PT-2026-141046

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the APNG encoder's encode apng function in libavcodec/pngenc.c when frame size changes mid-stream. Attackers can supply crafted media whose resolution grows mid-stream, causing APNG DISPOSE OP BACKGROUND memset writes past prev...

PT-2026-141087

FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff prores kostya encode init that miscalculates frame size upper bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores ks encoder, causing encode frame to...

CVE-2026-124987: mikefarah yq: A vulnerability has been found in mikefarah yq up to 4.53.3

A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoderproperties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance...

PT-2026-141015

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta encode frame in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame,...

PT-2026-141022

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in pcm dvd encode frame in libavcodec/pcm-dvdenc.c when a 24-bit final frame holds fewer samples than one block. Attackers can supply 24-bit 48 or 96 kHz audio whose length leaves a short final frame, causing the loop counter to wr...

PT-2026-141045

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq dpcm encode frame in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transcoding, causing DPCM-quantized...

PT-2026-141061

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in dvbsub encode in libavcodec/dvbsubenc.c that undercounts each CLUT segment header by two bytes. Attackers can supply a file with many bitmap subtitle rectangles that, when transcoded to the dvbsub encoder, writes past the outpu...

CVE-2026-21015-PHP-Filter-Chain-Arbitrary-File-Read

CVE-2026-21015 – PHP Filter Chain Arbitrary File Read Program Code PHP // vulnerable.php - Includes file based on user input via filter ?php $file = $GET'page'; // Attempt to sanitize by allowing only .php files, but vulnerable to filter wrapper include"php://filter/convert.base64-encode/resource...

CVE-2025-57926

Sink: According to the mechanism of WordPress Core, XSS is prevented in post content, but with this plugin, the content is encoded and then decoded when rendered, unintentionally creating an XSS vulnerability." PoC: The base64 encoded payload is PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==...

Astra Linux – vulnerability in php8.2

The convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode stream filters accept a line-break-chars option; the length of this option is tracked separately from the string itself. The filter constructors duplicate the value using pestrdup, which stops at the...

openSUSE 16 Security Update : perl-Cpanel-JSON-XS (openSUSE-SU-2026:22187-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22187-1 advisory. Changes in perl-Cpanel-JSON-XS: - updated to 4.800.0 4.80 + Security fixes, reported by Stig Palmquist CPANSec: CVE-2026-110672 decode: free the...

[SECURITY] Fedora 45 Update: perl-Net-IDN-Encode-2.502-1.fc45

This module provides an easy-to-use interface for encoding and decoding Internationalized Domain Names IDNs...

Fedora 45 : perl-Net-IDN-Encode (2026-2aac921262)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2aac921262 advisory. Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode. This...

PT-2026-133480

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped json encode output. Attackers can send crafted index or value parameters with operation=save setting value to /database/designer to overwrite other...

CVE-2026-116103

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function loadparamintxt of the file python/src/nnabla/utils/cli/encodedecodeparam.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch th...

EUVD-2026-109591

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function loadparamintxt of the file python/src/nnabla/utils/cli/encodedecodeparam.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch th...

CVE-2026-116103 Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function loadparamintxt of the file python/src/nnabla/utils/cli/encodedecodeparam.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch th...

CVE-2026-116103 Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function loadparamintxt of the file python/src/nnabla/utils/cli/encodedecodeparam.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch th...

CVE-2026-116103

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function loadparamintxt of the file python/src/nnabla/utils/cli/encodedecodeparam.py of the component Encode Param Command Handler. Such manipulation leads to code injection. It is possible to launch th...

CVE-2026-116103

A code injection vulnerability exists in Sony Neural Network Libraries up to version 1.39.0 . The flaw is located in the load_param_in_txt function within the file python/src/nnabla/utils/cli/encode_decode_param.py, specifically affecting the Encode Param Command Handler component. This vulnerabi...