Astra Linux – Vulnerability in libraw

In LibRaw, there is a out-of-bounds read vulnerability within the gethuffmandiff function libraw\src\x3f\x3futilspatched.cpp when reading data from an image file...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Firmware: csdsp: Returns an error if the block header exceeds the size of the remaining data in the file. If the block header is longer than the amount of data remaining in the file, csdsppowerup will return an error. The previou...

CVE-2026-88033

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

CVE-2026-68086

Technical details about CVE-2026-68086 are not publicly available in the provided documents. No concrete impact, affected products, versions, or fixes are specified here. Monitor for updates.

CVE-2026-19075 All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...

CVE-2026-19229 SourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosure

A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functionality of the file /notes/ of the component Dreamweaver Metadata Files. Executing a manipulation can lead to file and directory information exposure. The attack can be launched...

Uncontrolled Resource Consumption

github.com/pterodactyl/wings is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded JSON, YAML, and XML configuration file parsers in parser.go processing oversized non-file parser configuration data, which allows an attacker to exhaust the Wings process memory...

libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within .solv files due to insufficient input validation. An attacker can provide a specially crafted .solv file, which, when processed by a vulnerable application, can lea...

CVE-2026-64398 ksmbd: add a permission check for FSCTL_SET_ZERO_DATA

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

EUVD-2025-210463

A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault MNRF...

CVE-2025-12012 CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow

A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault MNRF...

CVE-2025-12012

The CVE-2025-12012 entry concerns Rockwell Automation 5380/5480/5580 controllers. A denial-of-service vulnerability could allow a malicious user to write invalid file data to the controller, potentially triggering a major non-recoverable fault (MNRF). The available documents do not specify affect...

PYSEC-2026-756 Zope allows attackers to modify raw image and file data

Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects...

CVE-2026-49269: Exposure of Sensitive Information to an Unauthorized Actor

Apple M1 GPUs retain register file data between compute shader dispatches from different processes. A sandboxed Metal attacker app can run a GPU reader shader that reads stale register values left by a separate sandboxed victim app. In the proof of concept, GPUVictim.app generates a fresh random...

CVE-2026-24060

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. Th...

EUVD-2026-13840

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. Th...

CVE-2026-24060

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. Th...

CVE-2026-24060 Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. Th...

CVE-2026-24060

Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. Th...

CVE-2026-24060

This CVE (CVE-2026-24060) concerns Automated Logic WebCTRL Premium Server where BACnet traffic is sent in cleartext, allowing on-wire sniffing/interception and potential modification. The issue exposes sensitive data such as File Start Position and File Data; Wireshark BACnet dissector can reveal...