CVE-2026-111332

OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxishares share-ring cookie can request content via GET /api/files/id to read shared files or folder...

CVE-2026-111343

pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/id. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers,...

DEBIAN-CVE-2026-111272

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image...

CVE-2026-111272

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image...

CVE-2026-111274

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

CVE-2026-111275

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...

DEBIAN-CVE-2026-111271

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...

DEBIAN-CVE-2026-110918

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-111269

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the...

CVE-2026-111271

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...

CVE-2026-110918

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2024-58397

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications li...

CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110917

Google Chrome versions prior to 155.0.8059.84 are vulnerable to a memory corruption issue in SVG processing. A remote attacker can exploit this by tricking a user into visiting a crafted HTML page , which may allow the attacker to read memory . The vulnerability is classified as High severity by ...

CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110918

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110918

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...