CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

UBUNTU-CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 are vulnerable to a path traversal vulnerability within the files view. The root cause is the improper validation of the path parameter before it is passed to the output_file function. This allows authenticated users with Events view permission to read arb...

CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2026-101205 FastStone Image Viewer PCX Decoder out-of-bounds

A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds read. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-101205

A vulnerability exists in FastStone Image Viewer up to version 8.3 . The issue resides within an unknown function of the PCX Decoder component, where specific manipulation can trigger an out-of-bounds read . This attack can be initiated remotely . No specific remediation or exploit details are pr...

CVE-2026-101205 FastStone Image Viewer PCX Decoder out-of-bounds

A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds read. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-101204 FastStone Image Viewer TGA Image FSViewer.exe out-of-bounds

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure bu...

CVE-2026-101204 FastStone Image Viewer TGA Image FSViewer.exe out-of-bounds

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure bu...

CVE-2026-101204

A vulnerability exists in FastStone Image Viewer up to version 8.3 within the TGA Image Handler component. Specifically, an unknown function in FSViewer.exe is susceptible to an out-of-bounds read . This flaw can be triggered via a remote attack . While the base severity is rated as Medium , the ...

CVE-2026-91096

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams WebTransportImpl::destroy in releases before v2025.08.18.00 failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read...

CVE-2026-18416

The CoAP link-format helper matchpathuri in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing ...

CVE-2026-97025 Flatpak: flatpak: world-readable oci authentication token in system-helper cache path

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

EUVD-2026-88545

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams WebTransportImpl::destroy in releases before v2025.08.18.00 failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read...

CVE-2026-91096

A flaw in proxygen (versions v2024.10.28.00 until v2026.09.28.00) allows a use-after-free condition. The WebTransportImpl::terminateSessionStreams function (or WebTransportImpl::destroy in releases before v2025.08.18.00) fails to unregister read callbacks for closed streams before destroying them...

CVE-2026-91096

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams WebTransportImpl::destroy in releases before v2025.08.18.00 failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read...

K000163437: Vim vulnerabilities CVE-2026-28420, CVE-2026-28421, and CVE-2026-28422

Security Advisory Description CVE-2026-28420 Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes...

CVE-2026-97529

A flaw was found in the Linux kernel's qla2xxx driver. The driver fails to validate the length of vendor-specific request buffers before reading command data, resulting in an out-of-bounds read from heap memory. A local user with administrative privileges can exploit this flaw by submitting a...