EUVD-2026-63452

GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page ...

CVE-2026-18300 GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

CVE-2026-18297

GStreamer's OGG file parser copies user-supplied data to a stack buffer without length validation, enabling stack overflow and remote code execution when a victim opens a malicious OGG file. Exploitation requires user interaction. No specific affected versions or patch are provided in the documen...

CVE-2026-18296

A heap-based buffer overflow in GStreamer's MRF file parser (ZDI-CAN-29608) stems from copying user-supplied data to a heap buffer without length validation, enabling remote code execution in the current process context. Exploitation requires user interaction (visiting a malicious page or opening...

EUVD-2026-63443

OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target...

CVE-2026-18292 OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability

OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro . User interaction is required to exploit this vulnerability in that the target must...

EUVD-2026-63437

OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab OriginPro. User interaction is required to exploit this vulnerability in that the target must...

CVE-2026-18287 Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-18286 Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability

Aeon loadhumanactivitysegmentationdatasets Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2026-18286 Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability

Aeon loadhumanactivitysegmentationdatasets Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2026-63040

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache...

EUVD-2026-63480

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

CVE-2026-63044

CVE-2026-63044 is a Server-Side Request Forgery (SSRF) vulnerability in Apache InLong Manager , affecting versions 2.0.0 through before 2.4.0 . Any authenticated user (no admin role required) can abuse the POST /api/node/testConnection endpoint to force the server to make outbound HTTP requests o...

CVE-2026-76891

A flaw was found in the sharkd component of Wireshark. A remote attacker could exploit this vulnerability, which requires user interaction and has high attack complexity, by triggering a crash. This issue leads to a denial of service DoS, making the sharkd component unavailable. Mitigation Avoid...

CVE-2026-74273

A flaw was found in the Linux kernel's cxl/region component. A local user could exploit a race condition during the creation and deletion of regions. This could lead to the kernel becoming confused about the state of a region, potentially causing system instability or a denial of service DoS...

CVE-2026-64965

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user e.g. a student enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of test...

Microsoft Partner Center Information Disclosure Vulnerability

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-64969

ATutor (last confirmed vulnerable at v2.2.4) has an IDOR flaw in its profile album endpoint: any authenticated user can POST another user's member_id and permanently delete that user's profile picture, including instructors and administrators. The product is no longer supported and unpatched. CVS...