rdx

Android API type and exception facts src/nativeresourcenames.rs contains framework attribute IDs and names from Android SDK 36 data/res/values/public-final.xml, with its source SHA-256 recorded in the generated file. Binary XML uses this catalog to restore framework attribute names and namespaces...

phpmyadmin-vqb-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-vqb-xss phpmyadmin-vqb-xss Class: Stored XSS Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin js/src/designer/history.js builds visual-query history with innerHTML. Column names go through...

CVE-2026-116730

Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker module with a 2A03 instrument note count...

CVE-2026-104596

libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information...

EUVD-2026-110310

The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...

CVE-2026-116467

A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The...

CVE-2026-104591

libosmocore through 1.14.1 contains a buffer overflow in osmoiuupcomputepayloadcrc in src/gsm/iuup.c. This allows a remote attacker to cause a denial of service...

CVE-2026-116467 ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion

A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The...

CVE-2026-116467

The ggml-org llama.cpp project (versions up to 0.7.0 ) contains a security flaw within the Mirostat Sampler component, specifically affecting the src/llama-sampler.cpp file. An attacker can exploit an unknown functionality to trigger a reachable assertion (CWE-617). This vulnerability is potentia...

EUVD-2026-110065

A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The...

CVE-2026-115905

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in...

CVE-2026-115906

The zip library for Rust (versions 0.6.0 through 9.0.0 ) contains a vulnerability in the AES entry reader (src/aes.rs). The component fails to verify the HMAC authentication tag if the archive reaches the end of the stream while the data counter is still positive, or if an encrypted entry lacks a...

EUVD-2026-109917

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacte...

CVE-2026-116258

A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was...

EUVD-2026-109774

A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was...

CVE-2026-116258

A heap-based buffer overflow vulnerability exists in libimobiledevice up to version 1.4.0 . The flaw is located within an unspecified part of the src/afc.c file in the AFC component. This vulnerability can be exploited remotely to cause a buffer overflow. While the exploit is publicly available a...

EUVD-2026-109730

A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack ...

Instatic-Stored-XSS-CVE-2026-103931

URL scheme filter bypass in isSafeUrl via leading C0 control characters Affected: Instatic v0.0.13 / commit 63ad5d6 and all earlier revisions containing src/core/html-sanitize/index.ts Component: src/core/html-sanitize/index.ts → isSafeUrl / safeUrl Class: CWE-79 Stored XSS via CWE-184 Incomplete...

CVE-2026-116372

The MISP mispguard security filtering proxy contains a vulnerability in the process_feed_response method of src/mispguard.py. The software incorrectly assumes that only non-200 HTTP status codes bypass filtering, but it also allows other 2xx status codes (such as 201 , 203 , and 206 ) to pass thr...

CVE-2026-116372 MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules

MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The processfeedresponse method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled t...