CVE-2026-91156

The Discourse open-source discussion platform is vulnerable to an authorization bypass in the MessageBus audience calculation. Prior to versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 , the system failed to enforce Chat eligibility, allowing authenticated users who could view a category but w...

CVE-2026-91156 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the...

CVE-2026-73126

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...

CVE-2026-110618

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or...

DEBIAN-CVE-2026-110606

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

CVE-2026-110606

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

DEBIAN-CVE-2026-110598

Libyal libpff through 20260926 contains an integer underflow in libpffrecordentrygetmultivalue that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PTMVSTRING8, PTMVUNICODE or PTMVBINARY offsets ...

CVE-2026-110597

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

DEBIAN-CVE-2026-110597

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute bounds...

AZL-108312 CVE-2024-58392 affecting package physfs 3.0.2-4

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

DEBIAN-CVE-2024-58392

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

CVE-2024-58392

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFSutf8codepoint that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing...

CVE-2024-58392

A flaw was found in PhysicsFS. An attacker could cause a Denial of Service DoS by supplying a specially crafted archive file. Due to an out-of-bounds read flaw when decoding multi-byte UTF-8 character sequences in entry names, the library advances past the end of the input buffer during string...

K000163720: Apache Tomcat vulnerabilities CVE-2026-86243, CVE-2026-86246, and CVE-2026-86247

Security Advisory Description CVE-2026-86243 Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupporte...

ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

CVE-2026-110716 unshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table

unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshieldgetfiletable that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range filetableoffset or large file counts to...

EUVD-2026-101139

unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshieldgetfiletable that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range filetableoffset or large file counts to...

CVE-2026-110716 unshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table

unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshieldgetfiletable that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range filetableoffset or large file counts to...

CVE-2026-110716

unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshieldgetfiletable that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range filetableoffset or large file counts to...

CVE-2026-110716

The unshield through 1.6.2 tool and its associated library are vulnerable to a heap out-of-bounds read in the unshield_get_file_table() function. This issue occurs because the software fails to validate cabinet header offsets , allowing an attacker to provide a crafted InstallShield cabinet with ...