SUSE CVE-2026-19967

A security flaw has been discovered in Open Asset Import Library Assimp 17c12da. Impacted is the function Assimp::Compression::decompressBlock of the file code/Common/Compression.cpp of the component File Parser. Performing a manipulation results in heap-based buffer overflow. The attack may be...

SUSE CVE-2026-19968

A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ReadFaces3DGSMDL7 in the library code/AssetLib/LWO/LWOLoader.h of the component 3DGS MDL7 Model Parser. Executing a manipulation can lead to heap-based buffer...

SUSE CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

SUSE CVE-2026-19999

A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The manipulati...

SUSE CVE-2026-59893

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse,...

CVE-2026-50126

adaguc-server (versions prior to 7.2.2) has a memory-safety flaw in adagucserverEC/CConvertGeoJSON.cpp: it indexes coordinate array values and uses array length as a loop bound without validating JSON node type or coordinate length, affecting Polygon, LineString, MultiLineString and MultiPolygon ...

EUVD-2026-61048

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-50126 adaguc-server GeoJSON coordinate parser (CConvertGeoJSON.cpp) vulnerable to out-of-bounds read and NULL pointer dereference

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-50126 adaguc-server GeoJSON coordinate parser (CConvertGeoJSON.cpp) vulnerable to out-of-bounds read and NULL pointer dereference

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-50126

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-55839

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

CVE-2026-45116

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verifyprofilefields only performs the specialized validation when...

CVE-2026-55839 Kestra: Stored XSS via custom Markdown [[link]] attribute injection

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

CVE-2026-55839 Kestra: Stored XSS via custom Markdown [[link]] attribute injection

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

CVE-2026-55839

Kestra , an open-source event-driven orchestration platform, is vulnerable to stored cross-site scripting (XSS) in versions prior to 1.3.24 . The root cause is in the custom Markdown parser (ui/src/utils/markdown_plugins/link.ts), which renders parsed attributes from the [[link]] syntax directly ...

CVE-2026-55839

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

CVE-2026-55839 Kestra: Stored XSS via custom Markdown [[link]] attribute injection

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

EUVD-2026-60976

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

UBUNTU-CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

CVE-2026-72200

A flaw was found in the Linux kernel's NTFS mapping-pairs parser. A corrupted attribute can cause a signed integer overflow when processing Logical Cluster Number LCN deltas. This overflow leads to undefined behavior, which may result in the system incorrectly interpreting file system structures...