UBUNTU-CVE-2026-20345

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion...

API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

Summary The API Platform serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property. Impact An attacker who can submit write requests...

CVE-2026-20345

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion...

CVE-2026-20345

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion...

CVE-2026-20345 ClamAV GPT File Format Processing Memory Corruption Vulnerability

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion...

CVE-2026-20345

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion...

EUVD-2026-54525

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

CVE-2026-19212

CVE-2026-19212 affects WonderTrader up to version 0.9.9. The vulnerability exists in the component TraderATP Cash Trade Conversion, specifically in the file src/Includes/WTSTradeDef.hpp where manipulating the argument m_offsetType can cause an uninitialized variable to be used. The issue can be e...

CVE-2026-19212 WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

CVE-2026-19212 WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

JLSEC-2026-1178 FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video...

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdscparsetdsf function fails to unreference the...

fs/ntfs3: validate lcns_follow in log_replay conversion

...

PT-2026-69069

Name of the Vulnerable Software and Affected Versions WonderTrader versions prior to 0.9.9 Description A remote issue exists in the TraderATP Cash Trade Conversion component within the file src/Includes/WTSTradeDef.hpp. Manipulating the m offsetType argument can lead to the use of an uninitialize...

PT-2026-69073

Name of the Vulnerable Software and Affected Versions ClamAV affected versions not specified Description A flaw in the GPT file format parser allows an unauthenticated remote attacker to cause a Denial of Service DoS or other impacts via memory corruption. The issue stems from improper handling o...

CVE-2026-19212: Use of Uninitialized Variable

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

EulerOS 2.0 SP13 : libsoup (EulerOS-SA-2026-3027)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soupbodyinputstreamreadchunked functio...

The vulnerability of the GFX component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the GFX web browser components in Google Chrome and Microsoft Edge is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially created video file...

The vulnerability of the Skia component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...