D-Link DWR-M920 has a command injection vulnerability

DWR-M920 is a D-Link wireless router device used for cellular network access and wireless sharing. The D-Link DWR-M920 has a command injection vulnerability. This vulnerability arises due to the sub41C8E8 function in /boafrm/formSmsManage not performing secure filtering on the actionvalue...

CVE-2026-49975: Memory Allocation with Excessive Size Value

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67...

SCVMM Server Component Upgrade Fails After Upgrading to Veeam Backup & Replication 13

Challenge After upgrading Veeam Backup & Replication to version 13, attempts to upgrade the remote components on a highly available System Center Virtual Machine Manager SCVMM management server using the Veeam Backup & Replication Console fail with the following error: Failed to create persistent...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1786)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1786 advisory. http.cookies.Morsel.jsoutput returns an inline snippet and only escapes for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence inside the generated script element...

CVE-2026-11469 jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery

A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to...

quickjs:fuzz_compile: Use-of-uninitialized-value in JS_DefineProperty

Detailed Report: https://oss-fuzz.com/testcase?key=4646730619748352 Project: quickjs Fuzzing Engine: libFuzzer Fuzz Target: fuzzcompile Job Type: libfuzzermsanquickjs Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: JSDefineProperty buildbacktrace JSCallIntern...

mupdf:pdf_fuzzer: Use-of-uninitialized-value in FT_Atan2

Detailed Report: https://oss-fuzz.com/testcase?key=4850174630625280 Project: mupdf Fuzzing Engine: libFuzzer Fuzz Target: pdffuzzer Job Type: libfuzzermsanmupdf Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: FTAtan2 FTStrokerCubicTo FTStrokerParseOutline...

OSV-2026-872 Use-of-uninitialized-value in vpx_variance16x16_avx2

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520181861 Crash type: Use-of-uninitialized-value Crash state: vpxvariance16x16avx2 vp8pickintramode vp8cxencodeintramacroblock...

OSV-2026-868 Use-of-uninitialized-value in vp8_regular_quantize_b_sse4_1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520318421 Crash type: Use-of-uninitialized-value Crash state: vp8regularquantizebsse41 macroblockyrd vp8rdpickintramode...

PT-2026-50184

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520181861 Crash type: Use-of-uninitialized-value Crash state: vpx variance16x16 avx2 vp8 pick intra mode vp8cx encode intra macroblock...

PT-2026-50183

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=520318421 Crash type: Use-of-uninitialized-value Crash state: vp8 regular quantize b sse4 1 macro block yrd vp8 rd pick intra mode...

CVE-2026-9270

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The sendstats method does not remove newlines from metric names $stat variable, allowing attackers to change t...

CVE-2026-11341

A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEIvalue causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used...

libvpx:vpx_enc_fuzzer_vp8: Use-of-uninitialized-value in vp8_compute_skin_block

Project: https://chromium.googlesource.com/webm/libvpx Detailed Report: https://oss-fuzz.com/testcase?key=6574969609060352 Project: libvpx Fuzzing Engine: libFuzzer Fuzz Target: vpxencfuzzervp8 Job Type: libfuzzermsanlibvpx Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

CVE-2026-11312

A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purgekvmap in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The...

EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2026-2049)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : ACPI: CPPC: Avoid out of bounds access when parsing CPC dataCVE-2022-49145 scsi: libsas: Fix use-after-free bug in...

libvpx:vpx_enc_fuzzer_vp8: Use-of-uninitialized-value in vpx_variance16x16_avx2

Project: https://chromium.googlesource.com/webm/libvpx Detailed Report: https://oss-fuzz.com/testcase?key=5299502767734784 Project: libvpx Fuzzing Engine: libFuzzer Fuzz Target: vpxencfuzzervp8 Job Type: libfuzzermsanlibvpx Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

libvpx:vpx_enc_fuzzer_vp8_nalloc: Use-of-uninitialized-value in vp8_regular_quantize_b_sse4_1

Project: https://chromium.googlesource.com/webm/libvpx Detailed Report: https://oss-fuzz.com/testcase?key=4581817557778432 Project: libvpx Fuzzing Engine: libFuzzer Fuzz Target: vpxencfuzzervp8nalloc Job Type: libfuzzermsanlibvpx Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

MINI-QV45-H9W9-733M

Bulletin has no description...

CVE-2025-61306

A reflected cross-site scripted XSS vulnerability in the dfm-menucoveragealerts.php component of GmbH Mecury Managed Print Services docuForm v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable valu...