CVE-2026-111382 FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

Astra Linux – Vulnerability in poppler, poppler-22

Before version 25.04.0, crafted input files could cause out-of-bounds reads in the JBIG2Bitmap::combine function within JBIG2Stream.cc, due to an improperly placed isOk check...

Security Bulletin: IBM i is Affected by an Improper Validation Vulnerability in zlib [CVE-2026-27171]

Summary Zlib for IBM i is vulnerable to increased CPU consumption when using functions crc32combine64 and crc32combine64gen64 CVE-2026-27171 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-27171 DESCRIPTION: zlib before 1.3.2 allows CPU consumption via...

AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2025:1761261363)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1761261363 advisory. - Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc...

CentOS Linux 7 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-demos / etc (CENTOS7:CLSA-2025:1763139862)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1763139862 advisory. - Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because...

Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2025:1764868919)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1764868919 advisory. - Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc...

AlmaLinux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2025:1764868919)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1764868919 advisory. - Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc...

AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2026:1788270342)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788270342 advisory. - libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc...

AlmaLinux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1787750503)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787750503 advisory. - libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc...

Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1787750503)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787750503 advisory. - libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in...

PT-2026-95735

Name of the Vulnerable Software and Affected Versions Asset CleanUp: Page Speed Booster versions prior to 1.4.0.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via comment content. This enables the...

Astra Linux – Vulnerability in poppler, poppler-22

In Poppler version 24.12.0, the libpoppler.so library contains a out-of-bounds read vulnerability within the JBIG2Stream.cc file’s JBIG2Bitmap::combine function...

USN-8706-1 zlib vulnerability

It was discovered that zlib incorrectly handled negative length parameters in CRC32 combine functions. An attacker could use this issue to cause a denial of service via excessive CPU consumption...

USN-8706-1: zlib vulnerability

It was discovered that zlib incorrectly handled negative length parameters in CRC32 combine functions. An attacker could use this issue to cause a denial of service via excessive CPU consumption...

CVE-2026-19760: Improper Neutralization of Input During Web Page Generation

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-79773: Improper Limitation of a Pathname to a Restricted Directory

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

ROS-20260713-73-0028

The vulnerability of the crc32combine64 and crc32combinegen64 functions in the open-source data compression library zlib relates to the fact that the x2nmodp function may perform right shifts within a loop without a termination condition. Exploiting this vulnerability could allow an attacker to...

Astra Linux – Vulnerability in zlib

Zlib before version 1.3.2 allowed CPU consumption through crc32combine64 and crc32combinegen64, because x2nmodp could perform right shifts within a loop without a termination condition...

EulerOS Virtualization 2.12.0 : zlib (EulerOS-SA-2026-2117)

According to the versions of the zlib package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop th...

CVE-2026-4078

The ITERAS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes iteras-ordering, iteras-signup, iteras-paywall-login, iteras-selfservice in all versions up to and including 1.8.2. This is due to insufficient input sanitization and output escaping in the...