CVE-2026-23530 FreeRDP has heap-buffer-overflow in planar_decompress_plane_rle

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,freerdpbitmapdecompressplanar does not validate nSrcWidth/nSrcHeight against planar-maxWidth/maxHeight before RLE decode. A malicious server can trigger a client‑side heap buffer overflow, causing a crash DoS...

UBUNTU-CVE-2026-0943

HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability. Versions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hbsrc.tar.gz in the source tarball, which is affected by CVE-2026-22693...

CVE-2026-0943

The HarfBuzz::Shaper Perl module, versions before 0.032 , is vulnerable to a null pointer dereference because it bundles HarfBuzz 8.4.0 or earlier (as hb_src.tar.gz) which is affected by CVE-2026-22693 . This issue is present in several Linux distributions, including Fedora . To remediate, users ...

CVE-2026-0943 HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability

HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability. Versions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hbsrc.tar.gz in the source tarball, which is affected by CVE-2026-22693...

Prime security vulnerabilities

Prime is a content management system developed by Birkir Gudjonsson. Versions of Prime prior to 0.4.0.beta.0 contained security vulnerabilities, which were caused by incorrect operations on the /graphql file. These vulnerabilities could lead to denial-of-service attacks...

Pterodactyl Panel security vulnerabilities

Pterodactyl Panel is an open-source game server management panel developed by Pterodactyl. Versions of Pterodactyl Panel prior to 1.12.0 contained security vulnerabilities. These vulnerabilities stemmed from resource limit verification occurring early in the request cycle and failing to lock down...

Whisper Money security vulnerability

Whisper Money is an open-source personal finance application developed by Whisper Money. Versions of Whisper Money prior to 0.1.5 contained a security vulnerability caused by insecure direct object references, which could allow users to update or create bank account balances for other users...

mpay security vulnerability

MPay is a convenient payment tool developed by Technic Laohu in China. Versions of MPay prior to 1.2.4 contained security vulnerabilities. These vulnerabilities were caused by incorrect operations on unknown functions, which could lead to cross-site request forgery attacks...

PT-2026-3420

Name of the Vulnerable Software and Affected Versions HarfBuzz::Shaper versions prior to 0.032 Description HarfBuzz::Shaper versions before 0.032 include a bundled library with a null pointer dereference issue. The vulnerable component is HarfBuzz 8.4.0 or earlier, packaged as hb src.tar.gz withi...

PT-2026-3449

Name of the Vulnerable Software and Affected Versions Automation Studio versions prior to 6.5 Description An Improper Certificate Validation issue exists in the OPC-UA client and ANSL over TLS client. This could allow an unauthenticated attacker on the network to intercept and interfere with data...

Devolutions Server security vulnerabilities

Devolutions Server is an application system developed by the Canadian company Devolutions. It provides a fully functional solution for shared accounts and password management. Versions of Devolutions Server prior to 2025.3.12 contained a security vulnerability due to SQL injection vulnerabilities...

PT-2026-3500

Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create account balances in other users' bank accounts. Version 0.1.5 fixes the issue...

SiYuan path traversal vulnerability

SiYuan is a privacy-oriented personal knowledge management system developed by SiYuan. Versions of SiYuan prior to 3.5.4 contained a path traversal vulnerability. This vulnerability stemmed from a logical flaw in the/api/file/globalCopyFiles endpoint, which lacked proper path validation. As a...

Movary cross-site scripting vulnerabilities

Movary is a film review program developed by Lee Peuker personally. Versions of Movary prior to 0.70.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from insufficient input validation for the categoryUpdated parameter, which could lead to cross-site scripting attacks...

Movary cross-site scripting vulnerabilities

Movary is a film review program developed by Lee Peuker personally. Versions of Movary prior to 0.70.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from insufficient input validation for the categoryCreated parameter, which could lead to cross-site scripting attacks...

MyTube security vulnerability

MyTube is a video self-hosting downloader and player developed by Peifan Li. Versions of MyTube prior to 1.7.66 contained security vulnerabilities. These vulnerabilities stemmed from the authentication check implemented by roleBasedAuthMiddleware, which could be bypassed, allowing unverified user...

QuickJS security vulnerabilities

QuickJS is a small and embeddable JavaScript engine developed by the QuickJS open-source project. Versions of QuickJS prior to 0.11.0 contain security vulnerabilities. These vulnerabilities stem from incorrect operations on the function jstypedarrayconstructorta in the file quickjs.c, which may...

CVE-2026-0517

CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially crafted packet to a server and cause the server to crash...

CVE-2026-0518

CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileges can interfere with another administrator’s use of the console...

Clay code issues and vulnerabilities

Clay is a high-performance UI layout library developed by Nic Barker personally. Versions of Clay prior to 0.14 contained code vulnerabilities; these vulnerabilities stemmed from a null pointer dereferencing in the ClayMeasureTextCached function within the clay.h library, which could lead to loca...