PT-2026-29847

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when appending segmented request bodies without continuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input. An...

PT-2026-29851

A newly disclosed stack buffer overflow CVE-2026-34124 affects specific TP-Link devices within their HTTP server, potentially leading to Denial of Service DoS. The vulnerability is triggered by malformed HTTP GET requests, with the original summary also indicating a similar POST body overflow...

PT-2026-32884

Name of the Vulnerable Software and Affected Versions microsoft defender antimalware platform versions prior to 4.18.26030.3011 Description Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally to SYSTEM level. This issue,...

PT-2026-29868

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to commit 8aceaf5 Description OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass in shell-bleed protection. This allows attackers to execute blocked script content by using piped or complex...

CVE-2026-5032: Exposure of Sensitive Information to an Unauthorized Actor

The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains "W3 Total Cache", which causes raw...

PT-2026-29858

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.3 Description OpenSSH mishandles the authorized keys principals option in scenarios involving a principals list and a Certificate Authority CA that uses comma characters. A parsing error occurs where a comma in an...

PT-2026-33871

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31 Description An issue allows attackers to escape sandbox restrictions and achieve unauthorized privilege escalation. This is possible through heartbeat context inheritance and the manipulation of the...

PT-2026-29849

A critical HTTP authentication bypass CVE-2026-34121 has been identified in TP-Link devices, potentially allowing unauthorized access. Technical Breakdown Vulnerability Type: Authentication Bypass Impact: Allows an attacker to circumvent HTTP authentication mechanisms on affected TP-Link devices,...

PT-2026-29846

Name of the Vulnerable Software and Affected Versions TP-Link Tapo C520WS version 2.6 Description A heap-based buffer overflow exists in the HTTP POST body parsing logic due to insufficient boundary validation and missing validation of remaining buffer capacity after dynamic allocation when...

PT-2026-29903

Name of the Vulnerable Software and Affected Versions Azure SRE Agent affected versions not specified Description Improper authentication in the Azure SRE Agent allows an unauthorized attacker to disclose information over a network. A multi-tenant design oversight occurred where authentication...

PT-2026-29848

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of local video stream content due to insufficient alignment and validation of buffer boundaries when processing streaming inputs.An attacker on the same network segment could...

sleuthkit:fls_ntfs_fuzzer: Heap-buffer-overflow in ntfs_proc_attrseq

Detailed Report: https://oss-fuzz.com/testcase?key=5542460911845376 Project: sleuthkit Fuzzing Engine: honggfuzz Fuzz Target: flsntfsfuzzer Job Type: honggfuzzasansleuthkit Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7d1329be1481 Crash State: ntfsprocattrseq...

duckdb:parse_fuzz_test: Bad-cast to duckdb::ProfilingNode from invalid vptr in duckdb::QueryProfiler::Flush

Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=5097336987779072 Project: duckdb Fuzzing Engine: libFuzzer Fuzz Target: parsefuzztest Job Type: libfuzzerubsanduckdb Platform Id: linux Crash Type: Bad-cast Crash Address: 0x58ecea529ba0 Crash State:...

harfbuzz:hb-raster-fuzzer: Heap-buffer-overflow in hb_raster_paint_push_clip_rectangle

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=4872362293264384 Project: harfbuzz Fuzzing Engine: afl Fuzz Target: hb-raster-fuzzer Job Type: aflasanharfbuzz Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

yyjson:yyjson_fuzzer: Use-of-uninitialized-value in read_root_single

Project: https://github.com/ibireme/yyjson.git Detailed Report: https://oss-fuzz.com/testcase?key=4836509529473024 Project: yyjson Fuzzing Engine: libFuzzer Fuzz Target: yyjsonfuzzer Job Type: libfuzzermsanyyjson Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State...

lucene:QueryParserFuzzer: Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray

Detailed Report: https://oss-fuzz.com/testcase?key=4743143588429824 Project: lucene Fuzzing Engine: libFuzzer Fuzz Target: QueryParserFuzzer Job Type: libfuzzerasanlucene Platform Id: linux Crash Type: Security exception Crash Address: Crash State: org.apache.lucene.util.ArrayUtil.copyOfSubArray...

@01.software/sdk (>=0.0.1-251022.145258, <=0.2.3), @adenta/cms (>=0.0.6, <=1.1.1-0) +71 more potentially affected by CVE-2026-34748 via @payloadcms/ui (>=3.0.0, <=3.77.0-internal.9837b1e)

@payloadcms/ui NPM version =3.0.0, =0.0.1-251022.145258, =0.0.6, =3.70.0, =0.0.3, =3.39.2, =1.0.1-beta.3, =0.1.2, =0.0.1, =1.0.0, =0.1.0, =0.1.2, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2026-34748 Source advisory: SNYK:JS-PAYLOADCMSUI-15873862...

OPENSUSE-FU-2026:20453-1 Feature update for himmelblau

This update for himmelblau fixes the following issues: Update to himmelblau 2.3.8 jscPED-14511: Security issues: - CVE-2025-54882: world readable cloud TGT token bsc1247735. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249013. - CVE-2026-25727: time: parsing of user-provided...

nestegg:fuzz: Use-of-uninitialized-value in ne_read_block

Project: https://github.com/kinetiknz/nestegg.git Detailed Report: https://oss-fuzz.com/testcase?key=6705140546732032 Project: nestegg Fuzzing Engine: libFuzzer Fuzz Target: fuzz Job Type: libfuzzermsannestegg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

ghostscript:gs_xps_fuzzer: Segv on unknown address in chunk_free_object

Detailed Report: https://oss-fuzz.com/testcase?key=6683180378947584 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsxpsfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: chunkfreeobject sblockreadclose sclose...