ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur...

GHSA-FF5C-8X9R-8QCW ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur...

CVE-2026-55730

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

EUVD-2026-48595

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

CVE-2026-55730

CVE-2026-55730 summary: Loytec LWEB802 is affected by a reflected Cross-Site Scripting (CWE-79) in the LWEB802 component. The vulnerability exists in all platforms and affects versions prior to 5.0.8. An unauthenticated remote attacker can craft a link containing a malicious project or mspParams ...

CVE-2026-55730 Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

EUVD-2026-48594

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

EUVD-2026-48589

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

CVE-2026-7007 Division by zero in Zephyr ext2 superblock parsing allows DoS via crafted filesystem image

The Zephyr ext2 file system validates the on-disk superblock in ext2verifydisksuperblock subsys/fs/ext2/ext2impl.c before completing a mount. The validator checked the magic number, block size, revision and feature flags, but did not verify that the on-disk fields sblockspergroup and...

CVE-2026-66143

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-65706

A flaw was found in FFmpeg. This vulnerability, an out-of-bounds write in the vfswaprect video filter, allows an attacker to corrupt heap memory. By providing a specially crafted NV12 video frame with specific dimensions, a local user can trigger a memory corruption, leading to a process crash...

CVE-2026-15810

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2026-66143

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...

CVE-2026-64831

A flaw was found in FFmpeg. A remote attacker can exploit a stack buffer overflow vulnerability in the Vulkan HEVC High Efficiency Video Coding hardware decoder by providing a specially crafted HEVC/H.265 bitstream. This can lead to overwriting memory on the stack, potentially allowing the attack...

CVE-2026-65704

A flaw was found in FFmpeg. A remote attacker can exploit this vulnerability by providing a specially crafted ffconcat file, which, when processed with the -safe 0 flag, triggers an out-of-bounds write. This occurs due to improper bounds checking in the TY demuxer's demuxaudio function, leading t...

OESA-2026-3158 mtr security update

It is a network diagnostic tool,it has the "ping" and "traceroute" features. It prints information about the route and packets that sent from the host to the specified destination system.This tool can also print the response times and percentage for all network hops between the systems. Security...

OESA-2026-3133 jbig2dec security update

jbig2dec is a decoder implementation of the JBIG2 image compression format. Security Fixes: An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafted input.CVE-2026-38076...

CVE-2026-15810 Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...

CVE-2026-15810

A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...