CVE-2026-77220

PDFio before 1.6.5 contains a dangling pointer vulnerability in its dictionary string-formatting function. The root cause is that a pointer to a stack-local buffer is stored in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, this allows ...

CVE-2026-77220 PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can...

CVE-2026-77220 PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can...

EUVD-2026-64163

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can...

JLSEC-2026-1364 Wasmtime has out-of-bounds write or crash when transcoding component model strings

Impact Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated before the host attempts to write through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes...

CVE-2026-76905 kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

CVE-2026-76905 kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

CVE-2026-76905 kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validationerrorencoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data...

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains, , function writes into generated SQL without...

GHSA-MQJF-5F49-2FJH GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains, , function writes into generated SQL without...

CVE-2026-50290

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes \65xpression, null bytes, or CSS comments exp//ression. These CSS injection...

EUVD-2026-64133

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-76904

GeoTools (open-source Java geospatial library) is affected by an unauthenticated SQL injection in the jsonArrayContains OGC Filter function within the PostGIS DataStore implementation. Affected versions are 30.5 through 33.5 (branch 33) and through 34.4 (branch 34). The root cause is that the pa...

USN-8669-1: Linux kernel (NVIDIA) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Drivers core; - Null block...

USN-8669-1 linux-nvidia-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Drivers core; - Null block...

EUVD-2026-64123

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes \65xpression, null bytes, or CSS comments exp//ression. These CSS injection...

CVE-2026-50290

SpecifyJS (@asymmetric-effort/specifyjs), a declarative TypeScript UI framework, had a CSS sanitization bypass in its renderToString function (core/src/server/render-to-string.ts:307-311). Prior to v0.2.136 , the regex-based filter for expression( and url(javascript: could be circumvented using C...

CVE-2026-50290 @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes \65xpression, null bytes, or CSS comments exp//ression. These CSS injection...