190319 matches found
CVE-2026-111935
NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...
CVE-2026-112279
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processbmpcache2 in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble an...
CVE-2026-112277
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processplane in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs o...
CVE-2026-112273
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::composename in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority...
UBUNTU-CVE-2026-111925
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
CVE-2026-112274
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soarecord::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causin...
UBUNTU-CVE-2026-112277
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processplane in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs o...
UBUNTU-CVE-2026-112279
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processbmpcache2 in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble an...
CVE-2026-111925
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...
UBUNTU-CVE-2026-112273
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::composename in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority...
UBUNTU-CVE-2026-112276
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent...
CVE-2026-112282
VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpiaccesspoint that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with numepfine set to zero and an...
UBUNTU-CVE-2026-112282
VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpiaccesspoint that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with numepfine set to zero and an...
UBUNTU-CVE-2026-112278
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processrawbmpcache in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy to read past...
UBUNTU-CVE-2026-112274
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soarecord::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causin...
CVE-2026-112276
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent...
CVE-2026-112278
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processrawbmpcache in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy to read past...
CLSA-2026-1785774324 libpng: Fix of 2 CVEs
CVE-2025-64506: fix heap buffer over-read in pngwriteimage8bit when 8-bit input is written with the convertto8bit flag set...
CVE-2026-112292 CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...
CVE-2026-112292
Versions of CheckCle through 1.6.0 are vulnerable to a missing authorization vulnerability (CWE-862) because the shipped PocketBase collections use empty API rules. This flaw allows unauthenticated attackers to query /api/collections//records endpoints to read, modify, or delete records. Potentia...