Sonos tract

• CVE-2026-55093 Medium 6.1 tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load 0.2%
• CVE-2026-55832 Medium 6.1 Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx 0.2%
• CVE-2026-75093 Medium 4.3 sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size 0.6%