EUVD-2026-48371

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

CVE-2026-65704 FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

CVE-2026-65704

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

CVE-2026-65704

CVE-2026-65704 affects FFmpeg up to version 8.1.2, where the TY demuxer’s demux_audio() decrements packet size without bounds checking, producing a negative size that, when passed to memcpy in shorten_decode_frame(), wraps to near SIZE_MAX and causes heap corruption from reads beyond the source a...

CVE-2026-65704 FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio function decrements packet size without bounds checking, producing a negative size...

CVE-2026-61140

creationtimestamp| type| source ---|---|--- 2026-07-23 18:15:38+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-23 18:56:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdjbga3p72j 2026-07-25 09:37:07+00:00| seen|...

n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

Impact The shell tool in the @n8n/computer-use package applied its sandbox restrictions only on macOS. On Linux and Windows, shell commands executed by the tool ran without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the...

n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Impact n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider IdP to an n8n global role and applies it during authentication. The provisioning path did not prevent assignment of the global:owner role, unlike the token-exchange identity path,...

Authorization Bypass Through User-Controlled Key

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the SSO instance-role provisioning. An attacker can gain full administrative privileges by manipulating the instance-role claim issued by the...

Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

The SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec allocates a pooled ByteBuf when processing a client-initiated SYNSTREAM frame with FLAGFIN=0, storing the partially-constructed FullHttpRequest in an internal map messageMap to accumulate subsequent DATA frames. When the remote peer sends ...

CVE-2026-55990

CVE-2026-55990 affects NLnet Labs Unbound 1.7.0 through 1.25.1. If the dnscrypt: clause lists more dnscrypt-provider-cert: files than there are matching dnscrypt-secret-key: files, Unbound only fills the matched prefix and leaves tail slots as 0xdb-filled garbage from libsodium’s allocator. The s...

CVE-2026-55990

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes...

CVE-2026-55990 Packet of death for a DNSCrypt misconfigured Unbound

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes...

CVE-2026-56745

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec allocates a pooled ByteBuf when processing a client-initiated...

Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Summary Gitea does not re-evaluate the official flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an official: true approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch e.g.,...

CVE-2026-65068 Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in sphash.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644...

CVE-2026-65065 Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in roaring.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644...

CVE-2026-65064

Data::HashMap::Shared versions before 0.14 for Perl are vulnerable to a local security issue due to improper file permissions and missing flags in shm_generic.h. The software creates an mmap backing file with a mode of 0666 , which defaults to 0644 (world-readable) under a standard umask. Further...

CVE-2026-65062 Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in sortedset.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644...

CVE-2026-64617 Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in pubsub.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...