gpac:fuzz_scene: Heap-use-after-free in ReplaceDEFNode

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6669904425320448 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzscene Job Type: aflasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x77d1a8ce0100 Crash State:...

tdengine:sql-fuzzer: Stack-buffer-overflow in MurmurHash3_32

Detailed Report: https://oss-fuzz.com/testcase?key=6521509010276352 Project: tdengine Fuzzing Engine: libFuzzer Fuzz Target: sql-fuzzer Job Type: libfuzzerasantdengine Platform Id: linux Crash Type: Stack-buffer-overflow READ 4 Crash Address: 0x75e590dd032c Crash State: MurmurHash332 taosHashPut...

wolfssl:cryptofuzz-sp-math-all-8bit: Use-of-uninitialized-value in sp_exptmod_ex

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=6451249854873600 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-sp-math-all-8bit Job Type: libfuzzermsanwolfssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

gpac:fuzz_scene: Heap-use-after-free in gf_node_unregister

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6308691635929088 Project: gpac Fuzzing Engine: honggfuzz Fuzz Target: fuzzscene Job Type: honggfuzzasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x7688f66e02f0 Crash...

imagemagick:encoder_psd_fuzzer: Use-of-uninitialized-value in WritePixelCachePixels

Detailed Report: https://oss-fuzz.com/testcase?key=5803226330103808 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderpsdfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: WritePixelCachePixels...

gpac:fuzz_scene: Crash in gf_svg_node_del

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5419170354495488 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzscene Job Type: libfuzzerubsangpac Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x571d1e370250 Crash State:...

ogre:ogre_deep_fuzz: Crash in Ogre::MeshSerializerImpl_v1_3::reorganiseTriangles

Project: https://github.com/OGRECave/ogre.git Detailed Report: https://oss-fuzz.com/testcase?key=5113074905579520 Project: ogre Fuzzing Engine: afl Fuzz Target: ogredeepfuzz Job Type: aflasanogre Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0002a4b3dfd0 Crash State:...

gpac:fuzz_scene: Heap-buffer-overflow in gf_node_register

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=4954571494719488 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzscene Job Type: aflasangpac Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x7765358ea4a0 Crash State:...

gpac:fuzz_scene: Heap-use-after-free in gf_node_unregister

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=4714478829895680 Project: gpac Fuzzing Engine: honggfuzz Fuzz Target: fuzzscene Job Type: honggfuzzasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x793e102e0140 Crash...

assimp:assimp_fuzzer_ifc: Bad-cast to std::__shared_weak_count from invalid vptr in std::__1::shared_ptr<Assimp::STEP::EXPRESS::DataType const>::shared_ptr

Detailed Report: https://oss-fuzz.com/testcase?key=4579058511052800 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzerifc Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5615beca3bf0 Crash State: Bad-cast to std::sharedweakcount from invali...

PT-2026-49249

Impact Malicious algorithms can potentially access other algorithms input and output files. Patches Todo Workarounds Verify and restrict the algorithm containers that are allowed to run on your node. See here on how to do this. References https://docs.vantage6.ai/usage/running-the-node/security F...

PT-2026-46911

Name of the Vulnerable Software and Affected Versions Product Slider Pro for WooCommerce versions prior to 3.5.4 Description Improper validation of input parameters related to specified quantities allows unauthenticated remote attackers to implant malicious software and execute arbitrary commands...

Lyrion Music Server 9.2.0 (metadata) Stored XSS

Summary Lyrion Music Server formerly Logitech Media Server, and often abbreviated as "LMS" is open-source software which can control and serve stream music to a wide range of physical and virtual audio players called Squeezeboxes. Lyrion Music Server can stream your local music collection, intern...

📄 Lyrion Music Server 9.2.0 metadata Persistent Cross Site Scripting

Lyrion Music Server version 9.2.0 stores media file metadata tags such as GENRE, ARTIST, and ALBUM exactly as written in the file and later renders them in its web interface without HTML-encoding, resulting in persistent cross site scripting. An attacker who gets a file with a malicious tag into...

PT-2026-47064

Name of the Vulnerable Software and Affected Versions Alba Board versions prior to 2.1.4 Description The plugin fails to properly verify if a user is authorized to perform specific actions, leading to an authorization bypass. This allows authenticated attackers with subscriber-level access or...

WordPress plugin Alba Board 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

PT-2026-47093

Name of the Vulnerable Software and Affected Versions DbGate versions prior to 7.1.9 Description The "POST /runners/load-reader" endpoint accepts a functionName parameter that is directly interpolated into a JavaScript code template without sanitization or validation. An authenticated user with...

PT-2026-47024

Name of the Vulnerable Software and Affected Versions Markdown Preview Enhanced versions prior to 0.8.28 Description The software parses Bitfield fenced code blocks using the interpretJS function, which evaluates the block content as code via vm.runInNewContext. This allows for arbitrary code...

PT-2026-47023

Name of the Vulnerable Software and Affected Versions Markdown Preview Enhanced versions prior to 0.8.28 Description On Windows, the software opens external files and links from the preview through a shell without validating untrusted inputs from the markdown document. This allows for the injecti...

PT-2026-47081

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1 Description An authenticated commenter can store HTML in row comments that executes as a script when other users hover over the comment in the expanded form view. This occurs because comment write paths persi...