@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

Summary @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. An issue exists where, under...

nationstate-cyber-tools

NATION-STATE CYBER WEAPONS ARSENAL Live Web Page: htt...

freerdp:TestFuzzWinPRClipboard: Heap-buffer-overflow in _wcsnlen

Project: https://github.com/FreeRDP/FreeRDP.git Detailed Report: https://oss-fuzz.com/testcase?key=5824412885254144 Project: freerdp Fuzzing Engine: centipede Fuzz Target: TestFuzzWinPRClipboard Job Type: centipedeasanfreerdp Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Addres...

libredwg:llvmfuzz: Heap-double-free in dxf_blocks_read

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=5692626108743680 Project: libredwg Fuzzing Engine: honggfuzz Fuzz Target: llvmfuzz Job Type: honggfuzzasanlibredwg Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x78956c0e01d0 Cra...

libyal:libluksde_volume_fuzzer: Stack-buffer-overflow in libluksde_password_pbkdf2

Detailed Report: https://oss-fuzz.com/testcase?key=5513603281911808 Project: libyal Fuzzing Engine: libFuzzer Fuzz Target: libluksdevolumefuzzer Job Type: libfuzzerasani386libyal Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0xf66f0070 Crash State:...

mruby:mruby_fuzzer: Stack-use-after-return in parser_lex

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5317160201945088 Project: mruby Fuzzing Engine: libFuzzer Fuzz Target: mrubyfuzzer Job Type: libfuzzerasanmruby Platform Id: linux Crash Type: Stack-use-after-return READ 8 Crash Address: 0x7bedc1e3e3c0...

libredwg:llvmfuzz: Heap-buffer-overflow in json_objects_write

Project: https://github.com/LibreDWG/libredwg.git Detailed Report: https://oss-fuzz.com/testcase?key=4506072807964672 Project: libredwg Fuzzing Engine: honggfuzz Fuzz Target: llvmfuzz Job Type: honggfuzzasanlibredwg Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

CVE-2026-13593

A flaw was found in CSS::Minifier::XS. This vulnerability causes a memory leak when the software processes a document containing only characters that are meant to be removed, such as comments and whitespace. If an attacker provides specially crafted input, it could lead to excessive memory usage,...

libyal:libqcow_file_fuzzer: Heap-buffer-overflow in libqcow_internal_file_read_buffer_from_file_io_handle

Detailed Report: https://oss-fuzz.com/testcase?key=6523664565338112 Project: libyal Fuzzing Engine: afl Fuzz Target: libqcowfilefuzzer Job Type: aflasanlibyal Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x77469d0e06d3 Crash State:...

libreoffice:ww6fuzzer: Heap-use-after-free in SwContentIndex::Remove

Project: git://anongit.freedesktop.org/libreoffice/core Detailed Report: https://oss-fuzz.com/testcase?key=5959896152211456 Project: libreoffice Fuzzing Engine: honggfuzz Fuzz Target: ww6fuzzer Job Type: honggfuzzasanlibreoffice Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

ghostscript:gs_device_ljet4_fuzzer: Crash in names_string_ref

Detailed Report: https://oss-fuzz.com/testcase?key=5669830234275840 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdeviceljet4fuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7b2c53aa1da0 Crash State: namesstringref copycspacedi...

PT-2026-53836

Name of the Vulnerable Software and Affected Versions EventON - WordPress Virtual Event Calendar Plugin versions prior to 5.0.12 Description An issue exists where unauthenticated attackers can perform SQL Injection, a technique used to interfere with the queries that an application makes to its...

PT-2026-53812

Name of the Vulnerable Software and Affected Versions Plugin for Google Analytics by IO technologies versions prior to 1.2 Description Cross-Site Request Forgery occurs on the Google Analytics settings page 'ga.php' due to missing or incorrect nonce validation. A nonce is a unique token used to...

PT-2026-53904

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2025.9 and earlier Description An unrestricted upload of files with dangerous types allows for arbitrary code execution in the context of the current user. This issue can be exploited without requiring any user...

PT-2026-54471

Name of the Vulnerable Software and Affected Versions Wp Google Places Review Slider versions prior to 18.2 Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the file admin/partials/googlecrawl dfs.php. The place parameter is URL-decod...

PT-2026-54066

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue in the GPU allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. A sandbox escape is ...

Linux Distros Unpatched Vulnerability : CVE-2026-56017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp...

Security update for perl-Crypt-PasswdMD5 (important)

openSUSE security update: security update for perl-crypt-passwdmd5 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21137-1 Rating: important References: bsc1264705 Cross-References: CVE-2026-6659 Affected Products: openSUSE Leap 16.0...

PT-2026-53808

Name of the Vulnerable Software and Affected Versions PixMagix – WordPress Image Editor versions prior to 1.7.3 Description Authenticated attackers with author-level access and above can write files with controlled content to arbitrary server locations. The issue occurs because the layers.id...

PT-2026-53816

Name of the Vulnerable Software and Affected Versions Export User Data versions prior to 2.2.7 Description Insufficient file path validation in the unserialize function allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server. This occurs when ...