PT-2026-35518

Name of the Vulnerable Software and Affected Versions Pimcore version 12.3.3 Description An authenticated administrative user with permissions to import or save DataObject class definitions can inject malicious composite index metadata. This action allows the execution of unintended SQL commands ...

PT-2026-35548

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.5 Description Default web security in certain configurations is ineffective, allowing unauthorized and unauthenticated access to all endpoints. This occurs when a servlet-based web application relies on t...

PT-2026-35395

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent version 0.8.0 Description A flaw in the Webhooks Endpoint component, specifically within the gateway/platforms/webhook.py file, allows for missing authentication. This occurs through the manipulation of the INSECURE N...

PT-2026-35373

Name of the Vulnerable Software and Affected Versions Apache MINA versions 2.0.0 through 2.0.27 Apache MINA versions 2.1.0 through 2.1.10 Apache MINA versions 2.2.0 through 2.2.5 Description A flaw in the resolveClass function of AbstractIoBuffer allows a bypass of the classname allowlist for...

CVE-2026-5940: Use After Free

Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes...

Foxit PDF Editor < 14.0.4 / 2026.1.1 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 2026.1.1/14.0.4. It is, therefore affected by multiple vulnerabilities: - Document structural anomalies caused inconsistencies between page element...

grok:grk_decompress_fuzzer: Bad-cast to TileComponentWindow<int> from grk::TileComponentWindow<short> in grk::TileComponent::getWindow

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=6146125806764032 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerubsangrok Platform I...

poppler:page_search_fuzzer: Use-of-uninitialized-value in Gfx::gouraudFillTriangle

Detailed Report: https://oss-fuzz.com/testcase?key=5792040079392768 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target: pagesearchfuzzer Job Type: libfuzzermsanpoppler Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: Gfx::gouraudFillTriangle...

imagemagick:encoder_mvg_fuzzer: Use-of-uninitialized-value in DrawPolygonPrimitive

Detailed Report: https://oss-fuzz.com/testcase?key=5724380956262400 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encodermvgfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: DrawPolygonPrimitive...

gdal:gtiff_mmap: Crash in gdal__TIFFmemcpy

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=5671185739481088 Project: gdal Fuzzing Engine: libFuzzer Fuzz Target: gtiffmmap Job Type: libfuzzerasani386gdal Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x73402dbf Crash State:...

wolfssl:fuzzer-wolfssl-ocsp: Heap-buffer-overflow in GetASNHeader_ex

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5469696341377024 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssl-ocsp Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

mruby:mruby_fuzzer: Global-buffer-overflow in fixed_width

Project: https://github.com/mruby/mruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5180852039647232 Project: mruby Fuzzing Engine: honggfuzz Fuzz Target: mrubyfuzzer Job Type: honggfuzzasanmruby Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x5c3ba5fdf538...

grok:grk_decompress_fuzzer: Crash in void grk::N_AVX2::vscheduler<grk::N_AVX2::DecompressDcShiftIrrev>

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=4702388488568832 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzermsangrok Platform Id...

iperf:auth_fuzzer: Crash in Base64Decode

Detailed Report: https://oss-fuzz.com/testcase?key=5672913530585088 Project: iperf Fuzzing Engine: libFuzzer Fuzz Target: authfuzzer Job Type: libfuzzermsaniperf Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x700fffffffff Crash State: Base64Decode authfuzzer.c Sanitizer: memory MSA...

PT-2026-35277

Name of the Vulnerable Software and Affected Versions GeoVision GV-IP Device Utility version 9.0.5 Description Insufficient encryption in the Device Authentication functionality allows for the leakage of administrator credentials. When the utility sends privileged commands to devices over UDP...

PT-2026-35220

Name of the Vulnerable Software and Affected Versions Totolink A8000RU version 7.1cu.643 b20200521 Description An OS command injection flaw exists in the CGI Handler component. Remote, unauthenticated attackers can execute arbitrary operating system commands by manipulating the pptpPassThru...

PT-2026-35239

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description A code injection issue exists in the Policies component's ToolGuard integration that bypasses the allow custom components=false security control. The validation mechanism only checks t...

Cillium exposes sensitive information included in the cilium-bugtool debug archive

Impact The output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. Users of WireGuard Transparent Encryption are affected. The sensitive data is the WireGuard private key ciliumwg0.key used for node-to-node encrypted...

GHSA-GJ49-89WH-H4GJ Cillium exposes sensitive information included in the cilium-bugtool debug archive

Impact The output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. Users of WireGuard Transparent Encryption are affected. The sensitive data is the WireGuard private key ciliumwg0.key used for node-to-node encrypted...

libvips:vips_fuzzer: Heap-buffer-overflow in vips_stdif_generate

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=6416631973871616 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: vipsfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...