CVE-2025-60480

A heap buffer overflow in the gfodfac4cfgalternativeinfo function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2026-112282: Out-of-bounds Read

VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpiaccesspoint that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with numepfine set to zero and an...

ALSA-2026:85239 Important: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-79986: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the...

CVE-2025-52290

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

PT-2026-117470

docling-core through 2.102.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow image file uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with...

PT-2026-117535

A segmentation violation in the dump isom saps function /mp4box/filedump.c of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-117351

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

CVE-2025-60480

GPAC Project/MP4Box version 2.5-DEV-rev1593-gfe88c3545-master contains a heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function located in /odf/descriptors.c. An attacker can exploit this vulnerability by providing a crafted AC4 file to trigger a Denial of Service (DoS) . No specifi...

CVE-2025-60480

A heap buffer overflow in the gfodfac4cfgalternativeinfo function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

ROS-20261019-73-0003

The vulnerability of the putepelhvfallback function in the h.265 Libde265 implementation is related to the issue where the operation’s output goes beyond the buffer boundaries during processing of the unsigned short data type. Exploiting this vulnerability could allow a remote attacker to cause a...

PT-2026-117671

Name of the Vulnerable Software and Affected Versions Pillow versions 12.0.0 through 12.x Description The Image.merge function can dereference a null image8 plane because validation skips the first input band. This allows a 32-bit integer or floating-point image backed by image32 storage to be...

Red Hat Enterprise Linux Resource Management Vulnerability

Red Hat Enterprise Linux has a resource management vulnerability. This vulnerability arises when GIMP attempts to load a specially crafted XCF file by selecting a path; the loading process fails. As a result, the main process is reloaded after being released, potentially leading to a crash and...

RHEL 8 : python3 (RHSA-2026:85239)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85239 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

CVE-2025-60482

A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-55654

A use-after-free in the gffilterpidgetpacket function filtercore/filterpid.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted file...

Jenkins 2.426.2 LTS CLI Arbitrary File Read

Jenkins version 2.426.2 LTS contains an arbitrary file read vulnerability in CLI argument processing that can expose files readable by the Jenkins process. The supplied proof of concept retrieves CTF credentials through this issue. https://packetstorm.news/download/236352...

PT-2026-117225

Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the...

PT-2026-118089

SFTPGo source-side file-pattern filter bypass during copy operations in github.com/drakkan/sftpgo...

PT-2026-117495

Name of the Vulnerable Software and Affected Versions Eptura Archibus versions prior to 2025.02 Description An unauthenticated arbitrary file upload issue allows attackers to upload files with any content, including JSP and JSPX scripts, via the export reports feature. Because these uploaded file...