Lucene search
+L

9453 matches found

Github Security Blog
Github Security Blog
added 2026/09/10 3:06 p.m.13 views

@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name

Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...

5.8AI score
SaveExploits0References2Affected Software2
Kitploit
Kitploit
added 2026/09/10 2:22 p.m.5 views

BrokenType

BrokenType BrokenType es un conjunto de herramientas diseñadas para probar la robustez y seguridad del software de rasterización de fuentes, especialmente bases de código propensas a problemas de corrupción de memoria escritas en C/C++ y lenguajes similares. Consta de los siguientes componentes:...

5.9AI score
SaveExploits0References7
NVD
NVD
added 2026/09/10 9:17 a.m.7 views

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

9.5CVSS0.00438EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/10 9:17 a.m.6 views

CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

9.2CVSS0.00411EPSS
SaveExploits0References1
Debian CVE
Debian CVE
added 2026/09/10 8:19 a.m.21 views

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

9.5CVSS5.4AI score0.00438EPSS
SaveExploits0
EUVD
EUVD
added 2026/09/10 8:19 a.m.8 views

EUVD-2026-75306

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

9.5CVSS0.00438EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/10 8:19 a.m.55 views

CVE-2026-44950

CVE-2026-44950 is a heap buffer overflow in the libXfont2 font-server client (fs_read_glyphs() in src/fc/fserve.c). The function validates each glyph's source slice individually but never checks whether the cumulative destination offset exceeds the allocated buffer size. A malicious font server c...

9.5CVSS0.00438EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/10 8:19 a.m.38 views

CVE-2026-44950 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...

9.5CVSS0.00438EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/10 8:15 a.m.11 views

EUVD-2026-75300

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

9.2CVSS0.00411EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/10 8:15 a.m.34 views

CVE-2026-59679 fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

9.2CVSS0.00411EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/10 8:15 a.m.32 views

CVE-2026-59679

CVE-2026-59679 affects the libXfont2 font-server client (X.Org X11). The function fs_read_glyphs() in src/fc/fserve.c indexes the encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated based on num_extents from the separate FS_QueryXExtents16 reply—two fi...

9.2CVSS0.00411EPSS
SaveExploits0References1
Debian CVE
Debian CVE
added 2026/09/10 8:15 a.m.15 views

CVE-2026-59679

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...

9.2CVSS5.4AI score0.00411EPSS
SaveExploits0
RedhatCVE
RedhatCVE
added 2026/09/10 6:33 a.m.10 views

CVE-2026-79515

A flaw was found in the stb component. An out-of-bounds read vulnerability in the stbttGetGlyphShape function allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted TrueType Font TTF file. This can lead to the affected application becoming unresponsive or crashin...

4.3CVSS0.00183EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/10 2:50 a.m.6 views

dompdf-rce

Exploit de RCE para dompdf Este repositorio contiene una aplicación de demostración vulnerable que utiliza dompdf 1.2.0 y un exploit que logra ejecución remota de código mediante un archivo políglota ttf+php. Para más detalles, visite https://positive.security/blog/dompdf-rce Instrucciones 1...

6AI score
SaveExploits0
Cvelist
Cvelist
added 2026/09/10 12:00 a.m.26 views

CVE-2026-79591

A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS function of libxls 1.6.3 due to insufficient validation of a file-controlled font index...

0.00155EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/10 12:00 a.m.18 views

CVE-2026-79591

A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 , caused by insufficient validation of a file-controlled font index. A potential fix is referenced in a GitHub pull request (libxls PR #164 ), alongside issue #161 . No CVSS metrics or conf...

0.00155EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/10 12:00 a.m.6 views

EUVD-2026-75745

A heap-buffer-overflow and use-after-free vulnerability exists in the xlsgetCSS function of libxls 1.6.3 due to insufficient validation of a file-controlled font index...

0.00155EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/09 6:10 p.m.6 views

nexts-cve-2025-66478-exploit

这是一个使用 create-next-app 引导的 Next.js 项目。 快速开始 首先,运行开发服务器: root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev 在浏览器中打开 http://localhost:3000 查看结果。 你可以通过修改 app/page.tsx 来编辑页面。当你编辑文件时,页面会自动更新。 该项目使用 next/font 自动优化和加载 Geist,这是 Vercel 的一个新字体家族。 了解更多 要了解更多关于 Next.js 的信息,请查看以下资源: Next.js 文档 - 了解...

7.5AI score
SaveExploits112References1
Kitploit
Kitploit
added 2026/09/09 4:12 p.m.7 views

CVE-2025-63708

CVE-2025-63708 CVE ID: CVE-2025-63708 分配日期: 2025-12-11 问题类型: CWE-79(跨站脚本) 受影响产品: “AI Font Matcher”(发布于2025-10-10,nid=18425) 产品页面: https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html 发现日期: 2025-10-11 研究人员: Dylan Davis 概要 该应用程序在处理来自 webfont...

6.1CVSS5.9AI score0.00263EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 10:31 a.m.5 views

CVE-2023-21716

CVE-2023-21716 POC : CVE-2023-21716 Microsoft Word RTF Font Table Heap Corruption...

9.8CVSS8.1AI score0.82302EPSS
SaveExploits11
Rows per page
Query Builder