CVE-2020-11019

CVE-2020-11019 In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOGTRACE", a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. authentication| complexity|...

CVE-2026-119142

A flaw was found in Wasmtime. This issue allows a Denial of Service DoS condition where the host application crashes when canceling pending asynchronous tasks. When an embedder drops or cancels an asynchronous function call before execution begins, cleanup routines fail to handle the missing work...

Linux Distros Unpatched Vulnerability : CVE-2026-119124

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer...

UBUNTU-CVE-2026-119124

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the...

pillow: pillow: Denial of Service via zero-size images in rank filters

A flaw was found in Pillow. An attacker can cause a Denial of Service DoS by submitting a zero-size image to an application that applies rank-based filters, such as median, minimum, or maximum filters. When attempting to expand the image borders, Pillow reads from unallocated image storage,...

CVE-2026-119124

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147032)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147032 advisory. A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remot...

CVE-2026-117610

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

CVE-2026-117610

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

CVE-2026-117610 libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

CVE-2026-117610

The libexpat library (versions through 2.9.0 ) is vulnerable to a NULL pointer dereference in the externalEntityInitProcessor2() function within lib/xmlparse.c. The flaw occurs because the software mishandles the XML_TOK_NONE token when processing empty input. An attacker capable of controlling s...

CVE-2026-117610 libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

EUVD-2026-111545

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

PT-2026-127734

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XML TOK NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causi...

Linux Distros Unpatched Vulnerability : CVE-2026-117610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token...

AZL-111188 CVE-2026-117556 affecting package zchunk 1.3.2-1

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in readpreface in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing read...

EUVD-2026-110834

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in readpreface in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing read...

PT-2026-126415

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read preface in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing rea...

PT-2026-125479

Name of the Vulnerable Software and Affected Versions Furnace versions prior to 0.6.8.4 Description An out-of-bounds heap read occurs during the import of FamiTracker modules .ftm, .dnm, or 0CC/E-FamiTracker. The issue is triggered by an unbounded DPCM note count in the DivEngine::loadFTM functio...

PT-2026-125482

Name of the Vulnerable Software and Affected Versions flatcc versions prior to 0.6.5 Description An out-of-bounds read occurs in the flatcc json parser number function when processing numbers that end with a decimal point. An attacker can provide untrusted JSON data that terminates immediately...