gpac:fuzz_probe_analyze: Stack-buffer-overflow in gf_text_process_ssa

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6167396904927232 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzprobeanalyze Job Type: libfuzzerasangpac Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address: 0x758481a3a820...

graphicsmagick:coder_HEIC_fuzzer: Use-of-uninitialized-value in residual_coding

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5897318355501056 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderHEICfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

libraw:libraw_raf_fuzzer: Use-of-uninitialized-value in LibRaw::parse_rollei

Project: https://github.com/libraw/libraw.git Detailed Report: https://oss-fuzz.com/testcase?key=4832321084915712 Project: libraw Fuzzing Engine: libFuzzer Fuzz Target: librawraffuzzer Job Type: libfuzzermsanlibraw Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

grok:grk_decompress_fuzzer: Heap-use-after-free in tf::Executor::_invoke

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=4599444736901120 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerasangrok Platform Id...

kimageformats:kimgio_heif_fuzzer: Heap-buffer-overflow in decoder_context::decode_slice_unit_WPP

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=6267766733864960 Project: kimageformats Fuzzing Engine: afl Fuzz Target: kimgioheiffuzzer Job Type: aflasankimageformats Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

PT-2026-26918

Name of the Vulnerable Software and Affected Versions D-Link DHP-1320 version 1.00WWB04 Description A flaw exists in the SOAP Handler component, specifically within the redirect count down page function, of the D-Link DHP-1320. This issue allows for a stack-based buffer overflow, which can be...

PT-2026-26945

D-Link DIR-513 boa formEasySetTimezone memory corruption CVE: CVE-2026-4555 PT-Identifier: PT-2026-26945 Vendor: D-link Product: DIR-513 CVSS: 8.7 Credits: LtzHust2 VulDB User Description: A weakness has been identified in D-Link DIR-513 1.10. The impacted element is the function...

PT-2026-26725

OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requirements and self-assign elevated operator scopes including operator.admin. Attackers with valid shared gateway authentication can present...

PT-2026-26733

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.1 Description An authorization mismatch exists that allows authenticated callers with operator.write scope to invoke owner-only tool surfaces, including gateway and cron, through agent runs in scoped-token...

PT-2026-26834

Name of the Vulnerable Software and Affected Versions App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress versions prior to 5.5.11 Description The software contains a flaw that allows unauthorized privilege escalation. The verify role function in AuthTrails.php...

AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization

Summary The fix for CVE-2026-27568 GHSA-rcqw-6466-3mv7 introduced a custom ParsedownSafeWithLinks class that sanitizes raw HTML and tags in comments, but explicitly disables Parsedown's safeMode. This creates a bypass: markdown link syntax text is processed by Parsedown's inlineLink method, which...

GHSA-72H5-39R7-R26J AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization

Summary The fix for CVE-2026-27568 GHSA-rcqw-6466-3mv7 introduced a custom ParsedownSafeWithLinks class that sanitizes raw HTML and tags in comments, but explicitly disables Parsedown's safeMode. This creates a bypass: markdown link syntax text is processed by Parsedown's inlineLink method, which...

h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)

Summary The EventStream class in h3 fails to sanitize carriage return \r characters in data and comment fields. Per the SSE specification, \r is a valid line terminator, so browsers interpret injected \r as line breaks. This allows an attacker to inject arbitrary SSE events, spoof event types, an...

GHSA-4HXC-9384-M385 h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)

Summary The EventStream class in h3 fails to sanitize carriage return \r characters in data and comment fields. Per the SSE specification, \r is a valid line terminator, so browsers interpret injected \r as line breaks. This allows an attacker to inject arbitrary SSE events, spoof event types, an...

AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

Summary The Gallery plugin's saveSort.json.php endpoint passes unsanitized user input from $REQUEST'sections' array values directly into PHP's eval function. While the endpoint is gated behind User::isAdmin, it has no CSRF token validation. Combined with AVideo's explicit SameSite=None session...

GHSA-XGGW-G9PM-9QHH AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

Summary The Gallery plugin's saveSort.json.php endpoint passes unsanitized user input from $REQUEST'sections' array values directly into PHP's eval function. While the endpoint is gated behind User::isAdmin, it has no CSRF token validation. Combined with AVideo's explicit SameSite=None session...

CRL Distribution Point Scope Check Logic Error in AWS-LC

Summary AWS-LC is an open-source, general-purpose cryptographic library. Impact A logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs wi...

GHSA-9F94-5G5W-GF6R CRL Distribution Point Scope Check Logic Error in AWS-LC

Summary AWS-LC is an open-source, general-purpose cryptographic library. Impact A logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs wi...

GHSA-394X-VWMW-CRM3 AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN

Summary AWS-LC is an open-source, general-purpose cryptographic library. Impact A logic error in CN Common Name validation allows certificates with wildcard or raw UTF-8 Unicode CN values to bypass name constraints enforcement. The cn2dnsid function does not recognize these CN patterns as valid D...

AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN

Summary AWS-LC is an open-source, general-purpose cryptographic library. Impact A logic error in CN Common Name validation allows certificates with wildcard or raw UTF-8 Unicode CN values to bypass name constraints enforcement. The cn2dnsid function does not recognize these CN patterns as valid D...