CVE-2026-46471

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...

EUVD-2026-102936

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...

CVE-2026-46471

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparseuuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents...

MiracleLinux 8 : rsyslog-8.2102.0-15.el8_10.3 (AXSA:2026-2073:04)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2073:04 advisory. rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd...

CVE-2026-46471

A heap-based buffer overflow vulnerability exists in GStreamer gst-plugins-good versions before 1.28.2 . The issue is located within the isomp4 plugin's qtdemux_parse_uuid function, which may read past the end of a heap-allocated buffer while parsing an MP4 file . This flaw could allow an attacke...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131766)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-131766 advisory. In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix memory leak if ntfsreadmft failed Label ATTRROOT in ntfsreadmft sets isroot = true...

EUVD-2026-102937

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemuxparsechnl function may read past the end of a global array, potentially leading to information disclosure...

CVE-2026-46472

An out-of-bounds read vulnerability exists in GStreamer gst-plugins-good before version 1.28.2 . The flaw is located in the isomp4 plugin's qtdemux_parse_chnl function, which may read past the boundary of a global array while parsing a crafted MP4 media file. A remote attacker could exploit this ...

PT-2026-115336

A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki type can lead to server-side request forgery. It is possible to launch the atta...

PT-2026-115536

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store upload function. This is due to a fail-open extension...

PT-2026-115407

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NO BACKSLASH ESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings...

CVE-2026-109383

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

PT-2026-115422

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the mo by pass login function. This is due to mo delay otp process short-circuiting the authentication flow before password validati...

PT-2026-115432

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribe to email list endpoint accepting an attacker-supplied optin dataform...

PT-2026-115396

The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays popup get user ip function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only...

PT-2026-115338

A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.get modelmeta.custom metadata map of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of th...

CVE-2026-88753

A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service DoS via a crafted Markdown document...

CVE-2026-111152

Game Music Emu libgme through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader getdata function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via...

CVE-2026-111458

The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...

Linux SCTP Verify Function Data Compromise

The vulnerabilities of the functions sctpverifyasconf and sctpverifyparam in the net/sctp/smmakechunk.c component of the Linux kernel are related to insufficient resource control during their existence. Exploiting these vulnerabilities could allow a remote attacker to compromise the confidentiali...