CVE-2026-70628

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...

CVE-2026-70628 FFmpeg 0.5 < 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV File

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...

CVE-2026-70628

FFmpeg versions 0.5 up to (but not including) 9.0 are affected by a signed integer overflow in the DVB subtitle parser (libavcodec/dvbsub_parser.c) that can trigger a heap buffer overflow when processing a crafted WTV file. The overflow causes the bounds-check guard to wrap to INT_MIN, bypassing ...

CVE-2026-70628

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsubparser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard...

CVE-2026-71488 league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71488

The CVE concerns league/commonmark (PHP) with a vulnerability in versions 0.6.0–2.9.0 where crafted Markdown can trigger quadratic-time processing during parsing/conversion. The root cause involves repeatedly rescanning growing segments to translate character positions to byte positions, and the ...

GHSA-5P4M-2WFM-XMQJ JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Quadratic CPU consumption in !!omap resolution js-yaml 3.x and 4.x Summary resolveYamlOmap enforces key uniqueness for !!omap sequences with a linear scan objectKeys.indexOf... inside the per-element loop, making resolution On² in the number of entries. A modestly sized YAML document therefore...

CVE-2026-5857 Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...

CVE-2026-5857 Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...

CVE-2026-5855 Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m_tlv_read

Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...

CVE-2026-64573

A flaw was found in the Linux kernel's Bluetooth subsystem, specifically within the qca driver. A local attacker could exploit an integer underflow vulnerability in the NVM tag length parser by providing specially crafted firmware data. This could lead to an out-of-bounds memory write, potentiall...

Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:3521-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

Apache Solr <= 7.1 - XML Entity Injection

Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

CVE-2026-19000

A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachment Parser. The manipulation leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-18995

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out...

CVE-2026-19000

A vulnerability was identified in JeecgBoot up to 3.9.2. The affected element is an unknown function of the file /airag/chat/send of the component Anonymous Chat Attachment Parser. The manipulation leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly...

EUVD-2026-53708

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out...

CVE-2026-18995 netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out...