EUVD-2026-102968

Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap...

CVE-2026-111677

The software Antiword through 0.37 contains a heap out-of-bounds read vulnerability within the vGet8LstInfo function in prop8.c . This issue is caused by an inverted bounds check on the PlcfLst record count. An attacker can trigger the vulnerability by providing a crafted Word 8 .doc file that cl...

CVE-2026-111677 Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstInfo in prop8.c

Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap...

DEBIAN-CVE-2026-57486

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNodecompare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocumentcreateAttribute...

CVE-2026-57486

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNodecompare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocumentcreateAttribute...

EUVD-2026-102928

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNodecompare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocumentcreateAttribute...

CVE-2026-57486 pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNodecompare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocumentcreateAttribute...

CVE-2026-57486

The pupnp SDK for UPnP development applications is vulnerable to a NULL pointer dereference in ixml/src/node.c prior to version 2.0.2 . The ixmlNode_compare function incorrectly passes nullable fields (such as nodeValue, namespaceURI, prefix, and localName) of non-namespaced attributes directly t...

CVE-2026-57486 pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNodecompare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocumentcreateAttribute...

EUVD-2026-102529

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

UBUNTU-CVE-2026-111270

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...

UBUNTU-CVE-2026-109449

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property access...

UBUNTU-CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

Linux Distros Unpatched Vulnerability : CVE-2026-111274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse- zip.c due to an incorrect ZIP64 extra field length check...

Linux Distros Unpatched Vulnerability : CVE-2026-111273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname in tar/parse- tar.c, reachable through the arentrygetname API. Attackers can...

PT-2026-116076

Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap...

CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

DEBIAN-CVE-2026-111270

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...

CVE-2026-111274

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

Summary kin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader resolves circular $refs on purpose to support recursive data structures, and Schema.validate uses stack-based cycle detection. Validate therefore accepts a schema whose allOf / anyO...