EUVD-2026-119275

Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer dereference vulnerability in InterPrediction::xPredInterBlk that allows attackers to crash the decoder by switching SPS to enable reference wrap-around. Attackers can supply a crafted VVC bitstream activating a new SPS with...

EUVD-2026-119274

Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying a collocated picture of different resolution. Attackers can craft a VVC bitstream enabling TMVP with a smaller collocated reference picture, causing getColIn...

CVE-2026-124312

Fraunhofer HHI VVdeC versions through 3.2.1 are affected by a heap out-of-bounds read vulnerability in the CodingStructure::getColInfo function. An attacker can crash the decoder by providing a specially crafted VVC bitstream that enables TMVP with a smaller collocated reference picture. This cau...

CVE-2026-124310

Fraunhofer HHI VVdeC versions prior to 3.2.1 are vulnerable to an out-of-bounds read in the Slice::getRefPic function. The root cause is a lack of proper validation when processing bitstreams with overlapping slice CTU coverage; specifically, an attacker can craft a second slice where a bi-predic...

EUVD-2026-119276

Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying bitstreams with overlapping slice CTU coverage. Attackers can code a CTU in a second slice so a bi-predicted BDOF coding unit carries a negative reference index,...

CVE-2026-124309

Fraunhofer HHI VVdeC versions before 3.2.1 are vulnerable to a heap out-of-bounds read in the SEIReader::xParseSEIScalableNesting function. The vulnerability occurs because the software casts the SEI wrapper object instead of its intended payload. An attacker can exploit this by providing a craft...

EUVD-2026-119277

Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a crafted VVC bitstream with a scalable...

CVE-2026-124307

Fraunhofer HHI VVdeC versions before 3.2.1 are vulnerable to a heap use-after-free flaw. The root cause occurs when an attacker provides a crafted VVC bitstream that redefines an ALF adaptation parameter set (APS) ID while it is still being referenced by slices. During multithreaded decoding, wor...

EUVD-2026-119278

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

CVE-2026-124308

Fraunhofer HHI VVdeC versions prior to 3.2.1 are vulnerable to a heap use-after-free vulnerability within the DecLibRecon::createSubPicRefBufs function. The root cause is that the decompressPicture function clears m_subPicExtTasks without waiting for tasks that are still pending. An attacker can ...

EUVD-2026-119279

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multithreaded decoding, makes worker threads...

EUVD-2022-7146

Malicious code in bioql PyPI...

RUSTSEC-2024-0344 Timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`

Timing variability of any kind is problematic when working with potentially secret values such as elliptic curve scalars, and such issues can potentially leak private keys and other secrets. Such a problem was recently discovered in curve25519-dalek. The Scalar29::sub 32-bit and Scalar52::sub...

cluster.itwm.fraunhofer.de Cross Site Scripting vulnerability OBB-3606132

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

cluster.itwm.fraunhofer.de Cross Site Scripting vulnerability OBB-3419903

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

irb.fraunhofer.de Cross Site Scripting vulnerability OBB-3346767

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

fraunhofertheater.de Cross Site Scripting vulnerability OBB-3257363

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

fraunhofer-innovisions.de Cross Site Scripting vulnerability OBB-3193447

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress WP User Merger plugin <= 1.5.2 - Auth. SQL Injection (SQLi) vulnerability

Auth. SQL Injection SQLi vulnerability discovered by Kunal Sharma University of Kaiserslautern, Germany and Daniel Krohmer Fraunhofer IESE, Germany in the WordPress WP User Merger plugin versions = 1.5.2. Solution Update the WordPress WP User Merger plugin to the latest available version at least...

WordPress WP User Merger plugin <= 1.5.2 - Auth. SQL Injection (SQLi) vulnerability

Auth. SQL Injection SQLi vulnerability discovered by Kunal Sharma University of Kaiserslautern and Daniel Krohmer Fraunhofer IESE in the WordPress WP User Merger plugin versions = 1.5.2. Solution Update the WordPress WP User Merger plugin to the latest available version at least 1.5.3...