openexr -- buffer overflow in istream_nonparallel_read on invalid input data

Cary Phillips reports: openexr v3.4.5 ... fixes an incorrect size check in istreamnonparallelread that could lead to a buffer overflow on invalid input data...

CVE-2025-66605

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Since there are input fields on this webpage with the autocomplete attribute enabled, the input content could be saved in the browser the user is using. The affected products and versions are as follows:...

ROS-20260209-73-0025

Vulnerability in python-urllib3 related to incorrect handling of highly compressed input data. Exploitation of the vulnerability may allow a remote attacker to cause a denial of service...

ROS-20260205-73-0027

A vulnerability in the rseq.c component of the Linux operating system kernel is related to the reliance on unreliable input data to make security decisions. Exploitation of the vulnerability allows an attacker to impact the confidentiality and availability of protected information...

ROS-20260203-73-0021

A vulnerability in the btrfs component of the Linux kernel is related to buffer copying without input data validation. Exploitation of the vulnerability allows an intruder to affect the integrity of protected information...

ROS-20260128-73-0010

A vulnerability in the Linux operating system kernel is related to buffer copying without checking the size of the input data. Exploitation of the vulnerability could allow an attacker acting remotely to escalate his privileges...

CVE-2026-1484

A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrust...

CVE-2025-11065

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

CVE-2025-11065

CVE-2025-11065 affects github.com/go-viper/mapstructure/v2, where the field processing using mapstructure.WeakDecode may disclose input values through detailed error messages. Public sources corroborate the issue and its remediation. Fedora advisories indicate the fix is to upgrade mapstructure t...

CVE-2026-0528 Improper Input Validation in Metricbeat Leading to Denial of Service

Improper Validation of Array Index CWE-129 exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation CAPEC-153 via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input...

CVE-2026-22712

Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39...

GHSA-JRMJ-C5CX-3CW6 Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

A Cross-Site Scripting XSS vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG elements as a Resource URL context. In a standard security model,...

CVE-2020-12498

mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code execution. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation...

CVE-2026-22712

Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39...

CVE-2026-22712 ApprovedRevs allows bypassing the inline CSS sanitizer

Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39...

CVE-2026-22712 ApprovedRevs allows bypassing the inline CSS sanitizer

Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39...

CVE-2026-22712

The CVE-2026-22712 issue affects MediaWiki’s ApprovedRevs extension (versions 1.39–1.45). The root cause is improper encoding or escaping of output due to a magic word replacement in ParserAfterTidy, which can enable input data manipulation by bypassing the inline CSS sanitizer. Exploitation deta...

Mediawiki - ApprovedRevs Extension 安全漏洞

Mediawiki - ApprovedRevs Extension is an open source content quality control plugin for Mediawiki. A security vulnerability exists in Mediawiki - ApprovedRevs Extension versions 1.45, 1.44, 1.43, and 1.39, which stems from improper output encoding or escaping, and could lead to input data...

CVE-2025-47335 Buffer Copy Without Checking Size of Input in Camera Driver

Memory corruption while parsing clock configuration data for a specific hardware type...

ROS-20251223-7309

Vulnerability in python3.11 related to incorrect validation of a specified index, position or offset in input data. Exploitation of the vulnerability could allow an attacker to cause a denial of service...