CVE-2026-2660 FascinatedBox lily lily_symtab.c shorthash_for_name use after free

A vulnerability was identified in FascinatedBox lily up to 2.3. Affected by this issue is the function shorthashforname of the file src/lilysymtab.c. The manipulation leads to use after free. Local access is required to approach this attack. The exploit is publicly available and might be used. Th...

CVE-2026-2660 FascinatedBox lily lily_symtab.c shorthash_for_name use after free

A vulnerability was identified in FascinatedBox lily up to 2.3. Affected by this issue is the function shorthashforname of the file src/lilysymtab.c. The manipulation leads to use after free. Local access is required to approach this attack. The exploit is publicly available and might be used. Th...

CVE-2026-2659 Squirrel sqfuncstate.cpp PopTarget out-of-bounds

A vulnerability was determined in Squirrel up to 3.2. Affected by this vulnerability is the function SQFuncState::PopTarget of the file src/squirrel/squirrel/sqfuncstate.cpp. Executing a manipulation of the argument targetstack can lead to out-of-bounds read. It is possible to launch the attack o...

CVE-2026-2658

A vulnerability was found in newbee-ltd newbee-mall up to a069069b07027613bf0e7f571736be86f431faee. Affected is an unknown function of the component Multiple Endpoints. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-2658 newbee-ltd newbee-mall Multiple Endpoints cross-site request forgery

A vulnerability was found in newbee-ltd newbee-mall up to a069069b07027613bf0e7f571736be86f431faee. Affected is an unknown function of the component Multiple Endpoints. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-2658 newbee-ltd newbee-mall Multiple Endpoints cross-site request forgery

A vulnerability was found in newbee-ltd newbee-mall up to a069069b07027613bf0e7f571736be86f431faee. Affected is an unknown function of the component Multiple Endpoints. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-2658

The CVE affects the newbee-ltd newbee-mall project (up to a069069b07027613bf0e7f571736be86f431faee) with an issue in the Unknown function of the Multiple Endpoints component. The described impact is cross-site request forgery (CSRF) arising from a manipulation of that function, with remote exploi...

CVE-2026-2657

CVE-2026-2657 affects the Wren language (wren) up to version 0.4.0. The vulnerability is in the function printError within src/vm/wren_compiler.c of the Error Message Handler, where manipulation can cause a stack-based buffer overflow. The advisory notes a local attack vector and that an exploit ...

Hugging Face Smolagents has a Server-Side Request Forgery issue

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-2654

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-2655

A vulnerability was detected in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::strless::operator of the file include/chaiscript/chaiscriptdefines.hpp. The manipulation results in use after free. The attack requires a local approach. The attack requires a high level of...

CVE-2026-2655 ChaiScript chaiscript_defines.hpp operator use after free

A vulnerability was detected in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::strless::operator of the file include/chaiscript/chaiscriptdefines.hpp. The manipulation results in use after free. The attack requires a local approach. The attack requires a high level of...

CVE-2026-2654 huggingface smolagents LocalPythonExecutor requests.post server-side request forgery

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-2654 huggingface smolagents LocalPythonExecutor requests.post server-side request forgery

A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made...

PYSEC-2026-5

A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stlchecknormalvector of the file src/normals.c. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the...

PYSEC-2026-5

A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stlchecknormalvector of the file src/normals.c. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the...

CVE-2026-2653 admesh normals.c stl_check_normal_vector heap-based overflow

A security flaw has been discovered in admesh up to 0.98.5. This issue affects the function stlchecknormalvector of the file src/normals.c. Performing a manipulation results in heap-based buffer overflow. The attack must be initiated from a local position. The exploit has been released to the...

CVE-2026-2644 niklasso minisat DIMACS File SolverTypes.h value out-of-bounds

A weakness has been identified in niklasso minisat up to 2.2.0. This issue affects the function Solver::value in the library core/SolverTypes.h of the component DIMACS File Parser. This manipulation of the argument variable index with the input 2147483648 causes out-of-bounds read. The attack nee...

CVE-2026-2642 ggreer the_silver_searcher search.c search_stream null pointer dereference

A security vulnerability has been detected in ggreer thesilversearcher up to 2.2.0. The impacted element is the function searchstream of the file src/search.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed...

AZL-78087 CVE-2026-2641 affecting package ctags 6.1.0-1

A weakness has been identified in universal-ctags ctags up to 6.2.1. The affected element is the function parseExpression/parseExprList of the file parsers/v.c of the component V Language Parser. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack on t...