EUVD-2026-85885

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97059

Versions of DCMTK through 3.7.0 are vulnerable to a heap over-read in the ConcatenationLoader component. The root cause is a failure to validate the PixelData buffer length against the declared NumberOfFrames when copying pixel data frames. Attackers can exploit this by crafting malicious DICOM i...

CVE-2026-97059 DCMTK through 3.7.0 Heap Over-read via NumberOfFrames

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97059 DCMTK through 3.7.0 Heap Over-read via NumberOfFrames

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97059

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-79616

A flaw was found in Qt Quick. This out-of-bounds read vulnerability occurs when parsing untrusted SVG path strings in the Context2D.path or PathSvg.path properties. A local attacker with low privileges could exploit this flaw with user interaction to cause a Denial of Service DoS. Mitigation...

CVE-2026-88841

BusyBox dpkg writestatusfile does not reset a stale field cursor between package stanzas, causing out-of-bounds reads and status file corruption when removing multiple packages. Mitigation Do not use the BusyBox dpkg applet for package management on systems where package integrity is critical...

Path Traversal

Mockoon is vulnerable to Path Traversal. The vulnerability is due to insufficient path validation using a prefix check without a path-separator boundary, which allows an unauthenticated attacker to use ../ traversal sequences to access and read files from sibling directories outside the intended...

Astra Linux – Vulnerability in Chromium

In version 152.0.7977.65, an uninitialized resource in Dawn in Google Chrome allowed a remote attacker to potentially read memory within the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Before version 152.0.7977.65, reading out of bounds in Skia using Google Chrome allowed a remote attacker to potentially read memory within the sandbox through a crafted media file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In version 152.0.7977.65, an uninitialized resource in the Video tab of Google Chrome allowed a remote attacker to read memory within the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in WebRTC in Google Chrome prior to version 151.0.7922.72 allowed a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

A “off-by-one” error in DevTools in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox through a crafted Chrome extension, using social engineering techniques. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

In ANGLE, an uninitialized resource in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In ANGLE, an uninitialized resource in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside of the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In Google Chrome, before version 153.0.8010.36, uninitialized resources in Codecs allowed a remote attacker to read memory within the sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Before version 153.0.8010.36, reading out of bounds in WebGL in Google Chrome allowed a remote attacker to potentially execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

In WebXR, a out-of-bounds read in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out-of-bounds memory read through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Integer overflow in WebRTC in Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to read memory within the sandbox through a crafted HTML page. Chromium security severity: Medium...

CVE-2026-77193

The eesyID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the id2wppath parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...