184 matches found
CVE-2026-104189 3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share
The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...
CVE-2026-104189
The 3D Viewer for Nextcloud (versions 1.7.9 through 3.3.1) contains a vulnerability where share passwords are not enforced when streaming 3D models via public links. The root cause is that PublicFileController extends OCP\AppFramework\Controller instead of OCP\AppFramework\PublicShareController, ...
PT-2026-126616
The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...
CVE-2026-112019
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltfaccessorunpackfloats that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltfvalidate to read adjacent heap memory into vertex data or cra...
CVE-2026-112019 cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltfaccessorunpackfloats that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltfvalidate to read adjacent heap memory into vertex data or cra...
CVE-2026-112019
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltfaccessorunpackfloats that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltfvalidate to read adjacent heap memory into vertex data or cra...
CVE-2026-112019 cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltfaccessorunpackfloats that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltfvalidate to read adjacent heap memory into vertex data or cra...
CVE-2026-112019
The cgltf library (versions through 1.15 ) contains a heap out-of-bounds read vulnerability within the cgltf_accessor_unpack_floats() function. The flaw occurs because the function advances the sparse values cursor by the base bufferView byteStride. An attacker can provide a crafted glTF or GLB f...
EUVD-2026-103472
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltfaccessorunpackfloats that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltfvalidate to read adjacent heap memory into vertex data or cra...
CVE-2026-112019 cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltfaccessorunpackfloats that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltfvalidate to read adjacent heap memory into vertex data or cra...
CVE-2026-112018 cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...
CVE-2026-112018 cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...
CVE-2026-112018 cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...
CVE-2026-112018
The cgltf library (through version 1.15 ) is vulnerable to a heap out-of-bounds write within the cgltf_accessor_unpack_floats() function. The root cause is the processing of unchecked sparse accessor indices , which allows an attacker to write outside the designated output buffer. By providing a ...
PT-2026-116623
Name of the Vulnerable Software and Affected Versions cgltf versions prior to 1.16 Description A heap out-of-bounds read occurs in the cgltf accessor unpack floats function when the sparse values cursor is advanced by the base bufferView byteStride. An attacker can provide a specially crafted glT...
CVE-2026-112019: Out-of-bounds Read
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltfaccessorunpackfloats that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltfvalidate to read adjacent heap memory into vertex data or cra...
Johannes Kuhlmann cgltf buffer error vulnerability
Johannes Kuhlmann’s cgltf versions prior to 1.15 have a buffer error vulnerability. This vulnerability stems from the cgltfaccessorunpackfloats function, which does not check the sparse accessor indices. This can lead to out-of-buffer writes. Attackers can write large sparse indices into the outp...
Johannes Kuhlmann cgltf buffer error vulnerability
Johannes Kuhlmann’s cgltf versions prior to 1.15 contain a buffer error vulnerability. This vulnerability stems from the cgltfaccessorunpackfloats function, which advances the cursor based on the byteStride of the base bufferView when handling sparse values. This allows for heap out-of-bound...
(0Day) Genesis World glTF Server-Side Request Forgery Vulnerability
This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Genesis World. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within th...
