hdf5: HDF5: Denial of Service via crafted file requiring user interaction

A flaw was found in HDF5, a data management library. This vulnerability, a heap-based buffer overflow, allows a local attacker to cause a denial of service DoS by persuading a user to open a specially crafted HDF5 file. The malformed file can trigger out-of-bounds memory operations, leading to...

SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems

Safe agents can fail together. Multi-agent LLM systems MAS move information, state, decisions, and authority across principal boundaries, creating failures that local checks may miss. Without an execution-level view, a multi-agent setting can easily be mistaken for evidence of a genuinely...

Adobe XD 60.0 < 61 Arbitrary code execution (APSB26-125)

The version of Adobe XD installed on the remote Windows host is prior to 61. It is, therefore, affected by a vulnerability as referenced in the APSB26-125 advisory. - Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the curren...

Adobe XD 60.0 < 61 Arbitrary code execution (APSB26-125) (macOS)

The version of Adobe XD installed on the remote macOS host is prior to 61. It is, therefore, affected by a vulnerability as referenced in the APSB26-125 advisory. - Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current...

(0Day) pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

Malicious Package

Overview ux-metrics-client-interaction-subscriber is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

Malicious code in ux-metrics-client-interaction-subscriber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...

MAL-2026-15545 Malicious code in ux-metrics-client-interaction-subscriber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...

GHSA-F2XF-7X3G-4272 PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

Summary Stored cross-site scripting XSS in PrivateBin's attachment download link. An anonymous attacker can create a paste with a text/html attachment that, with certain user interaction, bypasses protections similar to CVE-2022-24833. When a victim opens the "Download attachment" link in a new...

CVE-2026-55696 PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...

EUVD-2026-67938

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...

CVE-2026-55696

PrivateBin versions prior to 2.0.5 contain a stored XSS vulnerability in the attachment download link. The root cause is that DOMPurify sanitization in AttachmentViewer.setAttachment only applies to image/*svg MIME types, and the resulting sanitized blob is assigned to a local variable used for t...

CVE-2026-55696 PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...

CVE-2026-34620

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to corrupt memory, causing the application to crash or become unresponsive. Exploitation of this issue...

CVE-2026-34616

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must...

CVE-2026-34620 DNG SDK | Out-of-bounds Write (CWE-787)

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to corrupt memory, causing the application to crash or become unresponsive. Exploitation of this issue...

EUVD-2026-67216

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must...

EUVD-2026-67215

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to corrupt memory, causing the application to crash or become unresponsive. Exploitation of this issue...

CVE-2026-34620

DNG SDK versions 1.7.1 2502 and earlier are vulnerable to an out-of-bounds write (CWE-787) that can corrupt memory, leading to application crash or unresponsiveness (denial-of-service). Exploitation requires local user interaction —a victim must open a malicious file. The CNA-assigned CVSS 3.1 sc...

CVE-2026-34616

CVE-2026-34616 affects Adobe DNG SDK versions 1.7.1 2502 and earlier , containing an out-of-bounds read (CWE-125) that can lead to sensitive memory exposure . Exploitation requires user interaction : a victim must open a malicious file. The CVSS 3.1 score is 5.5 (MEDIUM) , with local attack vecto...