CVE-2026-111123 FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

EUVD-2026-102354

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

CVE-2026-111123 FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

CVE-2026-111123 FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

CVE-2026-110877 AdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

CVE-2026-110877

The AdPlug software (versions through 2.4 ) is vulnerable to a heap out-of-bounds read in the CdmoLoader::load() function located in src/dmo.cpp. This vulnerability occurs when a truncated TwinTeam DMO file is processed; specifically, an attacker can provide a 12- or 13-byte file that bypasses dm...

EUVD-2026-102352

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

CVE-2026-110877 AdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

CVE-2026-110876 AdPlug through 2.4 Out-of-Bounds Read via CxsmPlayer::play_note in XSM Files

AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before notetable by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read duri...

CVE-2026-110874

Dolibarr versions prior to 23.0.4 are vulnerable to a PHP object injection flaw within the jsonOrUnserialize() function in functions.lib.php. The vulnerability occurs because the application calls unserialize() without class restrictions when json_decode() fails. If an attacker can provide input ...

EUVD-2026-102349

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-110874 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-110874 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

EUVD-2026-102346

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

CVE-2026-111234

The SimplePie library (through version 1.9.0 ) contains a local file read vulnerability. The root cause is the handling of file:// URLs within redirects or autodiscovery links, which can cause the file_get_contents() function to read files accessible to the web server process. Malicious feed serv...

CVE-2026-111234 SimplePie through 1.9.0 Local File Read via file:// Redirect

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

CVE-2026-111234 SimplePie through 1.9.0 Local File Read via file:// Redirect

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

CVE-2026-111230

Netgate pfSense CE (through version 2.9.0 ) is vulnerable to a local file read vulnerability via the Dynamic DNS client. An attacker with the required privileges can set a file:// custom Update URL in services_dyndns_edit.php. By providing a non-matching Result Match string, the _checkStatus() fu...

CVE-2026-111230 Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

EUVD-2026-102342

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...