190376 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-111133
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via craft...
PT-2026-115645
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder decodeLength...
UBUNTU-CVE-2026-111133
libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...
Red Hat: CVE-2026-62438: gimp: gimp: PAA integer overflow out-of-bounds read
A flaw was found in GIMP. An attacker can cause a Denial of Service DoS or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive PAA texture file. Due to an integer overflow when calculating image dimensions during file...
CVE-2026-46472: Out-of-bounds Read
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...
Red Hat: CVE-2026-46471: gstreamer1-plugins-good: gstreamer1-plugins-good: information disclosure via out-of-bounds read during MP4 parsing
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...
UBUNTU-CVE-2026-111274
unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...
UBUNTU-CVE-2026-111140
libregf through 20260526 contains a heap out-of-bounds read in libregfvalueitemreadvaluedata because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacen...
CVE-2026-46472
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...
Apache Doris 4.1.5 JDBC Catalog Arbitrary File Read
Apache Doris version 4.1.5 JDBC catalog handling permits an attacker-controlled MySQL server to request arbitrary local files from the Frontend host through the MySQL driver's LOCAL INFILE support. The proof of concept demonstrates the issue. !/usr/bin/env python Apache Doris 4.1.5 JDBC Catalog...
CVE-2026-111677: Out-of-bounds Read
Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap...
CVE-2026-68907: Out-of-bounds Read
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtilscopyStringToBuffer while constructing an MMSASSOCIATIONSPECIFIC...
Apache Doris 4.1.5 JDBC Catalog Arbitrary File Read
Summary Apache Doris is a high-performance, real-time analytical database based on the MPP architecture. Known for being efficient, simple, and unified, it returns query results over massive datasets within sub-second latency, and a single system supports both high-concurrency point queries and...
PT-2026-115909
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc info plugin could be confused by a query containing embedded null bytes. Reading information schema.query cache info after such a query was cached could...
CVE-2026-111689: Authorization Bypass Through User-Controlled Key
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/departmentId with arbitrary department ids to retrieve usernames,...
PT-2026-115924
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a craft...
PT-2026-116034
šØ CVE-2026-111635 Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an...
EUVD-2026-102937
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...
CVE-2026-111722: Authorization Bypass Through User-Controlled Key
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id ...
Adobe Substance 3D Designer <= 16.0.5 Multiple Vulnerabilities (APSB26-169)
The version of Adobe Substance 3D Designer installed on the remote host is prior or equal to 16.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-169 advisory. - Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in...