CVE-2026-93749: Improper Validation of Specified Quantity in Input

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

CVE-2026-54633

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...

UBUNTU-CVE-2026-54633

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...

CVE-2026-54633

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...

EUVD-2026-82560

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...

CVE-2026-54633 PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine)

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...

CVE-2026-54633 PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine)

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...

CVE-2026-54626 SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch)

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGAINDEXEDRLE path selected by imagetype == 9 allocates an image buffer using the one-byte-per-pixel SAILPIXELFORMATBPP8INDEXED format returned by...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in IndexedDB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in GhostScript

A issue was discovered in psi/zcolor.c in Artifex Ghostscript prior to version 10.04.0. There is a buffer overflow vulnerability when reading colors from the indexed color space...

Astra Linux – Vulnerability in Firefox

Potential race conditions in IndexedDB could have caused memory corruption, resulting in a potentially exploitable crash. This vulnerability affects Firefox 132 and Thunderbird 132...

Astra Linux – Vulnerability in Chromium

Before version 102.0.5005.61, using the "after free" feature in Indexed DB in Google Chrome allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page...

CVE-2026-89492: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2validatedxleaf and ocfs2validatedxroot check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validato...

Malicious Package

Overview indexed-btree is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-15888 Malicious code in indexed-btree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdcf3d23eb09d4a5d5736b43c78f6b140e79d23c0ac3488e84f3f1633c1ae578 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in indexed-btree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdcf3d23eb09d4a5d5736b43c78f6b140e79d23c0ac3488e84f3f1633c1ae578 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-75466

libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12 or tj3LoadImage16 using the default pixel format, the application may trigger a division-by-zero in allocsarray,...

PT-2026-82265

libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12 or tj3LoadImage16 using the default pixel format, the application may trigger a division-by-zero in alloc sarray...

CVE-2026-75466

The libjpeg-turbo 3.2.0 library contains an integer division-by-zero vulnerability within its PNG loader . When the application processes a valid indexed-color PNG image featuring a non-gray palette via the tj3LoadImage12() or tj3LoadImage16() functions using the default pixel format, it may trig...

EUVD-2026-66663

libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12 or tj3LoadImage16 using the default pixel format, the application may trigger a division-by-zero in allocsarray,...