CVE-2026-110877

The AdPlug software (versions through 2.4 ) is vulnerable to a heap out-of-bounds read in the CdmoLoader::load() function located in src/dmo.cpp. This vulnerability occurs when a truncated TwinTeam DMO file is processed; specifically, an attacker can provide a 12- or 13-byte file that bypasses dm...

CVE-2026-110877 AdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

EUVD-2026-102352

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

CVE-2026-110877 AdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

CVE-2026-110876 AdPlug through 2.4 Out-of-Bounds Read via CxsmPlayer::play_note in XSM Files

AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before notetable by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read duri...

CVE-2026-110874

Dolibarr versions prior to 23.0.4 are vulnerable to a PHP object injection flaw within the jsonOrUnserialize() function in functions.lib.php. The vulnerability occurs because the application calls unserialize() without class restrictions when json_decode() fails. If an attacker can provide input ...

CVE-2026-110874 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

EUVD-2026-102349

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-110874 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-111234 SimplePie through 1.9.0 Local File Read via file:// Redirect

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

CVE-2026-111234 SimplePie through 1.9.0 Local File Read via file:// Redirect

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

CVE-2026-111234

The SimplePie library (through version 1.9.0 ) contains a local file read vulnerability. The root cause is the handling of file:// URLs within redirects or autodiscovery links, which can cause the file_get_contents() function to read files accessible to the web server process. Malicious feed serv...

EUVD-2026-102346

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

EUVD-2026-102342

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

CVE-2026-111230 Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

CVE-2026-111230

Netgate pfSense CE (through version 2.9.0 ) is vulnerable to a local file read vulnerability via the Dynamic DNS client. An attacker with the required privileges can set a file:// custom Update URL in services_dyndns_edit.php. By providing a non-matching Result Match string, the _checkStatus() fu...

CVE-2026-110659

A flaw was found in elfio. This vulnerability allows an attacker to cause a Denial of Service DoS by crashing applications that process untrusted binaries. By supplying a specially crafted Executable and Linkable Format ELF file containing an invalid relocation section link, an attacker triggers ...

CVE-2026-110603

A flaw was found in laszip. This invalid free vulnerability allows an attacker to cause a Denial of Service DoS and memory corruption by supplying a specially crafted LAS or LAZ file. When the application processes truncated Variable Length Record VLR data with an inflated record count, it attemp...

IOBitUnlockerUnlocker

Intro 0 day Moves or Copies any file. Bypasses previous patch with a checksum trick. Writup: https://nathan2.com/files/iobit.pdf Overall info: https://nathan2.com/posts/iobit/ I discovered this without knowing that this there was another previous exploit that discovered this first. However, this...

CVE-2026-0740

ninja.py An experimental/tool script that uses file upload endpoints for the Ninja Forms plugin on WordPress sites. It sends requests sequentially to targets in list.txt and writes successful uploads to the shell.txt file. Requirements Python 3 requests usually installed together with urllib3 pip...