CVE-2026-59931

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-59931: Server-Side Request Forgery (SSRF)

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

PT-2026-65485

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto , were not handled as ordina...

CVE-2026-51259

The CVE-2026-51259 entry has concrete details in connected sources: the vulnerability is an unchecked unsigned integer overflow in buffer size calculation within the schreibfaul1 ESP32-audioI2S 3.4.5 product. This overflow causes an undersized PSRAM buffer allocation, which in turn leads to heap ...

TSIG packet with name compression can crash DNS

== Summary: Incorrect size calculations when a TSIG record contains compressed names can lead to a large out-of-bounds write causing the server to crash. Description To calculate the size of a DNS packet region signed by a TSIG record, Samba's internal DNS server subtracted the presumed size of t...

CVE-2026-51259

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Siemens SIMATIC S7-1500 CPU 1518 MFP Incorrect Calculation of Buffer Size (CVE-2026-31515)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505565; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Incorrect Calculation of Buffer Size (CVE-2026-31416)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505684; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2026-64272

In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S and MMS136 touch controllers have an event size of 6 bytes rather than 8 bytes. When mms114readreg reads the touch data packet from the device into the touch...

CVE-2026-64357 xfs: fix exchmaps reservation limit check

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchmaps reservation limit check xfsexchmapsestimateoverhead adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINTMAX check still tests req-resblks. That is the reservation value from before t...

CVE-2026-64272

Summary of CVE-2026-64272 : A bug in the Linux kernel MMS114 touch screen driver misreads touch data because it assumed 8-byte events, while MMS134S/MMS136 report 6-byte events. The driver loops over events using an 8-byte step (sizeof(struct mms114_touch)) but the actual packet size is 6 bytes p...

EUVD-2026-48585

Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...

PT-2026-64421

Name of the Vulnerable Software and Affected Versions GPU DDK affected versions not specified Description An integer overflow occurs during the calculation of physical offsets for sparse PMRs Partial Memory Regions within the PMRLogicalOffsetToPhysicalOffset function. For PMRs larger than 4 GB,...

CVE-2026-45812: Incorrect Calculation of Buffer Size

Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...

CVE-2026-29007

A flaw was found in U-Boot. A remote attacker can exploit an out-of-bounds read vulnerability in the tcprxstatemachine function when the Transmission Control Protocol TCP is enabled. By crafting a malicious packet with a mismatched IP total length and TCP data offset, an attacker can read beyond...

PYSEC-2026-3496 Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Summary src/libImaging/Jpeg2KDecode.c:853 accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recomputing it per tile. That accumulated value is then used in the tilebytes calculation at src/libImaging/Jpeg2KDecode.c:868, which can make the decoder grow state-buffer v...

CVE-2026-64009

A flaw was found in the Linux kernel's xfrm IPSec framework component. A local, unprivileged user can trigger an integer underflow in the Encapsulating Security Payload ESP module's Maximum Transmission Unit MTU calculation. This underflow leads to a severe out-of-bounds write, which can cause...

The vulnerability of the webService() method in the Calculation/Web/Service.php PHP library allows a attacker to perform an SSRF attack.

The vulnerability of the webService method in the Calculation/Web/Service.php PHP library of the PhpSpreadsheet framework is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...