PT-2026-80552

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted image file. An...

EUVD-2026-55235

A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...

EUVD-2026-54208

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior...

CVE-2026-3415

CVE-2026-3415 affects WSO2 products where the SchemaValidator Mediator processes XML input during validation. The XML parser may resolve external entities under certain crafted payloads, enabling an attacker with sufficient privileges to read files on the server and possibly cause outbound reques...

CVE-2026-3415 XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior...

CVE-2026-64640 Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially crafted HTML page...

UBUNTU-CVE-2026-19026

H5Zfilternbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

Exploit for CVE-2026-15430

AxHunter PoCs for Wellbia XIGNCODE3 anti-cheat xhunter driv...

CVE-2026-15918 VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection

VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization...

CVE-2026-67862

A flaw was found in open62541. A buffer-overflow vulnerability exists in the high-level attribute reading logic. This flaw allows a remote attacker to trigger a denial of service, making the affected system unavailable...

CVE-2026-67862

open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/uaclienthighlevel.c. This allows a remote attacker to cause a denial of service...

CVE-2026-67862

open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/uaclienthighlevel.c. This allows a remote attacker to cause a denial of service...

CVE-2026-67862

open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/uaclienthighlevel.c. This allows a remote attacker to cause a denial of service...

CVE-2026-67862

The open62541 C-based library (version 1.5.5 ) contains a buffer-overflow vulnerability within the high-level attribute reading logic, specifically located in src/client/ua_client_highlevel.c. This flaw enables a remote attacker to trigger a denial of service (DoS) , rendering the affected system...

CVE-2026-67862

open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/uaclienthighlevel.c. This allows a remote attacker to cause a denial of service...

GHSA-FXQJ-RQCC-2CMP PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Summary The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile that restricts an attacker-controlled sourceMappingURL from a CSS comment to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is...

CVE-2026-18092

Perl's Net::SAML2 versions before 0.86 are vulnerable to a SAML authentication bypass via XML signature wrapping . The root cause is that the new_from_xml function retrieves identity fields (such as NameID and attributes) using document-wide XPath queries instead of restricting the search to the ...

JLSEC-2026-1065 ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability...

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy...

MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

Summary The stdio transports in MCP::Server::Transports::StdioTransport and MCP::Client::Stdio read newline-delimited JSON-RPC frames using IOgets with no limit argument. CRuby's IOgets with no limit reads from the current position until the next separator \n with no upper bound on the returned...