GHSA-W8WR-V893-VJVP node-tar: Process crash via PAX numeric path type confusion

Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls .split'/' on the numeric value. Error handlers and strict: false cannot...

Cross-site Scripting (XSS)

Overview loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Loofah::HTML5::Scrub.alloweduri? method, which relies on CGI.unescapeHTML and...

SUSE CVE-2026-15043

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the ismatched method, = was evaluated using Perl's le operator...

CVE-2026-55142

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally...

CVE-2026-50402

Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally...

CVE-2026-50357

Numeric truncation error in Windows Resilient File System ReFS allows an authorized attacker to execute code locally...

CVE-2026-49792

Numeric truncation error in Windows Resilient File System ReFS allows an authorized attacker to execute code locally...

CVE-2026-49792

CVE-2026-49792 is a Windows ReFS vulnerability due to a numeric truncation error that allows an authorized, local attacker to execute code. Affected component is Windows Resilient File System (ReFS); impact is local code execution with high confidentiality, integrity, and availability impact as p...

NTFS Elevation of Privilege Vulnerability

Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally...

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Numeric truncation error in Windows Resilient File System ReFS allows an authorized attacker to execute code locally...

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Numeric truncation error in Windows Resilient File System ReFS allows an authorized attacker to execute code locally...

Microsoft Word Information Disclosure Vulnerability

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally...

PT-2026-58164

Name of the Vulnerable Software and Affected Versions Windows Resilient File System ReFS affected versions not specified Description A numeric truncation error in the Windows Resilient File System ReFS allows an authorized attacker to execute code locally. Recommendations At the moment, there is ...

PT-2026-58585

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A numeric truncation error occurs in Microsoft Office Word, which could allow an unauthorized attacker to disclose information locally. This issue enables attackers to obtain...

PT-2026-58381

Name of the Vulnerable Software and Affected Versions Windows NTFS affected versions not specified Description An incorrect conversion between numeric types in the Windows NTFS file system allows an authorized attacker with local access to elevate their privileges locally. Recommendations At the...

PT-2026-58340

Name of the Vulnerable Software and Affected Versions Windows Resilient File System ReFS affected versions not specified Description A numeric truncation error in the Windows Resilient File System ReFS allows an authorized attacker to execute code locally, potentially enabling local privilege...

CVE-2026-15551

CVE-2026-15551 : Samsung Open Source rlottie fraught with an integer overflow/ wraparound in the function gray_hline() , causing a heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size. Risk details: attacker-controlled input through a crafted animation; CVSS3...

CVE-2026-15551 Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas size

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects...

OPENSUSE-SU-2026:21297-1 Security update for uriparser

This update for uriparser fixes the following issues - CVE-2026-42371: numeric truncation in text range comparison when an application accepts URIs with a length in gigabytes bsc1262999. - CVE-2026-44927: truncation of ptrdifft to int in various places bsc1264578. - CVE-2026-44928: function famil...

CVE-2026-15300

The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The values were read from $SERVER'QUERYSTRING' via parsestr bypassing wpmagicquotes, which does not cover $SERVER, then passed through bare...