CVE-2026-110913

Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-110913

Google Chrome versions prior to 155.0.8059.84 are vulnerable to a memory corruption issue within the DOM component (CWE-119). This vulnerability allows a remote attacker to execute arbitrary code inside the sandbox by viewing a crafted HTML page . The impact is significant enough to be classified...

CVE-2026-36355

CVE-2026-36355: Realtek rtl819x Jungle SDK - Unauthenticated Kernel Memory Read/Write via Debug ioctls CVE : CVE-2026-36355 CWE : CWE-782, CWE-787, CWE-200 Discoverer : Daniil Gordeev Disclosed : 2026-05-03 Summary The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x out-of-tree "Jungle SDK"...

CVE-2026-111282

The Driftregion iso14229 library (versions before 0.10.1 ) is vulnerable to an Out-of-Bounds Read due to an integer wraparound in the Handle_0x38_RequestFileTransfer function. Unauthenticated attackers can send a short RequestFileTransfer (SID 0x38) request with a filePathAndNameLength between 0x...

CVE-2026-111282 iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer

Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle0x38RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer SID 0x38 request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to...

CVE-2026-111280

The snap7 library, versions through 1.4.3 , is vulnerable to an out-of-bounds write in the TSnap7MicroClient::opReadArea() function. The root cause is an unchecked DataLength field , which allows malicious S7 peers to overflow client buffers. Specifically, rogue or impersonated PLCs can return cr...

CVE-2026-111280 snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea

snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into...

CVE-2026-111279 Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to...

CVE-2026-111279

The Dragonfly database (through version 2.0.2 ) is vulnerable to an unbounded memory allocation issue. An unauthenticated client can exhaust system memory by providing a negative COUNT value to the HRANDFIELD , ZRANDMEMBER , or SRANDMEMBER commands. By sending a single command against a one-eleme...

CVE-2026-111279 Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to...

CVE-2026-111275

Versions of nifti_clib through 3.0.1 are vulnerable to a stack-based out-of-bounds read and write in the nifti_convert_n2hdr2nim() function. The root cause is a lack of range-checking on the NIfTI-2 dim[0] value. An attacker can provide a crafted 540-byte NIfTI-2 header via nifti_image_read() to ...

CVE-2026-111275 nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...

CVE-2026-111275 nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim

nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...

CVE-2026-111271 libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...

CVE-2026-111271

The libmodplug library (versions through 0.8.9.1 ) is vulnerable to a heap-based out-of-bounds read in the CSoundFile::ReadAMS2() function located in src/load_ams.cpp. An attacker can provide a crafted AMS file where the pattern effect bytes maintain bit 7 as set. This action drives the decoder p...

CVE-2024-58397 MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications li...

CVE-2024-58397

Versions of MP4v2 through 2.1.3 are vulnerable to a heap-based out-of-bounds read in the MP4File::GetChapters() function. An attacker can exploit this by providing a crafted MP4 file where a QuickTime chapter sample is shorter than its declared title length. This allows the attacker to read past ...

CVE-2024-58397 MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters

MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications li...

CVE-2026-111269 libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the...

mongobleedburp

MongoBleed Burp Extension Burp Suite extension to detect CVE-2025-14847 MongoBleed via manual leak tests from a dedicated UI tab. Repository: https://github.com/j0lt-github/mongobleedburp Current version: 1.1.0 Features Manual test UI tab with host/port and min/max offsets Temporary-file leak...