CVE-2026-51273

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf to write formatted strin...

CVE-2026-51273

In the ESP32-based schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow is reported in the ID3 tag parsing function showID3Tag() within the embedded audio streaming library. The issue arises when the program reads untrusted, long ID3 tag values from crafted audio files and uses unbound...

CVE-2026-51273

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf to write formatted strin...

PT-2026-65532

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the ID3 tag parsing function showID3Tag of the embedded audio streaming library. The program reads untrusted long ID3 tag value from malicious audio files and uses unbounded appendf to write formatted strin...

PT-2026-65428

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wp unslash which removes...

EUVD-2026-49866

schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the host parsing logic. The dismantlehost function parses untrusted host and URL input, and subsequent code uses clonefrom to copy parsed host, request host, extension and querystring segments into fixed heap...

CVE-2026-51268

ESP32-audioI2S 3.4.5 is affected by a heap-based buffer overflow in the host parsing logic. The dismantle_host() function parses untrusted host and URL input, and subsequent code uses clone_from() to copy parsed host, request host, extension, and query_string segments into fixed heap buffers with...

EUVD-2026-49863

schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openaispeech function in the Audio library manually constructs JSON request bodies and HTTP request headers by directly concatenating externally controllable input and instructions strings without effective length...

CVE-2026-51261

Missing mutex synchronization in AudioBuffer::freeSpace in schreibfaul1 ESP32-audioI2S 3.4.5 creates a race condition between concurrent tasks. The function calculates available buffer space without protecting shared read/write pointers, returning an incorrectly large value. Trusting this value...

CVE-2026-51252

The CVE-2026-51252 entry concerns schreibfaul1 ESP32-audioI2S 3.4.5, with a buffer overflow in MP3Decoder::UnpackSFMPEG1 caused by missing input validation on attacker-controlled MP3 metadata. The connected records assign a CVSS v3.1 base score of 9.8 (CRITICAL) with network attack vector, no pri...

CVE-2026-51275

In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 APIC frame parsing function in audiolib allows remote attackers to execute arbitrary code or cause a denial of service crash via a crafted MP3 file. The vulnerability exists due to missing length validation when...

Multiples vulnerabilities in jsPDF

Brocade SANnav provides security updates for multiple CVEs affecting jsPDF. CVE-2025-68428 sPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given...

OpenSSL 3.5.0 < 3.5.5 Multiple Vulnerabilities in SANnav images

Brocade SANnav has provided security updates to multiple vulnerabilities as referenced in the 3.5.5 advisory and as described in the Nessus Plugin ID 296768 - Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher suite fro...

Linux Distros Unpatched Vulnerability : CVE-2026-51298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree, the program still access...

OpenSSL 3.0.0 < 3.0.18 Multiple Vulnerabilities detected in Nginx

Brocade SANnav provides Security updates for CVEs disclosed in OpenSSL Security Advisory 30th September 2025. - Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'noproxy' environment variable is set and the host portion of the...

OpenSSL 3.5.0 < 3.5.4 Multiple Vulnerabilities in SANnav images

The version of OpenSSL installed on the remote host is prior to 3.5.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.5.4 advisory. - Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm...

Security update for agama-web-ui (important)

openSUSE security update: security update for agama-web-ui ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21448-1 Rating: important References: bsc1246822 bsc1259169 bsc1268851 bsc1269359 bsc1269514 bsc1269595 bsc1269927 bsc1272310 bsc1272311...

PT-2026-65683

Summary The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate ...

Axios affected by Denial of Service via __proto__ Key in mergeConfig

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing proto as an own property. An attacker can trigger this by providing a malicious...

Postgres Vulnerabilities in Brocade SANanv before 3.0.1 - CVE-2026-2006, CVE-2026-2005, CVE-2026-2004, CVE-2026-2003

Security update is provided in Brocade SANav for multiple Postgres vulnerabilities. CVE-2026-2006 PostgreSQL missing validation of multibyte character length executes arbitrary code Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue...