wamr:wamr_fuzz_llvm_jit: Null-dereference READ in ubsan_GetStackTrace

Detailed Report: https://oss-fuzz.com/testcase?key=5126779546435584 Project: wamr Fuzzing Engine: libFuzzer Fuzz Target: wamrfuzzllvmjit Job Type: libfuzzerubsanwamr Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: ubsanGetStackTrace Sanitizer:...

libjpeg-turbo:transform_fuzzer_3_0_x: Null-dereference READ in ubsan_GetStackTrace

Detailed Report: https://oss-fuzz.com/testcase?key=5028022114385920 Project: libjpeg-turbo Fuzzing Engine: libFuzzer Fuzz Target: transformfuzzer30x Job Type: libfuzzerubsanlibjpeg-turbo Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State:...

imagemagick:encoder_ptif_fuzzer: Heap-use-after-free in TIFFFindField

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=4789744106799104 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderptiffuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type: Heap-use-after-free READ 8...

gpac:fuzz_scene: Heap-use-after-free in gf_node_get_attribute_by_tag

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=4575871779536896 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzscene Job Type: aflasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x799fb81e0fe0 Crash State:...

PT-2026-49112

Name of the Vulnerable Software and Affected Versions GALAYOU Y4 version 1.0.0 Description A buffer overflow occurs in the Web Server component due to the manipulation of an unknown function. This issue is exploitable only within the local network. Recommendations At the moment, there is no...

PT-2026-49104

Name of the Vulnerable Software and Affected Versions LiteSpeed cPanel plugin versions prior to 2.4.8 LiteSpeed WHM PlugIn versions prior to 5.3.2.0 Description A privilege escalation issue exists where the software mishandles symbolic links symlinks provided by a user with FTP or web shell acces...

PT-2026-49133

Name of the Vulnerable Software and Affected Versions nanoMODBUS versions prior to 1.23.1 Description The Modbus/TCP server contains an off-by-one buffer overflow in the recv msg header function. Remote unauthenticated attackers can exploit this by sending a crafted MBAP frame with the Length fie...

libxaac:xaac_enc_fuzzer: Heap-buffer-overflow in ixheaace_process

Project: https://github.com/ittiam-systems/libxaac.git Detailed Report: https://oss-fuzz.com/testcase?key=6358997045936128 Project: libxaac Fuzzing Engine: libFuzzer Fuzz Target: xaacencfuzzer Job Type: libfuzzerasanlibxaac Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address:...

imagemagick:encoder_mvg_fuzzer: Heap-buffer-overflow in RenderMVGContent

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=6242201047465984 Project: imagemagick Fuzzing Engine: honggfuzz Fuzz Target: encodermvgfuzzer Job Type: honggfuzzasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 8...

MAL-2026-5751 Malicious code in oh-my-ashclaw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf0a5a6234cbf55718057017cbe143ab41ad1aaf7964ebfaab6dfe12703b005 On npm install, the package's postinstall hook .prepare.cjs executes and harvests installer-side data: hostname, username, OS/arch, Node version, all...

Malicious code in oh-my-ashclaw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf0a5a6234cbf55718057017cbe143ab41ad1aaf7964ebfaab6dfe12703b005 On npm install, the package's postinstall hook .prepare.cjs executes and harvests installer-side data: hostname, username, OS/arch, Node version, all...

Exploit for CVE-2026-42647

CVE-2026-42647 - JoomSport Unauthenticated Time-Based Blind SQ...

suricata:fuzz_sigpcap_aware: Heap-buffer-overflow in PrefilterSetupRuleGroup

Project: https://github.com/OISF/suricata.git Detailed Report: https://oss-fuzz.com/testcase?key=6026694084067328 Project: suricata Fuzzing Engine: honggfuzz Fuzz Target: fuzzsigpcapaware Job Type: honggfuzzasansuricata Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

MAL-2026-5731 Malicious code in houzidawang807 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7568d90e7a8d940b5618fa36bccfc2b7fa02ceaa814f0a416d2cc989c685e489 Package advertises itself as 'a simple date formatting utility' but ships an SSH-key-stealing C2 client. postinstall.js enumerates /.ssh for .pub...

Malicious code in houzidawang807 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7568d90e7a8d940b5618fa36bccfc2b7fa02ceaa814f0a416d2cc989c685e489 Package advertises itself as 'a simple date formatting utility' but ships an SSH-key-stealing C2 client. postinstall.js enumerates /.ssh for .pub...

Malicious code in houzidawang808 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71d6b96fe99e7f8503cb07df05d6b621dc8e8243fc7288844678d8aff043a654 The package presents itself as a 'simple date formatting utility' index.js exports a trivial formatDate wrapper around toLocaleDateString, but ships ...

MAL-2026-5732 Malicious code in houzidawang808 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71d6b96fe99e7f8503cb07df05d6b621dc8e8243fc7288844678d8aff043a654 The package presents itself as a 'simple date formatting utility' index.js exports a trivial formatDate wrapper around toLocaleDateString, but ships ...

Malicious code in houzidawang806 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dbf603db6d0a3434c6c417dd460f26d08b9e230c03926f05987bb3841d3c72b Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. 1 postinstall.js enumerates /.ssh/ for .pub...

MAL-2026-5729 Malicious code in houzidawang806 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dbf603db6d0a3434c6c417dd460f26d08b9e230c03926f05987bb3841d3c72b Package self-describes as 'A simple date formatting utility' but ships two distinct attacker primitives. 1 postinstall.js enumerates /.ssh/ for .pub...

PT-2026-49096

Name of the Vulnerable Software and Affected Versions glances affected versions not specified Description The secure popen function in glances/secure.py improperly interprets shell-like operators, specifically file redirection, | pipe, and && command chaining, within command strings. When...