CVE-2026-68553

Coturn (open-source TURN/STUN server) prior to 4.13.0 is affected by a format string vulnerability in its Redis integration. An authenticated TURN user can inject printf-style format specifiers into the STUN USERNAME or REALM attribute. These values pass is_secure_string() validation and are embe...

CVE-2026-68553

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

CVE-2026-68553 Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

CVE-2026-15961

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings...

CVE-2026-15961

IBM PowerVM Hypervisor is affected by a format string vulnerability (CWE-134) in firmware versions FW1120.00, FW1110.00–FW1110.30, and FW1060.00–FW1060.80. A local attacker with high privileges can exploit this to obtain sensitive information or cause a denial of service . The CVSS 3.1 score is 5...

EUVD-2026-62429

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings...

CVE-2026-15961 Power System Information Disclosure

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings...

CVE-2026-15961: Use of Externally-Controlled Format String

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings...

PT-2026-78431

Name of the Vulnerable Software and Affected Versions IBM PowerVM Hypervisor version FW1120.00 IBM PowerVM Hypervisor versions FW1110.00 through FW1110.30 IBM PowerVM Hypervisor versions FW1060.00 through FW1060.80 Description Improper control of format strings may allow a local attacker to obtai...

CVE-2026-68553: Use of Externally-Controlled Format String

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

CVE-2026-62292

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heifimagehandledecodeimagetile. In...

ROS-20260818-73-0001

The vulnerability in Wireshark is related to the use of uncontrolled format lines. The vulnerability can be exploited remotely...

ANT-2026-6X60WXT0 · LibreOffice · Use-After-Free

use-after-free medium CVE-2026-6040 Severity Claude medium · Security research firm medium · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-6X60WXT0: Heap use-after-free writ...

hermes-decomp v0.2.2

Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...

CVE-2026-59894

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the...

CVE-2026-71491 sqlparse: Quadratic O(n²) DoS in group_comments

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...

CVE-2026-59894 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the...

CVE-2026-8723

A flaw was found in the qs library. When the qs.stringify function processes arrays containing null or undefined elements, and is configured with both arrayFormat: 'comma' and encodeValuesOnly: true, it can trigger a TypeError. This error causes the application to crash or return a 500 error,...

PT-2026-76779

Name of the Vulnerable Software and Affected Versions FreeCAD versions 0.19 through 1.1.0 Description In the BIM Project Manager Load Template flow within src/Mod/BIM/bimcommands/BimProjectManager.py, the software passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and...

CVE-2026-74875: Insufficient Verification of Data Authenticity

opensslencrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process...