EUVD-2026-52275

SiYuan: Full-content disclosure of publish-disabled documents via getHeadingTransaction endpoints publish mode: reader-reachable rendered DOM with no publish-access check...

EUVD-2026-52279

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure...

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

CVE: This vulnerability corresponds to CVE-2026-69086. Summary Four attribute-view read endpoints build a filesystem path from a caller-controlled id/avID and read it without confining the result to the attribute-view storage directory DataDir/storage/av/. On the load file-exists code path there ...

CVE-2026-84851

CVE-2026-84851 is an uncontrolled recursion vulnerability in the Ion reader component of Amazon Ion-C , affecting versions before 1.1.6 . A remote, unauthenticated attacker can craft malicious Ion data that exhausts the native call stack, causing a denial of service in any application using the l...

CVE-2026-84851 Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

CVE-2026-84851 Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

CVE-2026-84851 Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service...

CVE-2026-84852

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally...

CVE-2026-84852 Reader Tools PDF Reader App File ActSplashNew.handleDeeplink path traversal

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally...

CVE-2026-84852

A path traversal vulnerability exists in Reader Tools PDF Reader App version 98.8 for Android. The flaw resides in the ActSplashNew.handleDeeplink function of the File Handler component, where manipulation of the _display_name argument allows local path traversal. The attack requires local access...

EUVD-2026-70259

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally...

NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...

CVE-2026-84852: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally...

PT-2026-84866

Name of the Vulnerable Software and Affected Versions Reader Tools PDF Reader App version 98.8 Description A path traversal issue exists within the File Handler component. This occurs when the display name argument is manipulated in the ActSplashNew.handleDeeplink function, allowing a local...

PT-2026-84366

Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to b5694 Description A reachable assertion exists within the gguf reader::read function. An assertion is a check used during development to ensure that the program state is correct; a reachable assertion means a specif...

Alibaba Cloud Linux 3 : 0258: libarchive (ALINUX3-SA-2026:0258)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0258 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-14164: A double free issue has been...

CVE-2026-52131

llama.cpp versions b5693 and before are affected by a Reachable Assertion vulnerability located within the gguf_reader::read function. While several Linux distributions have identified this vulnerability, some reports indicate that a vendor-supplied patch may not be available for certain affected...

FreeRDP: FreeRDP: Denial of Service via null pointer dereference in smartcard cleanup

A null pointer dereference flaw in FreeRDP allows a remote attacker to cause a denial of service DoS via specially crafted smartcard requests. If reader-state decoding fails, the system attempts to free uninitialized states during cleanup, resulting in a process crash...

[SECURITY] [DLA 4762-1] libarchive security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4762-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 31, 2026 https://wiki.debian.org/LTS -...

Linux Distros Unpatched Vulnerability : CVE-2024-58378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri before 1.15.6 and 1.16.x before 1.16.2 CRuby, when using the packaged libxml2 is affected by a use-after-free vulnerability in libxml2 CVE-2024-25062 i...