CVE-2026-19325

A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. This affects the function readMemoryBankFile/appendMemoryBankEntry of the file src/index.ts of the component readmemorybankfile/appendmemorybankentry...

SUSE CVE-2026-18220

An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend bfd/elf32-dlx.c in GNU binutils. The dlxrtypetohowto function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values via...

JLSEC-2026-1197 A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream...

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE, subsequently invokes curleasyreset, and finally terminates the handle with curleasycleanup. During this final cleanup phase, libcurl...

SUSE CVE-2026-70630

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

SUSE CVE-2026-70632

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode function fails to enforce...

CVE-2026-62996

A flaw was found in Smarty, a PHP template engine. Smarty's stream resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template. An attacker able to author or influence a template's resource reference could exploit this by using...

CVE-2026-62996

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-62996

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

GHSA-RJHH-76WF-8XMW Smarty Security stream restriction bypass through stream: resource

smarty/smarty version 5.8.0 can read local files through PHP stream wrappers even when Smarty Security is enabled and all streams are disabled with Security::$streams = null. The bypass uses Smarty's built-in stream: resource type. A template such as: smarty include...

Smarty Security stream restriction bypass through stream: resource

smarty/smarty version 5.8.0 can read local files through PHP stream wrappers even when Smarty Security is enabled and all streams are disabled with Security::$streams = null. The bypass uses Smarty's built-in stream: resource type. A template such as: smarty include...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the stream resource type, which allows bypassing intended security checks on PHP stream wrappers. An attacker can read arbitrary local files accessible to the PHP process by including specially crafted templa...

EUVD-2026-54499

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-62996

Smarty is vulnerable in versions 5.0.0 through 5.8.3 due to improper restriction of stream: resource-name handling, allowing a php://filter-wrapped resource to read arbitrary local files accessible to the PHP process. An attacker who can influence a template’s resource reference could disclose se...

CVE-2026-62996 Smarty Security stream restriction bypass through stream: resource

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-62996 Smarty Security stream restriction bypass through stream: resource

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-62996

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-62996 Smarty Security stream restriction bypass through stream: resource

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

JLSEC-2026-1172 FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub...

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in...

JLSEC-2026-1192 FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write...

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD CFHD decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhddecode function fails to enforce...

CVE-2026-66838

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...