CVE-2026-10719

LowCVSS 1.8/10Last modified Jul 22, 2026

Description

Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platforms allows for writing 1 extra byte outside of allocated memory which sets a value to 1 via a maliciously crafted NVMe device with a bogus value in the namespace FLBAS byte.

Metrics

CVSS 4.0 1.8/10

CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:L/U:Clear

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
—	—	<= 25.05.3

References

Timeline

Published: Jun 2, 2026
Last modified: Jul 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1071936.5A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the CVE-2026-1071949.2Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially CVE-2026-10724.3The Keybase.io Verification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.5. Th CVE-2026-107205.1Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of CVE-2026-1072029.1A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen CVE-2026-1072035.4An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet inter CVE-2026-1072049.8LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by CVE-2026-1072058.6LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated att CVE-2026-1072069.4LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticate CVE-2026-1072077.2LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated at CVE-2026-1072085.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XM CVE-2026-1072097.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMa