CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-111274

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

CVE-2026-111271

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...

CVE-2026-111272

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image...

CVE-2026-111275

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...

CVE-2026-111269

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the...

CVE-2024-58397

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications li...

CVE-2024-58397

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications li...

CVE-2026-110918

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110918

A memory corruption vulnerability exists in the Core component of Google Chrome prior to version 155.0.8059.84 . A remote attacker can exploit this flaw by having a user visit a crafted HTML page , potentially allowing the attacker to read memory . This issue was addressed in the stable channel u...

CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110918

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110918

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110917

Google Chrome versions prior to 155.0.8059.84 are vulnerable to a memory corruption issue in SVG processing. A remote attacker can exploit this by tricking a user into visiting a crafted HTML page , which may allow the attacker to read memory . The vulnerability is classified as High severity by ...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the zzipparserootdirectory process. An attacker can cause the application to crash by supplying a specially crafted ZIP file with an entry name ending at the central directory end, which triggers a 28-byte ZIP64...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the zzipdiskfindfirst function. An attacker can cause the application to read past the end of a buffer and crash by supplying a specially crafted ZIP central directory structure. Remediation There is no fixed versi...

CVE-2026-111364

The software MinDoc (versions through 2.2-beta.2 ) contains an Insecure Direct Object Reference (IDOR) vulnerability in the DocumentController.Content component. This flaw allows authenticated users with a non-observer role on any book to access and read markdown and HTML content from unauthorize...

CVE-2026-111364 MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch

MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to...