-utils · https://access.redhat.com/downloads/content/package-browser/: iscsi-initiator-utils
CVE-2026-115485Published
Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: iscsi-initiator-utils · https://access.redhat.com/downloads/content/package-browser/: iscsi-initiator-utils · https://access.redhat.com/downloads/content/package-browser/: iscsi-initiator-utils
CVE-2026-115484Published
Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: iscsi-initiator-utils · https://access.redhat.com/downloads/content/package-browser/: iscsi-initiator-utils · https://access.redhat.com/downloads/content/package-browser/: iscsi-initiator-utils
GHSA-wmxv-xphr-5c9gPublished
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop
osv · CVE-2026-106116
NuGet: SixLabors.ImageSharp · NuGet: SixLabors.ImageSharp
GHSA-j3p4-wp97-rph4Published
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
osv · CVE-2026-106113
NuGet: SixLabors.ImageSharp · NuGet: SixLabors.ImageSharp
GHSA-gwg2-r3hj-4w44Published
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
osv · CVE-2026-106114
NuGet: SixLabors.ImageSharp · NuGet: SixLabors.ImageSharp
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.