CVE-2026-119729: Red Hat: A flaw was found in GStreamer

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker...

CVE-2026-104067: Scribus: Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify…

Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code...

CVE-2026-119727: Red Hat: A flaw was found in GStreamer's gst-plugins-bad H.265 video parser

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding SCC extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accep...

PT-2026-133508

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization that allows attackers to crash the host process via count over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK PLUS expressions...

PT-2026-133622

Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code...

CVE-2026-117184: n/a: An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a…

An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service DoS via a crafted POST request to the GraphQL endpoint...

PT-2026-133552

tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into...

CVE-2026-119762: Axigen Axigen Mail Server: Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial…

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request t...

CVE-2026-61847: rgrove crass: Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preservecomments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a ve...

CVE-2026-61848: rgrove crass: Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS...

CVE-2026-119591: SQLite: SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to…

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization that allows attackers to crash the host process via count over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TKPLUS expressions who...

PT-2026-133455

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE LIMIT EXPR DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in a...

PT-2026-133620

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing...

CVE-2026-111487: qt Qt Framework: An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module...

PT-2026-133553

AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af get page that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the...

CVE-2026-104061: Scribus: Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses…

Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloaderpsd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code...

CVE-2026-117184

Traggo server v0.8.3 (commit 6321119c3c2d55f04e2e4967f6492aabd6067b76) is vulnerable to an unauthenticated Denial of Service (DoS) via GraphQL alias overloading. The GraphQL endpoint (/graphql) fails to enforce complexity limits or request body size limits , and the version field lacks an authent...

CVE-2026-61627: libass: libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in wraplinesmeasure while rendering malicious ASS content. In wrap modes other than two, a final line ending with a...

CVE-2026-119365: bPlugins Media Player Addons for Elementor – Media Player widget for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widge...

PT-2026-133616

Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code...