kimageformats:kimgio_heif_fuzzer: Crash in init_CABAC_decoder_2

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=4856140637995008 Project: kimageformats Fuzzing Engine: afl Fuzz Target: kimgioheiffuzzer Job Type: aflasankimageformats Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7712ba0bd01b Crash...

vlc:vlc-demux-dec-libfuzzer-asf: Stack-buffer-overflow in SetupOutputFormat

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=4583863266639872 Project: vlc Fuzzing Engine: afl Fuzz Target: vlc-demux-dec-libfuzzer-asf Job Type: aflasanvlc Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 4 Crash Address: 0x787c1aeed04...

Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers...

Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

EUVD-2026-12188

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers...

GHSA-HF8W-X9H5-5GF9 Mattermost Boards Plugin fails to implement authorisation checks on comment block modifications

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

EUVD-2026-12411

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the comment block modification process. An attacker can alter comments created by other users by leveraging editor permissions without proper authorization checks. Remediation Upgrade...

GHSA-VGGC-6PG2-XVP9 Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the comment block modification process. An attacker can alter comments created by other users by leveraging editor permissions without proper authorization checks. Remediation Upgrade...

CVE-2026-32774

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers...

CVE-2026-2461

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

CVE-2026-2461

Mattermost Plugins versions

CVE-2026-2461 Missing authorization check allows unauthorized modification of other users' comments on a board

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

CVE-2026-2461 Missing authorization check allows unauthorized modification of other users' comments on a board

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

CVE-2026-2461

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

CVE-2026-2461

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

CVE-2026-2461 Missing authorization check allows unauthorized modification of other users' comments on a board

Mattermost Plugins versions =11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559...

arrow:arrow-ipc-file-fuzz: Segv on unknown address in arrow::Array::IsNull

Project: https://github.com/apache/arrow.git Detailed Report: https://oss-fuzz.com/testcase?key=6295340960776192 Project: arrow Fuzzing Engine: libFuzzer Fuzz Target: arrow-ipc-file-fuzz Job Type: libfuzzerasanarrow Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State...

libjpeg-turbo:compress_lossless_fuzzer_dev: Use-of-uninitialized-value in spng_decode_scanline

Detailed Report: https://oss-fuzz.com/testcase?key=5745070421901312 Project: libjpeg-turbo Fuzzing Engine: libFuzzer Fuzz Target: compresslosslessfuzzerdev Job Type: libfuzzermsanlibjpeg-turbo Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: spngdecodescanline...