libvpx:vpx_enc_fuzzer_vp8: Use-of-uninitialized-value in vpx_variance16x16_avx2

Project: https://chromium.googlesource.com/webm/libvpx Detailed Report: https://oss-fuzz.com/testcase?key=5299502767734784 Project: libvpx Fuzzing Engine: libFuzzer Fuzz Target: vpxencfuzzervp8 Job Type: libfuzzermsanlibvpx Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

libvpx:vpx_enc_fuzzer_vp8_nalloc: Use-of-uninitialized-value in vp8_regular_quantize_b_sse4_1

Project: https://chromium.googlesource.com/webm/libvpx Detailed Report: https://oss-fuzz.com/testcase?key=4581817557778432 Project: libvpx Fuzzing Engine: libFuzzer Fuzz Target: vpxencfuzzervp8nalloc Job Type: libfuzzermsanlibvpx Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

CVE-2026-5776

The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks...

CVE-2026-5306

The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled...

CVE-2026-2840

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eebmailto' shortcode in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-44214

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event SSE messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Event...

CVE-2026-34639

Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-34640

Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-40925

WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/configurationUpdate.json.php also routed via /updateConfig persists dozens of global site settings from $POST but protects the endpoint only with User::isAdmin. It does not call forbidIfIsUntrustedRequest, does not...

CVE-2024-7083

The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CLSA-2026-1780672432 ImageMagick: Fix of 4 CVEs

CVE-2026-30883: fix heap buffer overflow in the PNG encoder when writing extremely large raw profiles - CVE-2026-28692: fix 32-bit integer arithmetic in the MAT decoder row-size computation causing a heap over-read - CVE-2026-31853: fix broken 32-bit overflow check in the SFW decoder buffer...

imagemagick:encoder_psd_fuzzer: Use-of-uninitialized-value in WritePixelCachePixels

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=5803226330103808 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderpsdfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

[SECURITY] Fedora 43 Update: jpegxl-0.11.2-1.fc43

This package contains a reference implementation of JPEG XL encoder and decoder...

hf-ehr (>=0.1.2, <=0.1.4), mllibprodest (>=1.8.4, <=1.8.5) +2 more potentially affected by CVE-2026-10803 via mlflow (2.11.1)

mlflow PYPI version 2.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hf-ehr =0.1.2, =1.8.4, =1.8.5 - pms-encoder 1.1.0 - pollychem 0.1.0 Source cves: CVE-2026-10803 Source advisory: OSV:GHSA-5QMP-P3C4-72QJ...

hf-ehr (>=0.1.2, <=0.1.4), mllibprodest (>=1.8.4, <=1.8.5) +2 more potentially affected by CVE-2026-10803 via mlflow (2.11.1)

mlflow PYPI version 2.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hf-ehr =0.1.2, =1.8.4, =1.8.5 - pms-encoder 1.1.0 - pollychem 0.1.0 Source cves: CVE-2026-10803 Source advisory: OSV:PYSEC-2026-195...

jsoncons:fuzz_cbor_encoder: Bad-cast to jsoncons::cbor::cbor_mdarray_row_major_iterator<jsoncons::stream_source<unsigned char>, std::allocator<char>> from invalid vptr in jsoncons::cbor::cbor_mdarray_row_major_iterator<jsoncons::stream_source<unsigned

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=4549385555083264 Project: jsoncons Fuzzing Engine: libFuzzer Fuzz Target: fuzzcborencoder Job Type: libfuzzerubsanjsoncons Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5b1f102138e...

CVE-2026-46263

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds stream encoder index v3 engid can be negative and that streamencregs can be indexed out of bounds. engid is used directly as an index into streamencregs, which has only 5 entries. When engid is ...

EUVD-2026-34125

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds stream encoder index v3 engid can be negative and that streamencregs can be indexed out of bounds. engid is used directly as an index into streamencregs, which has only 5 entries. When engid is ...

CVE-2026-46263

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds stream encoder index v3 engid can be negative and that streamencregs can be indexed out of bounds. engid is used directly as an index into streamencregs, which has only 5 entries. When engid is ...

CVE-2026-46263 drm/amd/display: Fix out-of-bounds stream encoder index v3

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds stream encoder index v3 engid can be negative and that streamencregs can be indexed out of bounds. engid is used directly as an index into streamencregs, which has only 5 entries. When engid is ...