CVE-2026-85234

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring function. This leads to out-of-bounds read/write operations. A remote, unauthenticated...

CVE-2026-85234

A flaw was found in tftp-hpa. When the "in.tftpd" remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the "genmatchstring" function. This leads to out-of-bounds read/write operations. A remote, unauthenticated...

tidy-html5:tidy_general_fuzzer: Crash in tidy_general_fuzzer

Project: https://github.com/htacg/tidy-html5.git Detailed Report: https://oss-fuzz.com/testcase?key=5244629235335168 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidygeneralfuzzer Job Type: libfuzzerubsantidy-html5 Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

EUVD-2026-79123

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...

CVE-2026-40058 Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for Windows

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...

CVE-2026-40058 Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for Windows

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...

CVE-2026-40058

CrowdStrike Falcon sensor for Windows is affected by a vulnerability in the Microsoft Office File Malicious Macro Removal policy setting that allows an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation . The flaw requires t...

CVE-2026-18115

Concrete CMS versions 9.2.0 through 9.5.2 fail to enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password). An authenticated user holding an update-scoped OAuth token and permission to ...

EUVD-2026-78913

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/changepassword. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could...

AZL-103140 CVE-2026-79699 affecting package containerized-data-importer 1.62.0-8

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...

CVE-2026-44300

OpenCost (a Kubernetes cost-monitoring tool) versions prior to 1.121.0 contain an Improper Access Control flaw in the POST /serviceKey endpoint (pkg/costmodel/router.go ). The endpoint invokes AddServiceKey without mandatory authentication, allowing an unauthenticated network client to submit an ...

CVE-2026-63443

Coder (a Terraform-based remote development environment provisioner) is affected by an insecure redirect handling flaw in agentConn.apiClient(). The client used the default http.Client redirect behavior while its custom transport dialed the host from the request URL whenever the port matched the ...

CVE-2026-63443 Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API por...

DEBIAN-CVE-2026-91951

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urbsendcurrentframenumberresult function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-byte buffer, causing denia...

CVE-2026-91951

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urbsendcurrentframenumberresult function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-byte buffer, causing denia...

DEBIAN-CVE-2026-91948

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

CVE-2026-91948

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

CVE-2026-91940

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filteruntrustedfields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious imagesavedir paths to write attacker-controlled...

CVE-2026-91934

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...

CVE-2026-55828

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...