OSV-2026-711 Use-of-uninitialized-value in jxl::PerformMulBlending

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=511400706 Crash type: Use-of-uninitialized-value Crash state: jxl::PerformMulBlending jxl::PerformBlending jxl::NAVX2::BlendingStage::ProcessRow...

CVE-2025-61310

A reflected cross-site scripted XSS vulnerability in the acc-menubillings.php component of GmbH Mecury Managed Print Services docuForm v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value...

PT-2026-49745

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=511443006 Crash type: Use-of-uninitialized-value Crash state: ojph::local::tile::pull ojph::local::codestream::pull ojph expand fuzz target.cpp...

PT-2026-39663

Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.39 Description BentoML is a Python library used for building online serving systems optimized for AI applications and model inference. The issue occurs because the template src/bentoml/...

PT-2026-69228

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=511400706 Crash type: Use-of-uninitialized-value Crash state: jxl::PerformMulBlending jxl::PerformBlending jxl::N AVX2::BlendingStage::ProcessRow...

PT-2026-39608

A reflected cross-site scripted XSS vulnerability in the dfm-menu alerts.php component of GmbH Mecury Managed Print Services docuForm v11.11c allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into an unfiltered variable value...

CVE-2026-7262

CVE-2026-7262 affects PHP 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6. When a SOAP server uses a typemap, the decoding process checks the wrong variable for missing value elements, which can dereference a NULL pointer and crash the PHP SOAP server, causin...

CVE-2026-7262 NULL pointer dereference in SOAP apache:Map decoder with missing <value>

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer,...

CVE-2026-7262

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer,...

CVE-2026-7262 NULL pointer dereference in SOAP apache:Map decoder with missing <value>

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer,...

SUSE SLES12 Security Update : strongswan (SUSE-SU-2026:1762-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1762-1 advisory. - CVE-2026-35329: NULL pointer dereference when processing padding in PKCS7 bsc1261717. - CVE-2026-35330: integer underflow when handling...

openjph:ojph_expand_fuzz_target: Use-of-uninitialized-value in ojph::local::tile::pull

Project: https://github.com/aous72/OpenJPH.git Detailed Report: https://oss-fuzz.com/testcase?key=5957724247752704 Project: openjph Fuzzing Engine: libFuzzer Fuzz Target: ojphexpandfuzztarget Job Type: libfuzzermsanopenjph Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

libjxl:djxl_fuzzer: Use-of-uninitialized-value in jxl::PerformMulBlending

Detailed Report: https://oss-fuzz.com/testcase?key=4954385250844672 Project: libjxl Fuzzing Engine: libFuzzer Fuzz Target: djxlfuzzer Job Type: libfuzzermsanlibjxl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: jxl::PerformMulBlending jxl::PerformBlending...

CVE-2026-43474

A flaw was found in the Linux kernel's fuse filesystem. A local user could exploit an uninitialized value vulnerability when calling vfsfileattrget. This could potentially lead to information disclosure or system instability...

CVE-2026-6665

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow...

Linux Distros Unpatched Vulnerability : CVE-2026-41570

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes used for isolated/PHPT test executi...

Command Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Command Injection via the setvalue function when the section parameter is not properly validated for newline characters. An attacker can execute arbitrary code by...

openjph:ojph_expand_fuzz_target: Use-of-uninitialized-value in ojph::local::tile::finalize_alloc

Project: https://github.com/aous72/OpenJPH.git Detailed Report: https://oss-fuzz.com/testcase?key=5846319028830208 Project: openjph Fuzzing Engine: libFuzzer Fuzz Target: ojphexpandfuzztarget Job Type: libfuzzermsanopenjph Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

c-blosc2:decompress_frame_fuzzer: Use-of-uninitialized-value in get_coffset

Detailed Report: https://oss-fuzz.com/testcase?key=4559143301349376 Project: c-blosc2 Fuzzing Engine: libFuzzer Fuzz Target: decompressframefuzzer Job Type: libfuzzermsanc-blosc2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: getcoffset framegetchunk...

CVE-2026-43349

A flaw was found in the Linux kernel's Flash-Friendly File System f2fs. This vulnerability allows a local attacker to cause an uninitialized value access in the f2fssanitychecknodefooter function. This occurs when the system fails to read data from a device into a folio, potentially leading to...