CVE-2026-111130

OpenSlide versions through 4.0.1 are vulnerable to a heap out-of-bounds read in the MIRAX reader . The root cause involves crafted Slidedat.ini values where the CameraImageDivisionsPerSide does not evenly divide the image counts, leading to an out-of-bounds read of the slide_positions array. This...

EUVD-2026-102361

OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slidepositions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts,...

CVE-2026-111130 OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position

OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slidepositions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts,...

CVE-2021-34600

Original README below Proof of Concept for CVE-2021-34600 A detailed explanation of how this PoC works can be found within our blog post. On the user facing side we only added two new commands: hf 14a getchallenge and hf 14a opendoor . To make those work, we had to mix some code from the iceman...

CVE-2021-21017

CVE-2021-21017 Not another Adobe Reader Byte Order Mark bug : IA32 plugin, ver. 2020.013.20074. char cdecl FUN2581894cchar baseurl,LPCSTR relurl ............................................................ ............................................................ if baseurl != char 0x0 && relu...

CVE-2026-3462

CVE-2026-3462 Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' CWE-1321 CVE-2026-34621 - Advanced Cross-Platform Exploit Generator =========================================================== Generates a malicious PDF that exploits Adobe...

CVE-2021-39863

CVE-2021-39863 Adobe Acrobat Reader DC 21.005.20048.43252 32 bit Down load this version : https://ardownload2.adobe.com/pub/adobe/reader/win/AcrobatDC/2100520048/AcroRdrDC2100520048enUS.exe Bypass ASLR, DEP Non Bypass CFG Analysis Team Blog Team Member Blog - mntly Adobe root cause.pdf : Explain...

Astra Linux – Vulnerability in libxml2

A issue was discovered in libxml2 before versions 2.11.7 and 2.12.x, and even before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to a use-after-free of the xmlValidatePopElement function...

Astra Linux – Vulnerability in Firefox and Thunderbird

Requests initiated through the reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

PoC-CVE-2020-9715

CVE-2020-9715 EDR Validation PoC Use-after-free in Adobe Acrobat Reader DC's EScript.api ESObject cache. For authorized red team EDR testing only. Vulnerability Adobe Acrobat Reader DC = 2020.009.20063. The EScript engine caches data ESObjects with keys that preserve the original encoding ANSI or...

PT-2026-115136

OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts,...

CVE-2026-111130: Out-of-bounds Read

OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slidepositions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts,...

CVE-2026-14532

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 are vulnerable to an Integer Overflow (CWE-190) that allows an attacker with Reader-role privileges to obtain version information, which can trigger an uncaught exception . This issue also affects IBM Tivoli Application...

CVE-2026-14532 IBM WebSphere Application Server Liberty Integer Overflow

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception...

CVE-2026-14532: Integer Overflow or Wraparound

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception...

DEBIAN-CVE-2026-109252

FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERBRPCINTERNALNAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names...

CVE-2026-109252

FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERBRPCINTERNALNAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names...

CVE-2026-109252

FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERBRPCINTERNALNAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names...

EUVD-2026-97612

SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource exhaustion. A publish reader, or anyone when publish auth is disabled, can use uncapped functions like until to OOM-kill the kernel with one request...

CVE-2026-109252 FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC_INTERNAL_NAME

FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERBRPCINTERNALNAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names...