CVE-2026-108434

An out-of-bounds read vulnerability exists in Microsoft Office Word , which may allow an unauthorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 base score of 6.5 (Medium) , with high confidentiality impact and low attack complexity. Official remediation is ...

EUVD-2026-102446

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-111142

A flaw was found in zziplib. An out-of-bounds read vulnerability allows an attacker to cause a Denial of Service DoS by crashing the application. By supplying a specially crafted ZIP archive with a malformed central directory, an attacker can force the library to read past allocated memory buffer...

CVE-2026-111141

A flaw was found in zziplib. An attacker could exploit this vulnerability by providing a specially crafted ZIP archive to an application utilizing the library. An ineffective bounds check during the parsing of the central directory causes the library to read past allocated memory, resulting in an...

CVE-2026-111132

A flaw was found in libgxps. An attacker can exploit this vulnerability by convincing a user to open a specially crafted XML Paper Specification XPS document containing malformed curve segment attributes. Successful exploitation triggers an out-of-bounds memory read, primarily causing an...

CVE-2026-111125

A flaw was found in cfitsio. A heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decompression logic allows an attacker who tricks a user or system into processing a crafted Flexible Image Transport System FITS file with oversized tile dimensions to read beyond allocated memory...

CVE-2026-111124

A flaw was found in cfitsio. An attacker could exploit this vulnerability by supplying a specially crafted Flexible Image Transport System FITS file containing compressed image data with invalid dither parameters. When processed by an application using the library, this flaw triggers an...

CVE-2026-105037

EnergizeLab station-middleware (NestJS) Docker images, specifically versions 1.6.5 through 1.8.2 , are vulnerable to an authenticated path traversal vulnerability. A registered, low-privilege account can read arbitrary files from the server by providing an attacker-controlled file path. This flaw...

CVE-2026-105037 EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

CVE-2026-105037 EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

EUVD-2026-102433

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

CVE-2026-110656

A flaw was found in miniupnpc. An adjacent attacker can cause a Denial of Service DoS due to an out-of-bounds read vulnerability in the XML parser's namespace handling. A malicious or spoofed Universal Plug and Play UPnP gateway on the local network can exploit this flaw by sending a crafted devi...

CVE-2026-110655

A flaw was found in miniupnpc. An out-of-bounds read vulnerability in the XML attribute parser can lead to a Denial of Service DoS by crashing the client application. A network-adjacent attacker operating a rogue Universal Plug and Play UPnP gateway can exploit this by sending specially crafted...

CVE-2026-111234

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

CVE-2026-111230

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

CVE-2026-111171

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because checkipblocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA record...

DEBIAN-CVE-2026-111166

libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMFLoad loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex...

DEBIAN-CVE-2026-111165

libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTMLoad because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and...

CVE-2026-111167

GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acdsprivate that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property...

CVE-2026-111165

libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTMLoad because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and...