118049 matches found
DEBIAN-CVE-2026-70630
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...
DEBIAN-CVE-2026-70629
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...
CVE-2026-70633
TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray...
CVE-2026-64677
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...
DEBIAN-CVE-2026-64677
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...
CVE-2026-43630
llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious slot file with a...
CVE-2026-3415
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior...
CVE-2026-19054
A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument...
CVE-2026-19059
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendo...
CVE-2026-11803
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...
NPM: node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
NPM: node-re2: Out-of-bounds heap read in replace/split via a Buffer ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript vulnerability discovered by ? in WordPress Npm re2 versions = 1.26.0...
CVE-2026-71498
CVE-2026-71498 affects node-re2, the RE2 bindings for Node.js. Before version 1.26.1, passing a Buffer whose final bytes form a truncated multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while decoding the final code point, leading to an out-of...
CVE-2026-70630
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...
CVE-2026-70630 FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...
CVE-2026-70630
FFmpeg versions 3.0 up to (but not including) 9.0 are affected by an uninitialized heap memory read in the native Screenpresso decoder (libavcodec/screenpresso.c). The vulnerability arises when screenpresso_decode_frame() does not validate the byte count before copying from ctx->inflated_buf, ...
CVE-2026-70630 FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...
CVE-2026-70629
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...
CVE-2026-61632
CVE-2026-61632 affects PyMdown Extensions (b64 extension) up to version 10.21.3. The b64 code path in pymdownx/b64.py joins the attacker-controlled image src onto a configured base_path (or uses an absolute path) and opens the result without ensuring the resolved path stays inside base_path, allo...
glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...
CVE-2026-19146
Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...