WordPress midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload

WordPress midi-Synth plugin \u003C= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to...

CVE-2026-13343

The UMP Stream responder library in lib/midi2/umpstreamresponder.c builds reply packets in a 16-byte struct midiump uint32t data4. The builders makeendpointinfo and makefunctionblockinfo populate only the first two words res.data0 and res.data1 and, before this fix, declared their result as an...

CVE-2026-13343

CVE-2026-13343 affects the Zephyr RTOS UMP Stream responder library (lib/midi2/ump_stream_responder.c). The functions make_endpoint_info() and make_function_block_info() declare a local struct midi_ump without initialisation, populating only the first two of four uint32_t words. The remaining two...

EUVD-2026-64924

The UMP Stream responder library in lib/midi2/umpstreamresponder.c builds reply packets in a 16-byte struct midiump uint32t data4. The builders makeendpointinfo and makefunctionblockinfo populate only the first two words res.data0 and res.data1 and, before this fix, declared their result as an...

CVE-2026-13343 Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder

The UMP Stream responder library in lib/midi2/umpstreamresponder.c builds reply packets in a 16-byte struct midiump uint32t data4. The builders makeendpointinfo and makefunctionblockinfo populate only the first two words res.data0 and res.data1 and, before this fix, declared their result as an...

CVE-2026-75904

A flaw was found in libmodplug. An out-of-bounds read vulnerability exists in the patsmplooped function when processing a specially crafted MIDI Musical Instrument Digital Interface file. This flaw occurs because the function incorrectly handles a sample index, leading to a read one byte before a...

PT-2026-80902

The UMP Stream responder library in lib/midi2/ump stream responder.c builds reply packets in a 16-byte struct midi ump uint32 t data4. The builders make endpoint info and make function block info populate only the first two words res.data0 and res.data1 and, before this fix, declared their result...

CVE-2026-74502

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA Universal MIDI Packet UMP driver. This vulnerability, a double free error, occurs when handling legacy raw MIDI Musical Instrument Digital Interface conversions. Specifically, an error during the initialization of a USB...

SUSE CVE-2026-75904

libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array patloops, so an index of zero reads patloops-1, one byte...

CVE-2026-72443

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA USB audio driver. During the handling of MIDI 2.0 input Universal Serial Bus USB Request Blocks URBs, a setup failure can lead to a use-after-free vulnerability. This allows a local attacker, or a malicious USB device, ...

CVE-2026-74501

A flaw was found in the ALSA USB audio driver of the Linux kernel. A malicious USB MIDI 2.0 device can trigger a use-after-free vulnerability by causing a creation failure after an endpoint is registered. This can lead to a slab use-after-free read when the Universal MIDI Packet UMP node is...

Linux Distros Unpatched Vulnerability : CVE-2026-75904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index...

CVE-2026-75904

libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array patloops, so an index of zero reads patloops-1, one byte...

CVE-2026-75904

libmodplug ≤0.8.9.1 has an out-of-bounds read in pat_smplooped (src/load_pat.cpp): an smpno of zero indexes pat_loops[-1]. A crafted 32-byte MIDI file via ModPlug_Load triggers it through CSoundFile::Create, CSoundFile::ReadMID, and MID_ReadPatterns. Adjacent static storage influences playback st...

CVE-2026-75904 libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File

libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array patloops, so an index of zero reads patloops-1, one byte...

CVE-2026-75904

libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array patloops, so an index of zero reads patloops-1, one byte...

EUVD-2026-60967

libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array patloops, so an index of zero reads patloops-1, one byte...

CVE-2026-75904 libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File

libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array patloops, so an index of zero reads patloops-1, one byte...

PT-2026-77161

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat smplooped in src/load pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat loops, so an index of zero reads pat loops-1, one byt...

Linux Distros Unpatched Vulnerability : CVE-2026-72443

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to...