99 matches found
CVE-2026-119132 Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and...
CVE-2026-119132
The Wasmtime runtime (versions 49.0.0 before 49.0.3 ) is vulnerable to a denial-of-service flaw. The root cause is the transcoding of overlapping strings within fused adapters , which allows a WebAssembly guest to trigger a host panic . An attacker can cause a host crash by making a same-instance...
CVE-2026-119132 Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter
Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and...
VulnCheck KEV: CVE-2026-96655
Plex Media Server contains a server-side request forgery SSRF vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and...
Overlapping string transcode in a fused adapter can panic
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q For more information see the GitHub-hosted security advisory...
CVE-2026-96655
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...
EUVD-2026-85369
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...
CVE-2026-96655 Plex Media Server arbitrary-host SSRF
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...
CVE-2026-96655
Plex Media Server versions prior to 1.43.3.10861 are vulnerable to a Server-Side Request Forgery (SSRF) flaw (CWE-918). An authenticated user can leverage the /video/:/transcode/universal path parameter to force the server to request arbitrary internal or external addresses. This vulnerability is...
CVE-2026-96655 Plex Media Server arbitrary-host SSRF
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...
CVE-2026-96655: Server-Side Request Forgery (SSRF)
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...
PT-2026-97405
Name of the Vulnerable Software and Affected Versions Plex Media Server versions prior to 1.43.3.10861 Description An authenticated user can perform a Server-Side Request Forgery SSRF, which occurs when a server is tricked into making requests to an unintended location. This is possible by...
Plex Media Server server-side request forgeing vulnerability
Versions of Plex Media Server prior to 1.43.3.10861 have a vulnerability related to server-side request forgery. This vulnerability stems from improper handling of the '/video/:/transcode/universal' path parameter. It may allow authenticated users to request arbitrary internal or external...
CVE-2026-87875 Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound
The cupsUTF32ToUTF8 function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content...
CVE-2026-87875
The cupsUTF32ToUTF8 function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content. Mitigation...
Malicious code in dd-transcode-ctrl (npm)
The package dd-transcode-ctrl was found to contain malicious code. --- Credit: OpenSSF source...
PT-2026-80540
Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the transcode latin1 to utf8 function in xlstool.c:296...
EUVD-2017-0353
Malware in sbrugna...