CVE-2026-110600 xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id

xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in mainsheetgetsheetfileexpatcallbackelementstart in lib/xlsxioread.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship...

CVE-2026-110600

xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in mainsheetgetsheetfileexpatcallbackelementstart in lib/xlsxioread.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship...

CVE-2026-110600

The xlsxio library, versions through 0.2.37 , contains a NULL pointer dereference vulnerability in the main_sheet_get_sheetfile_expat_callback_element_start() function located in lib/xlsxio_read.c. An attacker can crash the application by providing a crafted .xlsx file where the workbook.xml.rels...

CVE-2026-110600 xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id

xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in mainsheetgetsheetfileexpatcallbackelementstart in lib/xlsxioread.c that allows attackers to crash applications via crafted files. Attackers can supply a .xlsx file whose workbook.xml.rels contains a worksheet Relationship...

CVE-2026-110596

quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern in lib/identify.c that allows attackers to hang quircend with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode...

CVE-2026-110596 quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search

quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern in lib/identify.c that allows attackers to hang quircend with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode...

CVE-2026-110596

quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern in lib/identify.c that allows attackers to hang quircend with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode...

CVE-2026-110596

quirc versions through 1.2 are vulnerable to a Denial of Service (DoS) via an excessive-iteration flaw in the find_alignment_pattern() function located in lib/identify.c. An attacker can provide a crafted image with three arranged finder patterns that produce a near-degenerate perspective transfo...

EUVD-2026-101224

quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern in lib/identify.c that allows attackers to hang quircend with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode...

curl: libcurl RTSP `CURLOPT_CRLF` conversion allows a request body to become a second RTSP request

AI WAS USED IN THE PROCESS OF IDENTIFYING THIS VULNERABILITY. The vulnerability was tested manually and the report was carefully read. Suggested severity Low Affected version curl 8.23.0, tag curl-8230, commit 3163ec065643ba20709f190111f42c3e1fe95273. Affected interface The issue is reachable...

Malicious code in @newspage/lib-ng-async-routes-ui (npm)

npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In version 99.99.4, index.js sen...

CVE-2026-110596: Excessive Iteration

quirc through 1.2 contains an excessive-iteration vulnerability in findalignmentpattern in lib/identify.c that allows attackers to hang quircend with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of regioncode...

CVE-2026-86849: Out-of-bounds Write

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend...

PT-2026-114038

quirc through 1.2 contains an excessive-iteration vulnerability in find alignment pattern in lib/identify.c that allows attackers to hang quirc end with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region code...

CVE-2026-86563: Incorrect Calculation of Buffer Size

A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access...

PT-2026-114309

Name of the Vulnerable Software and Affected Versions DPDK affected versions not specified Description A flaw exists in the DPDK lib/vhost vhost-crypto component. The indirect-descriptor snapshot performs a double-fetch of a guest descriptor next index, creating a time-of-check/time-of-use TOCTOU...

PT-2026-114305

Name of the Vulnerable Software and Affected Versions DPDK versions prior to 25.11.4-1.1 Description A flaw exists in the DPDK lib/vhost component where the VDUSE handler does not invalidate vring pointers during IOTLB invalidation. This failure results in a use-after-unmap condition, which occur...

PT-2026-114301

Name of the Vulnerable Software and Affected Versions DPDK versions prior to 25.11.4-1.1 Description A TOCTOU Time-of-Check to Time-of-Use double-fetch of control-queue descriptors in the lib/vhost library leads to a heap buffer overflow. This occurs within the VDUSE control-queue handler, allowi...

CVE-2026-86566: Integer Underflow (Wrap or Wraparound)

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK...

CVE-2026-86561: Allocation of Resources Without Limits or Throttling

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption...