gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource...

gimp: GIMP: Arbitrary code execution via crafted TIF file parsing

A flaw was found in GIMP. This vulnerability allows a remote attacker to execute arbitrary code by tricking a user into opening a specially crafted TIF file. The issue arises from improper validation of user-supplied data during TIF file parsing, which can lead to an integer overflow before memor...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

HDF5: HDF5: Memory corruption via crafted HDF5 file

A flaw was found in HDF5. A heap-use-after-free vulnerability exists when converting a compound datatype containing floating-point members during a dataset read. An attacker can supply a specially crafted HDF5 file, which, when parsed by an application, can trigger this flaw. This can lead to a...

FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response

A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol RDP response. This occurs because the client incorrectly uses a smaller allochint value instead of the actua...

freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in Opus audio decode

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious Remote Desktop Protocol RDP server can exploit a heap buffer overflow vulnerability during Opus audio decoding. This occurs when the server negotiates Opus audio with a vulnerable client, causing the...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

USN-8703-1: WebKitGTK vulnerabilities

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...

libxml2 security update

An update is available for libxml2. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libxml2 library is a development toolbox providing the implementation of...

RLSA-2026:61242 Important: mingw-sqlite security update

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL databas...

OPENSUSE-SU-2026:21711-1 Security update for emacs

This update for emacs fixes the following issues: Security issues fixed: - Arbitrary code execution when opening a specially crafted file bsc1275941. - CVE-2026-77219: integer overflow in the PBM/PPM/PGM image loader leads to heap memory content leaks when a crafted image with large dimensions an...

CVE-2026-82867

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

CVE-2026-82862

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

CVE-2026-82862

Hulumi versions prior to v1.3.2 are affected by a helper script shadowing vulnerability in which the threat-model helper script is resolved from an unsafe root . An attacker can place a malicious file in the workspace directory, causing it to be loaded in place of the intended helper script, resu...

CVE-2026-82862 Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

CVE-2026-82862 Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow

A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed...