CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. The vulnerability is a path traversal in the MCP server tools: export_state and import_state (in src/consciousness-explorer/mcp/server.js) and saveVectorToFile / loadVecto...

CVE-2026-55609 sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

EUVD-2026-45030

Whistle vulnerable to path traversal...

CVE-2026-80050 ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary...

CVE-2026-80050 ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary...

CVE-2026-80050

ContiNew Admin versions through 4.1.0 contain a missing authorization and file-type allowlist vulnerability in its multipart upload endpoints (specifically MultipartUploadController). Authenticated users can initialize chunked uploads, send file parts, and complete uploads with arbitrary file ext...

EUVD-2026-65702

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Attackers can initialize chunked uploads, send file parts, and complete uploads to leave arbitrary...

CVE-2026-61555 OpenEXR: Empty multiView viewFromChannelName file crash

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile processes a...

CVE-2026-61555

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile processes a...

CVE-2026-61555 OpenEXR: Empty multiView viewFromChannelName file crash

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile processes a...

CVE-2026-61555

OpenEXR (the reference implementation for the EXR image format used in the motion picture industry) is vulnerable to a crash when Imf::GetChannelsInMultiPartFile() processes a crafted EXR file with an empty multiView header attribute. The root cause is that Imf::viewFromChannelName() indexes an e...

CVE-2026-76198

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user...

CVE-2026-75769

Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-75770

Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-75768

Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a vict...

CVE-2026-75749

Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-75752

Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious...

CVE-2026-75767

Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-75750

Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-75766

Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...