ffmpeg:ffmpeg_dem_WSD_fuzzer: Use-of-uninitialized-value in wsd_read_header

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6596163492184064 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegdemWSDfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

pjsip:fuzz-sip-transaction: Use-of-uninitialized-value in pjsip_tpmgr_receive_packet

Project: https://github.com/pjsip/pjproject.git Detailed Report: https://oss-fuzz.com/testcase?key=6520488649359360 Project: pjsip Fuzzing Engine: libFuzzer Fuzz Target: fuzz-sip-transaction Job Type: libfuzzermsanpjsip Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

radare2:ia_fuzz: Crash in dotnet_parse_version_info

Project: https://github.com/radare/radare2.git https://github.com/radareorg/radare2.git Detailed Report: https://oss-fuzz.com/testcase?key=5536267634016256 Project: radare2 Fuzzing Engine: afl Fuzz Target: iafuzz Job Type: aflasanradare2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

u-boot:fuzz_efi_load_image: Crash in efi_load_pe

Detailed Report: https://oss-fuzz.com/testcase?key=4677271440130048 Project: u-boot Fuzzing Engine: libFuzzer Fuzz Target: fuzzefiloadimage Job Type: libfuzzerasanu-boot Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x790bcabe057f Crash State: efiloadpe efiloadimage fuzzefiloadimage...

PT-2026-25507

I found an SSRF vulnerability bypass via DNS rebinding in simstudioai/sim a project with 25k+ stars on GitHub CVE-2025-69660. Full write-up: https://t.co/eU3wf4d4Rd security websecurity appsec cve bugbounty...

CVE-2025-69660

CVE-2025-69660 is linked to a concrete finding in PT-2026-25507 describing an SSRF vulnerability bypass through DNS rebinding in the project simstudioai/sim (GitHub, 25k+ stars). The vulnerability bypasses SSRF protections by manipulating DNS resolution, enabling access to internal resources. The...

CVE-2026-32774: Improper Neutralization of Input During Web Page Generation

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers...

Security update for osc, obs-scm-bridge (moderate)

openSUSE security update: security update for osc, obs-scm-bridge ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20361-1 Rating: moderate References: bsc1230469 bsc1247410 Cross-References: CVE-2024-22038 CVSS scores: CVE-2024-22038 SUSE : 7.3...

PT-2026-34740

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon chips MDM and MSM series Description A hardware-level flaw exists in the BootROM of certain legacy and mid-range Snapdragon chipsets. The issue is exposed via the Sahara protocol in Emergency Download Mode EDL, allowing an...

PT-2026-25509

Name of the Vulnerable Software and Affected Versions Vulnogram version 1.0.0 Description The software contains a stored cross-site scripting issue in the handling of comment hypertext. This allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to...

Update your browser: Security fix for Chrome zero-days CVE 2026-3909 & CVE-2026-3910

News, Security Update your browser: Security fix for Chrome zero-days CVE 2026-3909 & CVE-2026-3910 Share March 14th, 2026 Hi everyone! The latest patches to Opera’s browsers address several recent vulnerabilities, including two zero-day exploits CVE 2026-3909 and CVE-2026-3910. We recommend...

EUVD-2026-11740

wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfilteredhtml capabilities can inject JavaScript...

EUVD-2026-11747

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to...

EUVD-2026-11751

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary...

EUVD-2026-11742

wpDiscuz before 7.6.47 contains a shortcode injection vulnerability that allows attackers to execute arbitrary shortcodes by including them in comment content sent via email notifications. Attackers can inject shortcodes like contact-form-7 or usermeta in comments, which are executed server-side...

GHSA-R48F-3986-4F9C fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist

Our analysis As stated in the project's security policy, we also don't consider UnusedVariables bypasses to be security issues. We added several unsafe modules mentioned by the reporter in advisory comments to the blocklist...

fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist

Our analysis As stated in the project's security policy, we also don't consider UnusedVariables bypasses to be security issues. We added several unsafe modules mentioned by the reporter in advisory comments to the blocklist...

CVE-2026-22210

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary...

CVE-2026-22202

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to...

CVE-2026-22183

wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfilteredhtml capabilities can inject JavaScript...