CVE-2026-91965 WWBN AVideo through 29.0 Broken Access Control via Live Endpoints

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct H...

rabbitmq-server: RabbitMQ: Denial of Service via unbounded super-stream partition allocation

A flaw was found in RabbitMQ. A highly privileged remote attacker, with the rabbitmqstreammanagement plugin enabled and access to the target vhost, can exploit an unbounded allocation vulnerability in the super-stream partitions. This allows the attacker to allocate a large amount of memory,...

rabbitmq-server: RabbitMQ: Privilege escalation via super-stream HTTP creation

A flaw was found in RabbitMQ. A user with management tag and virtual host vhost access, but lacking configure permissions, can exploit a vulnerability in the HTTP API for super-stream creation. This flaw allows the user to bypass permission checks and create persistent cluster-wide resources, suc...

rabbitmq-server: RabbitMQ: Denial of Service via atom table exhaustion in stream chunk_selector

A flaw was found in RabbitMQ. An authenticated stream client with read access to any stream can exploit a vulnerability in the getchunkselector/1 function. This function processes a client-supplied chunkselector property without proper validation, leading to an atom table exhaustion. Successful...

rabbitmq: RabbitMQ: Authenticated user can bypass connection limits via stream protocol

A flaw was found in RabbitMQ. The stream protocol handler does not correctly enforce per-user and per-virtual host vhost connection limits. An authenticated user can exploit this by connecting through port 5552, bypassing the intended connection restrictions. This could lead to resource exhaustio...

CVE-2026-91752

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

CVE-2026-91752

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

CVE-2026-91752 GNU libextractor before 1.15 Stack Overflow via OLE2

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

CVE-2026-91752

GNU libextractor before 1.15 contains a stack-based buffer overflow in the process_star_office function, where a variable-length stack array is sized from attacker-controlled OLE2 stream data. A crafted StarOffice document can force up to 4 MB of stack allocation, triggering a stack overflow that...

EUVD-2026-78234

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

CVE-2026-91752

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

PT-2026-91773

Name of the Vulnerable Software and Affected Versions GNU libextractor versions prior to 1.15 Description A stack-based buffer overflow occurs in the process star office function. The issue arises when the function determines the size of a variable-length stack array using attacker-controlled OLE...

Linux Distros Unpatched Vulnerability : CVE-2026-91752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array fro...

CVE-2026-91752: Memory Allocation with Excessive Size Value

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the processstaroffice function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing...

Linux Distros Unpatched Vulnerability : CVE-2026-19774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on...

PT-2026-92421

Ember's HTTP/2 stack replenishes the inbound flow-control window based on bytes received off the wire, not bytes consumed by the application. Received DATA is buffered in an unbounded per-stream channel. Flow control therefore provides no backpressure: a peer can stream a large or unbounded body...

CVE-2026-91200 DevSpace through 6.3.21 Path Traversal via tar extraction

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

CVE-2026-91200

DevSpace versions through 6.3.21 contain a path traversal vulnerability in the in-pod sync stream's tar extraction logic. The tool fails to reject parent-directory segments in tar entry names, allowing an attacker operating a malicious container to stream tar entries with traversal sequences that...

GHSA-2XMM-M4WV-3FJH October CMS: Incomplete Scheme Validation in Image Resizer

The image resizer classified external sources by testing whether the source string began with the substring http, and the string-source branch in ResizeImageItem::fromObject accepted any value containing :// as a URL. As a result, non-https PHP stream wrappers such as phar://, file:// and ftp://...

October CMS: Incomplete Scheme Validation in Image Resizer

The image resizer classified external sources by testing whether the source string began with the substring http, and the string-source branch in ResizeImageItem::fromObject accepted any value containing :// as a URL. As a result, non-https PHP stream wrappers such as phar://, file:// and ftp://...