CVE-2026-58082

The ISO-2022 encoding module in FreeBSD's iconv(3) allocates a 6-byte stack buffer (MB_LEN_MAX) but some variants require up to 10 bytes per character, causing up to a 4-byte stack overflow. Affects all supported FreeBSD versions; patched in stable/14 and stable/15 branches on 2026-06-30. No work...

EUVD-2026-62349

The ISO-2022 encoding module used a stack buffer sized to MBLENMAX 6 bytes for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to four bytes. An application that uses iconv3 to...

CVE-2026-58081

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv3 to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer...

PT-2026-78556

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-75936

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...

surfio has an out-of-bounds read

Impact Prior to version 0.0.19, surfio would not correctly validate size fields in irap files, leading to a buffer overflow . The severity rating assumes that surfio is used to parse untrused files in a networking context such as a web service. Patches The bug has been patched in version 0.0.19...

CVE-2026-75936 Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...

CVE-2026-71880 Server-side template injection in Integrated Publishing Toolkit

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection...

CVE-2026-71880 Server-side template injection in Integrated Publishing Toolkit

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection...

CVE-2026-71226 affecting package libkcapi for versions less than 1.5.1-1

CVE-2026-71226 affecting package libkcapi for versions less than 1.5.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-15371 Velociraptor Stored XSS in URL column types

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...

MINI-X99W-6QH7-QVJR

Bulletin has no description...

CVE-2026-74876

In openssl_encrypt before 1.4.0, PublicKeyBundle.from_dict() accepts untrusted key bundle data without signature verification. Attackers can craft a malicious bundle, call to_identity(), and encrypt secrets to an attacker-controlled public key, enabling confidential data exfiltration. CVSS 9.8 cr...

BIT-DOTNET-2026-62902 .NET Information Disclosure Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network...

BIT-DOTNET-SDK-2026-62902 .NET Information Disclosure Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network...

Important: perl-Date-Manip

Issue Overview: Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit...

CVE-2026-74788

Scriban before 7.0.0 affected versions = 6.6.0 contains an uncontrolled memory allocation vulnerability in the string.padleft and string.padright template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes...

EUVD-2026-59958

Scriban before 7.0.0 affected versions = 6.6.0 contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path ParseArrayInitializer → ParseExpression → ParseArrayInitializer that is not covered by the ExpressionDepthLimit count...

CVE-2026-74792 Scriban before 7.0.0 Stack Overflow via nested array initializers

Scriban before 7.0.0 affected versions = 6.6.0 contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path ParseArrayInitializer → ParseExpression → ParseArrayInitializer that is not covered by the ExpressionDepthLimit count...

CVE-2026-74788

Scriban before 7.0.0 affected versions = 6.6.0 contains an uncontrolled memory allocation vulnerability in the string.padleft and string.padright template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes...