MongoBleed

MongoBleed CVE-2025-14847 Scanner and Exploitation Toolkit A security research toolkit for MongoBleed -- a critical unauthenticated memory leak in MongoDB's zlib decompression that allows attackers to extract sensitive data from server heap memory without authentication. ╔╦╗┌─┐┌┐┌┌─┐┌─┐╔╗ ┬...

SUSE CVE-2026-112404

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently,...

EUVD-2026-104645

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels...

DEBIAN-CVE-2026-112404

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently,...

CVE-2026-112404

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently,...

CVE-2026-112404

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently,...

PT-2026-117670

Name of the Vulnerable Software and Affected Versions Pillow versions 8.1.0 through 12.x Description Pillow contains an out-of-bounds read issue when decoding certain malformed compressed TIFF files. The problem occurs in the decodeTile and decodeAsRGBA functions within src/libImaging/TiffDecode....

CVE-2026-90557

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a...

UBUNTU-CVE-2026-90557

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a...

CVE-2026-90557

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a...

CVE-2026-90557 Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a...

CVE-2026-90557

Freeciv versions 3.1.0 through 3.2.5 are affected by an out-of-bounds read in sg_load_player_unit() triggered when loading a crafted savegame file containing an out-of-range unit activity index that bypasses bounds checking. The impact is a crash or limited heap memory exposure , yielding a CVSS ...

CVE-2026-90557

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a...

CVE-2026-90557 Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a...

EUVD-2026-76902

Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sgloadplayerunit when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a...

DEBIAN-CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...

CVE-2026-41186

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-56391

The CVE-2026-56391 issue affects GNU coreutils, specifically the uniq utility, where out-of-bounds reads can occur when processing multibyte input with -w/--check-chars. The root cause is in find_field(), which fails to advance the input pointer correctly, inflating the computed length and causin...