htmLawed - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-314

The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting XSS vulnerability. Only site...

PT-2026-137307

The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting XSS vulnerability. Only site...

PT-2026-134200

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, bit TV to utf8 in src/bits.c can write to the caller-provided src buffer despite accepting const input. On an iconv error other than E2BIG, the function frees its output buffer and passes the original input alias to bit u...

CVE-2026-116620

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

AZL-111712 CVE-2026-116620 affecting package opencc 1.1.1-3

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

DEBIAN-CVE-2026-116620

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

CVE-2026-116620

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

AZL-111134 CVE-2026-116620 affecting package rapidjson 1.1.0-8

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

UBUNTU-CVE-2026-116620

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

EUVD-2026-110567

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

CVE-2026-116620

A security vulnerability exists in Tencent RapidJSON (versions up to 1.1.0 ) within the Regex Parser component. Specifically, the function GenericStringStream<UTF8>::Take in include/rapidjson/stream.h is susceptible to an out-of-bounds read caused by manipulation. This vulnerability can be ...

CVE-2026-116620 Tencent RapidJSON Regex stream.h Take out-of-bounds

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

CVE-2026-116620 Tencent RapidJSON Regex stream.h Take out-of-bounds

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

CVE-2026-116620

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

Tencent RapidJSON buffer error vulnerability

Tencent’s RapidJSON versions 1.1.0 and earlier contain a buffer error vulnerability. This vulnerability stems from improper handling in the GenericStringStream::Take function within the include/rapidjson/stream.h library in the Regex Parser component; it may lead to out-of-bounds reads, allowing...

PT-2026-125543

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The...

Astra Linux – Vulnerability in libtomcrypt

In LibTomCrypt version 1.18.2, the derdecodeutf8string function located in derdecodeutf8string.c does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service such as out-of-bounds reads and crashes or to read information from other...

Rocky Linux 8 [CIQ] Security Update: java-21-openjdk / java-21-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_4573)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20244573 advisory. OpenJDK: RangeCheckElimination array index overflow 8323231 CVE-2024-21147 OpenJDK: potential UTF8 size overflow 8314794 CVE-2024-21131 OpenJDK: Excessive...

Rocky Linux 8 [CIQ] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (crlsa-2024_4563)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20244563 advisory. OpenJDK: RangeCheckElimination array index overflow 8323231 CVE-2024-21147 OpenJDK: potential UTF8 size overflow 8314794 CVE-2024-21131 OpenJDK: Excessive...

AlmaLinux 9.2 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql (ALMALINUX9.2:CLSA-2026:1780519410)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780519410 advisory. - In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present...