CVE-2026-17250

A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary...

PYSEC-2026-3755

opensslencrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process...

DEBIAN-CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

CVE-2026-73248 calibre: Bypass of Python template restrictions via nested `template()` leading to RCE

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

Arbitrary Code Injection

Overview uproot is a ROOT I/O in pure Python and NumPy. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TStreamerInfo metadata processing. An attacker can execute arbitrary Python code by supplying a crafted ROOT file containing malicious streamer metadata...

The vulnerability of the metadata processing mechanism in the repomd.xml repository file of the libzypp library allows a perpetrator to execute arbitrary code.

The vulnerability of the file metadata processing mechanism in the repomd.xml repository of the libzypp library is related to errors in the mechanism for handling relative pathnames to directories. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

CVE-2026-53511

calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template in calibre:usermetadata that is pass...

PixelSmash flaw turns video files into attack tools

A newly discovered vulnerability in FFmpeg’s MagicYUV decoder can turn a tiny, malformed video into a foothold for attackers. Researchers have disclosed PixelSmash, a critical vulnerability tracked as CVE-2026-8461, in FFmpeg’s MagicYUV video decoder with a CVSS score of 8.8. By crafting a...

MongoDB 7.0.x < 7.0.35 / 8.0.x < 8.0.24 / 8.2.x < 8.2.10 / 8.3.x < 8.3.3 / 9.0.0-rc0 Multiple Vulnerabilities

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.35, 8.0.x prior to 8.0.24, 8.2.x prior to 8.2.10, or 8.3.x prior to 8.3.3. It is, therefore, affected by multiple vulnerabilities: - A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable...

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the metadata process. An attacker can rename, move, or create links to files within the container by submitting specially crafted metadata values that bypass the intended blocklist. This may also...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the metadata field processing. An attacker can rename, move, or change permissions of files within the container by submitting specially crafted tag names such as System:FileName, System:Directory, or...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the metadata field processing. An attacker can rename, move, or change permissions of files within the container by submitting specially crafted tag names such as System:FileName, System:Directory, or...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-33899: Denial of Service via out-of-bounds write in XML parsing bsc1262154. CVE-2026-33900: Denial of Service via integer truncation in viff encoder bsc1262156. CVE-2026-33905: Denial of service via out-of-bounds read in -sample...

CVE-2026-34445

A flaw was found in Open Neural Network Exchange ONNX. An attacker could exploit a vulnerability in how ONNX processes model metadata, specifically within the ExternalDataInfo class. By crafting a malicious ONNX model, an attacker could overwrite internal object properties, leading to a denial of...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview onnx is an Open Neural Network Exchange Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the ExternalDataInfo function. An attacker can cause system unavailability, limited information disclosure, or dat...

CVE-2026-32836

drlibs drflac.h version 0.13.3 and earlier fixed in commits fefced4, 4f5a4cd, and 663239a contain an uncontrolled memory allocation vulnerability in drflacreadanddecodemetadata that allows attackers to trigger excessive memory allocation by supplying crafted PICTURE metadata blocks. Attackers can...

The vulnerability of the metadata processing library in multimedia files. ExifTool, a software platform based on Git, is used for collaborative code development on GitLab. This vulnerability allows a hacker to cause a service failure.

The vulnerability of the ExifTool software library for processing metadata in multimedia files is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

EUVD-2021-19455

Malware in sbrugna...

SUSE-SU-2025:1569-1 Security update for libraw

This update for libraw fixes the following issues: - CVE-2025-43961: Fixed out-of-bounds read in the Fujifilm 0xf00c tag parser in metadata/tiff.cpp bsc1241643 - CVE-2025-43962: Fixed out-of-bounds read when tag 0x412 processing in phaseonecorrect function bsc1241585 - CVE-2025-43963: Fixed...

Linux Distros Unpatched Vulnerability : CVE-2021-37616

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference was found ...