SUSE-SU-2026:21375-1 Security update for fontforge

This update for fontforge fixes the following issues: - CVE-2025-15270: lack of proper validation of user-supplied data when parsing SFD files can lead to OOB writes and arbitrary code execution bsc1256031...

PT-2026-34618

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.13 @xmldom/xmldom versions prior to 0.9.10 xmldom versions 0.6.0 and earlier Description The software allows attacker-controlled processing instruction PI data to be serialized into XML without validating o...

gstreamer-plugins-base: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling

A flaw was found in GStreamer. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. The flaw exists within the handling of palette data in AVI files, where a lack of proper validation of user-supplied data can lead to an integer overflow...

gstreamer-plugins-ugly: GStreamer: Arbitrary code execution via ASF file processing

A flaw was found in GStreamer. This heap-based buffer overflow vulnerability in the ASF Demuxer component allows a remote attacker to execute arbitrary code. The issue arises from insufficient validation of user-supplied data length when processing stream headers within ASF Advanced Systems Forma...

The vulnerability of the biometric authentication function of the Windows Hello operating system allows a perpetrator to circumvent existing security restrictions.

The vulnerability of the biometric authentication function of the Windows Hello operating system relates to insufficient validation of input data. Exploiting this vulnerability could allow a hacker to circumvent existing security restrictions...

The vulnerability of the Hyper-V hardware virtualization system for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Hyper-V hardware virtualization technology for Windows operating systems is related to insufficient checking of output data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

WordPress plugin Accessibly 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPress...

Adobe ColdFusion deleteVersion Directory Traversal Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on affected installations of Adobe ColdFusion. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the deleteVersion method. T...

The vulnerability of the distributed data storage system RustFS, related to insufficient validation of input data, allows attackers to compromise the integrity and accessibility of the protected information.

The vulnerability of the distributed data storage system RustFS is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the integrity and accessibility of the protected information...

CVE-2026-4152

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

CVE-2026-4153

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...

CVE-2026-3446 Base64 decoding stops at first padded quad by default

When calling base64.b64decode or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use...

CVE-2026-5907

An insufficient data validation flaw was found in the Media component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=484665123...

The vulnerability of the WebML component in the Google Chrome browser, which allows a hacker to trigger a service failure.

The vulnerability of the WebML component in Google Chrome relates to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially created web page...

CVE-2026-5907

Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted video file. Chromium security severity: Low...

EUVD-2026-20489

CI4MS Vulnerable to .env CRLF Injection via Unvalidated host Parameter in Install Controller...

ROS-20260408-73-0032

A vulnerability in the btrfscopyroot function of the btrfs component of the Linux kernel is related to buffer copying without input data validation. Exploitation of the vulnerability allows an attacker to cause a denial of service...

gstreamer-plugins-base: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling

A flaw was found in GStreamer. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. The flaw exists within the handling of palette data in AVI files, where a lack of proper validation of user-supplied data can lead to an integer overflow...

The vulnerability of the cfg80211_6ghz_power_type_valid() function in the net/wireless/scan.c module, which supports wireless communication in Linux kernels, allows a hacker to cause a service failure.

The vulnerability of the cfg802116ghzpowertypevalid function in the net/wireless/scan.c module, which supports wireless communication in Linux kernels, is related to incorrect data validation. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the ext4_expand_extra_isize_ea() function in the fs/ext4/xattr.c module of the Ext4 file system in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ext4expandextraisizeea function in the fs/ext4/xattr.c module of the Ext4 file system in the Linux operating system is related to insufficient data validation. Exploiting this vulnerability could allow an attacker to cause a service failure...