CVE-2026-70630

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

CVE-2026-70629

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

CVE-2026-18487

Technical details (affected products, versions, root cause, and fixes) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-18487 Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

CVE-2026-18487 Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

PT-2026-68508

🚨 CVE-2026-28141 - high 🚨 NextGEN Gallery = 4.2.3 - Reflected Cross-Site Scripting NextGEN Gallery through 4.2.3 reflects a URL-decoded ngg tag route value into the g... 👾 https://t.co/No4GJJJ3Dv @pdnuclei NucleiTemplates cve...

Malicious code in ezdiscordbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a715452291e1bd779802f51dc90eca91740307e0bee7b9e2ca94f6f863f6a921 package.json declares a postinstall script sudo node install.js that runs install.js with root privileges on the installer's machine. Both install.js...

MAL-2026-12116 Malicious code in tailwind-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb0348430af0110be6ac537a38b5bb98983ec6b6f8f1474778ff16e4a4f4e8d8 dist/index.js appends an evalatob'...' payload after the legitimate export default scrollbarHide; line. The decoded payload queries Ethereum RPC...

JLSEC-2026-1096

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor WordPress, Sharp/libvips,...

NIP-98 authorization parsing permits resource exhaustion

The NIP-98 HTTP authorization parser Base64-decoded the complete authorization value and parsed the resulting JSON event without applying an application-level size limit. Both operations occurred before the event's signature and authorization fields could be validated. An unauthenticated remote...

PT-2026-76511

The NIP-44 decryption entry point Base64-decoded the complete attacker-controlled payload before determining its version or enforcing any size limit. For v2 payloads, the decoded buffer was then authenticated with HMAC even when it was much larger than the maximum payload supported by the crate's...

PT-2026-76513

The NIP-98 HTTP authorization parser Base64-decoded the complete authorization value and parsed the resulting JSON event without applying an application-level size limit. Both operations occurred before the event's signature and authorization fields could be validated. An unauthenticated remote...

openhole-server vulnerable to path traversal via URL-decoded request path

Summary openhole-server forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of the original request-target. Percent-encoded dot-segments %2e and separators %2f were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but...

CVE-2026-54650 openhole-server vulnerable to path traversal via URL-decoded request path

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

CVE-2026-54650

CVE-2026-54650 describes a path traversal vulnerability in openhole-server prior to 0.1.2. In 0.1.1 and earlier, internal/server/public_proxy.go forwarded the request using r.URL.Path instead of preserving the original target via r.URL.EscapedPath(). This allowed percent-encoded dot segments (%2e...

CVE-2026-54650 openhole-server vulnerable to path traversal via URL-decoded request path

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

EUVD-2026-50087

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

CVE-2026-54650 openhole-server vulnerable to path traversal via URL-decoded request path

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

CVE-2026-66746

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...

CVE-2026-64795

Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’...