CVE-2026-117610

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

CVE-2020-11019

CVE-2020-11019 In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOGTRACE", a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. authentication| complexity|...

CVE-2026-117610

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

CVE-2026-117610

The libexpat library (versions through 2.9.0 ) is vulnerable to a NULL pointer dereference in the externalEntityInitProcessor2() function within lib/xmlparse.c. The flaw occurs because the software mishandles the XML_TOK_NONE token when processing empty input. An attacker capable of controlling s...

CVE-2026-117610 libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

CVE-2026-117610 libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

EUVD-2026-111545

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

PT-2026-127734

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XML TOK NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causi...

AZL-111188 CVE-2026-117556 affecting package zchunk 1.3.2-1

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in readpreface in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing read...

EUVD-2026-110834

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in readpreface in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing read...

PT-2026-126415

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read preface in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing rea...

PT-2026-125477

Name of the Vulnerable Software and Affected Versions libfvde versions prior to 20260924 Description A heap out-of-bounds read occurs in the libfvde encrypted metadata read type 0x0024 function because the xml plist data size variable is not validated against the source metadata block. An attacke...

PT-2026-125482

Name of the Vulnerable Software and Affected Versions flatcc versions prior to 0.6.5 Description An out-of-bounds read occurs in the flatcc json parser number function when processing numbers that end with a decimal point. An attacker can provide untrusted JSON data that terminates immediately...

PT-2026-125475

Name of the Vulnerable Software and Affected Versions gbsplay versions 0.0.1 through 0.0.103 Description A heap out-of-bounds read occurs in the gbr open function within gbs.c because the software fails to verify the file length before scanning the GBR ROM title field. An attacker can provide a...

PT-2026-125479

Name of the Vulnerable Software and Affected Versions Furnace versions prior to 0.6.8.4 Description An out-of-bounds heap read occurs during the import of FamiTracker modules .ftm, .dnm, or 0CC/E-FamiTracker. The issue is triggered by an unbounded DPCM note count in the DivEngine::loadFTM functio...

NULL Pointer Dereference

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

NULL Pointer Dereference

Overview Magick.NET-Q16-HDRI-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

NULL Pointer Dereference

Overview Magick.NET-Q16-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

CVE-2026-115383

A flaw was found in Wasmtime. This vulnerability allows an untrusted guest module to cause a Denial of Service DoS by triggering a host application crash. When the WebAssembly exceptions feature is enabled, Wasmtime improperly validates imported tags that use subtypes of expected types. A malicio...

Security Bulletin: IBM Guardium Data Protection is affected by a security vulnerability (CVE-2025-10911)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2025-10911 DESCRIPTION: A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash...