CVE-2026-119053

The lwIP stack, versions 2.0.0 through 2.2.1 built with the SNMP agent , contains an out-of-bounds read vulnerability in the snmp_pbuf_stream_writeto() function. The root cause is that the function performs bounds copies using pbuf->len instead of the actual remaining bytes. Remote unauthentic...

CVE-2026-119053 lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()

lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmppbufstreamwriteto that bounds copies by pbuf-len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent...

CVE-2026-119053 lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()

lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmppbufstreamwriteto that bounds copies by pbuf-len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent...

CVE-2026-119052 llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SETTENSOR with a length abov...

CVE-2026-119052

The llama.cpp project (versions b2877 before b11935 ) is vulnerable to a Denial of Service (DoS) attack in the ggml-rpc server. An unauthenticated remote attacker can crash the rpc-server by sending a command, such as SET_TENSOR , with a length exceeding std::vector::max_size(). This triggers an ...

CVE-2026-119052

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SETTENSOR with a length abov...

EUVD-2026-112818

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SETTENSOR with a length abov...

CVE-2026-119052 llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SETTENSOR with a length abov...

CVE-2026-119052 llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SETTENSOR with a length abov...

CVE-2026-119048 JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module

JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call...

CVE-2026-119048

JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call...

CVE-2026-119049

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification...

EUVD-2026-112815

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification...

EUVD-2026-112814

JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call...

CVE-2026-119049

FreeMail versions prior to 5.3.2 are vulnerable to an authorization bypass in the POST /api/create endpoint. This flaw allows authenticated users who know a victim's email address to claim that existing mailbox. By leveraging the assignMailboxToUser function, an attacker can become a co-owner, gr...

CVE-2026-119048

JeeSite versions 5.11.0 through 5.19.1 are vulnerable to an Insecure Direct Object Reference (IDOR) within the AI CMS chat module . The root cause is missing and reversed ownership checks , which allows authenticated users to access other users' private conversations. Attackers who obtain or deri...

CVE-2026-119049 FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification...

CVE-2026-119049 FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification...

CVE-2026-119048 JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module

JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call...

CVE-2026-119049 FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification...