ffmpeg:ffmpeg_dem_GXF_fuzzer: Use-of-uninitialized-value in ff_hNUMBER_sei_message_decode

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5383132990996480 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegdemGXFfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5187303822917632 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

assimp:assimp_fuzzer_stl: Container-overflow in Assimp::BaseImporter::ConvertToUTF8

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=5181294291255296 Project: assimp Fuzzing Engine: afl Fuzz Target: assimpfuzzerstl Job Type: aflasanassimp Platform Id: linux Crash Type: Container-overflow READ 4 Crash Address: 0x76907f2e0198 Crash...

rdkit:mol_deserialization_fuzzer: Crash in void RDKit::MolPickler::_addRingInfoFromPickle<unsigned char>

Detailed Report: https://oss-fuzz.com/testcase?key=4803008000229376 Project: rdkit Fuzzing Engine: libFuzzer Fuzz Target: moldeserializationfuzzer Job Type: libfuzzermsanrdkit Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffaffffffffffc Crash State: void...

pcapplusplus:FuzzTarget: Heap-buffer-overflow in pcpp::IPv6Address::IPv6Address

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=4683685084594176 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTarget Job Type: libfuzzerasanpcapplusplus Platform Id: linux Crash Type: Heap-buffer-overflow READ 16 Crash...

CVE-2025-33017

Summary: The connected documents disclose a Langflow vulnerability (pre-1.9.0) where the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint accepts attacker-controlled flow data and executes Python code without sandboxing, causing unauthenticated remote code execution. Impact includes potentia...

PT-2026-26093

Name of the Vulnerable Software and Affected Versions UltraJSON versions 5.10 through 5.11.0 Description UltraJSON, a fast JSON encoder and decoder written in C, is susceptible to a buffer overflow or infinite loop when processing large indent values. Specifically, the ujson.dumps function can...

PT-2026-26092

Name of the Vulnerable Software and Affected Versions UltraJSON versions 5.4.0 through 5.11.0 Description UltraJSON, a fast JSON encoder and decoder written in C with Python 3.7+ bindings, contains an accumulating memory leak when parsing large integers outside the range -2^63, 2^64 - 1 within JS...

PT-2026-25996

Summary The install/checkConfiguration.php endpoint performs full application initialization — database setup, admin account creation, and configuration file write — from unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized...

PT-2026-25977

Name of the Vulnerable Software and Affected Versions jsPDF versions prior to 4.2.1 Description jsPDF, a JavaScript library used for generating PDFs, contains a flaw where insufficient sanitization of user-controlled input within the options argument of the output function allows attackers to...

PT-2026-25939

Name of the Vulnerable Software and Affected Versions Spring AI versions prior to 1.0.4 and 1.1.3 Description A JSONPath injection issue exists in Spring AI’s AbstractFilterExpressionConverter. Authenticated users can bypass metadata-based access controls by using crafted filter expressions...

PT-2026-25991

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions 4.7.0 through 4.10.16 used an unbounded ConcurrentHashMap cache with no eviction policy in its DefaultHtmlErrorResponseBodyProvider. If the application throws an...

PT-2026-25940

Name of the Vulnerable Software and Affected Versions Spring AI versions prior to 1.0.4 Spring AI versions prior to 1.1.3 Description A critical SQL injection flaw exists in Spring AI's MariaDBFilterExpressionConverter component. This issue allows attackers to bypass metadata-based access control...

PT-2026-25988

Name of the Vulnerable Software and Affected Versions Harden-Runner versions 2.15.1 and below Description Harden-Runner, a CI/CD security agent functioning as an EDR for GitHub Actions runners, contains a DNS over HTTPS DoH issue. This allows attackers to circumvent network restrictions imposed b...

PT-2026-26000

Summary /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, enabling cross-origin session theft and full account...

PT-2026-25983

Name of the Vulnerable Software and Affected Versions astral-tokio-tar versions 0.5.6 and earlier Description astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This...

PT-2026-25979

Summary music-metadata's ASF parser parseExtensionObject in lib/asf/AsfParser.ts:112-158 enters an infinite loop when a sub-object inside the ASF Header Extension Object has objectSize = 0. Root Cause When objectSize is 0: 1. remaining = 0 - 24 = -24 2. tokenizer.ignore-24 moves the read position...

PT-2026-25997

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 25.0 and below Description WWBN AVideo is an open source video platform. Versions 25.0 and below have an issue in the 'plugin/LiveLinks/proxy.php' endpoint where user-supplied URLs are validated against internal/private...

PT-2026-25901

Name of the Vulnerable Software and Affected Versions ScreenConnect versions prior to 26.1 Description A flaw in ScreenConnect could allow an attacker with access to server-level cryptographic material used for authentication to gain unauthorized access, potentially including elevated privileges...

PT-2026-25994

Summary AVideo contains a reflected XSS vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser. User input from a URL parameter flows through PHP's json encode into a JavaScript function that renders it via innerHTML, bypassing encoding and...