CVE-2026-73496

MCP Atlassian , a Model Context Protocol server for Confluence and Jira, is vulnerable to arbitrary server-side file read via attachment upload prior to version 0.22.0. The confluence_upload_attachment, confluence_upload_attachments, and jira_update_issue attachment functions pass a client-contro...

CVE-2026-55093 tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs readtensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length...

EUVD-2026-77792

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs readtensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length...

CVE-2026-55093 tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs readtensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length...

CVE-2026-55093

Tract (a self-contained TensorFlow/ONNX inference toolkit by Sonos) is affected by an integer overflow in tract-nnef's read_tensor function that leads to an out-of-bounds heap read when loading a crafted NNEF model archive. The unchecked usize multiplication over attacker-controlled tensor dimens...

CVE-2026-90815 FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup3x3 of the file libavfilter/vfconvolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploi...

CVE-2026-90815

FFmpeg is vulnerable to an out-of-bounds read in the Convolution Filter component, specifically in the function setup_3x3 of libavfilter/vf_convolution.c. The vulnerability is remotely exploitable and can be triggered without authentication, though user interaction is required (CVSS 3.1 score 6.3...

EUVD-2026-77791

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup3x3 of the file libavfilter/vfconvolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploi...

CVE-2026-90815 FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup3x3 of the file libavfilter/vfconvolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploi...

CVE-2026-90815

A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup3x3 of the file libavfilter/vfconvolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploi...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

CVE-2026-52297

A flaw was found in FFmpeg. An out-of-bounds read can occur when a specially crafted MOV file is parsed due to insufficiently padded extradata. This vulnerability can lead to an application crash, resulting in a denial of service. Mitigation Do not parse untrusted files with the MOV demuxer in...

CVE-2026-52296

A flaw was found in FFmpeg. An out-of-bounds read can occur when a specially crafted file is encoded into the WMA Windows Media Audio format due to a missing required padding in extradata allocation. This issue can lead to an application crash, resulting in a denial of service. Mitigation Do not...

CVE-2026-90946

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repourl as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including...

CVE-2026-55832

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled externaldata location from an ONNX model through onnx/src/tensor.rs getexternalresources and joins the value to the model...

CVE-2026-34151

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues due to IBM Semeru runtime

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities reported for IBM Semeru Runtime and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

EUVD-2026-77721

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled externaldata location from an ONNX model through onnx/src/tensor.rs getexternalresources and joins the value to the model...

CVE-2026-55832

Tract (tract-onnx crate, a Rust inference toolkit for TensorFlow/ONNX) is vulnerable to arbitrary local file read when loading an untrusted ONNX model. The external_data location field is joined to the model directory via Path::join without rejecting absolute paths or .. components, so the defaul...