CVE-2026-111346 ZenTao PMS through 22.6 Authorization Bypass via action::editComment

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and...

CVE-2026-111346 ZenTao PMS through 22.6 Authorization Bypass via action::editComment

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and...

CVE-2026-111332 OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie

OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxishares share-ring cookie can request content via GET /api/files/id to read shared files or folder...

CVE-2026-111343

The pig through 4.1.1 software contains a missing authorization vulnerability in the SysUserController.user component. This flaw allows any authenticated user to access the GET /admin/user/details/{id} endpoint without proper permission checks. By enumerating sequential user IDs, a low-privilege ...

CVE-2026-111282 iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer

Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle0x38RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer SID 0x38 request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to...

CVE-2026-111282

The Driftregion iso14229 library (versions before 0.10.1 ) is vulnerable to an Out-of-Bounds Read due to an integer wraparound in the Handle_0x38_RequestFileTransfer function. Unauthenticated attackers can send a short RequestFileTransfer (SID 0x38) request with a filePathAndNameLength between 0x...

CVE-2026-111282 iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer

Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle0x38RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer SID 0x38 request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to...

CVE-2026-111275 nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...

CVE-2026-111274 unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

CVE-2026-111274

The software unarr through 1.1.1 is vulnerable to a heap-based out-of-bounds read within the zip_parse_extra_fields() function in zip/parse-zip.c. The root cause is an incorrect ZIP64 extra field length check . An attacker can exploit this by providing a crafted ZIP archive containing 0xFFFFFFFF ...

CVE-2026-111272

The LibRaw library (versions through 0.22.2 ) is vulnerable to a heap-based out-of-bounds read within the LibRaw::parseNikonMakernote() function. An attacker can trigger this by providing a crafted Nikon NEF/TIFF image containing a 5-byte ShotInfo tag that declares version 243. This flaw allows t...

CVE-2026-111272 LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image...

CVE-2026-111272 LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image...

CVE-2026-111271 libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...

CVE-2026-111271 libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...

CVE-2026-111271

The libmodplug library (versions through 0.8.9.1 ) is vulnerable to a heap-based out-of-bounds read in the CSoundFile::ReadAMS2() function located in src/load_ams.cpp. An attacker can provide a crafted AMS file where the pattern effect bytes maintain bit 7 as set. This action drives the decoder p...

CVE-2026-111269 libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the...

CVE-2024-58397 MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications li...

CVE-2026-111269

Versions of libical through 4.0.6 are vulnerable to a heap-based out-of-bounds read in the icalvalue_decode_ical_string() function located in src/libical/icalvalue.c. This flaw occurs when the software decodes input ending in a backslash, specifically when handling escaped iCalendar text; the pro...

CVE-2024-58397

Versions of MP4v2 through 2.1.3 are vulnerable to a heap-based out-of-bounds read in the MP4File::GetChapters() function. An attacker can exploit this by providing a crafted MP4 file where a QuickTime chapter sample is shorter than its declared title length. This allows the attacker to read past ...