CVE-2026-88367: Incorrect Conversion between Numeric Types

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvgcurveDivs during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division...

EUVD-2026-86265

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvgpathArcTo when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle. The function subsequently...

PT-2026-97804

Name of the Vulnerable Software and Affected Versions Aureus ERP versions prior to 1.6.1 Description The application stores uploaded SVG files on its public disk and serves them from the application origin. This allows authenticated users to upload malicious SVG files containing JavaScript...

WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Safe SVG versions = 2.5.0...

WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by spectreDeveloper in WordPress Plugin Safe SVG versions = 2.5.0...

SUSE CVE-2026-79616

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...

Exploit for CVE-2026-94545

CVE-2026-94545 - Next.js next/og ImageResponse SVG Injection...

DEBIAN-CVE-2026-79616

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...

CVE-2026-79616

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...

CVE-2026-79616

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...

UBUNTU-CVE-2026-79616

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...

CVE-2026-79616

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...

CVE-2026-79616 Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...

CVE-2026-79616 Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...

EUVD-2026-85183

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...

CVE-2026-79616

The Qt Quick framework is vulnerable to an out-of-bounds read occurring while parsing untrusted SVG path strings within the Context2D.path and PathSvg.path components. The vulnerability stems from improper handling of path data during the parsing process. This flaw may result in a high impact on ...

Linux Distros Unpatched Vulnerability : CVE-2026-92024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156,...

Linux Distros Unpatched Vulnerability : CVE-2026-92029

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156,...

CVE-2026-79616: Out-of-bounds Read

Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...

CVE-2026-86062

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightragwebui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store r...