CVE-2026-105960
Medium · 5.5CVSS
5.5
EPSS
—
Published
Oct 20, 2026
CISA due date
—
The record
PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119600 tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows… CWE-130
- CVE-2026-119279 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
- CVE-2026-119277 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
- CVE-2026-119276 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
- CVE-2026-115794 P-Net before 1.0.3 passes the application alarm callback a data length derived from the… CWE-130
- CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked… CWE-130
- CVE-2026-114597 In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length… CWE-130
- CVE-2026-116013 OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability… CWE-130