libsndfile: integer overflow in ima_reader_init()

A flaw was found in the libsndfile library. An integer overflow in the IMA ADPCM codec can occur when a specially crafted WAV audio file is processed, specifically with malicious samplesperblock and blocks values. This can lead to a heap-based buffer overflow, causing a crash to the application...

CLEANSTART-2026-VN16911 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the wave package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-RF77222 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the wave package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-LA96053 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the wave package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.6), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.6) +4782 more potentially affected by CVE-2026-41854 via org.springframework:spring-web (>=7.0.0, <=7.0.7)

org.springframework:spring-web MAVEN version =7.0.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =2.1.0 and more Source cves: CVE-2026-41854 Source advisory: GHSA-7M2P-62GW-P8QQ...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.6), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.6) +846 more potentially affected by CVE-2026-41839 via org.springframework:spring-webflux (>=7.0.0, <=7.0.7)

org.springframework:spring-webflux MAVEN version =7.0.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.7.0-beta.3, =4.7.5 - ch.rasc:wamp2spring-reactive 4.0.0 - ch.rasc:wamp2spring-security-reactive 4.0.0 and more Source cves: CVE-2026-41839...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.6), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.6) +8670 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (>=7.0.0, <=7.0.7)

org.springframework:spring-expression MAVEN version =7.0.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-41851 Source advisory: MEND:CVE-2026-41851...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +6978 more potentially affected by CVE-2026-45416 via io.netty:netty-handler (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-handler MAVEN version =4.2.0.final, =0.4.0, =0.4.0, =1.0.0-beta, =0.6.4, =0.6.4, =0.6.4, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-45416 Source advisory: GHSA-X4GW-5CX5-PGMH...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +6978 more potentially affected by CVE-2026-45416 via io.netty:netty-handler (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-handler MAVEN version =4.2.0.final, =0.4.0, =0.4.0, =1.0.0-beta, =0.6.4, =0.6.4, =0.6.4, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-45416 Source advisory: SNYK:JAVA-IONETTY-17254117...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +1874 more potentially affected by CVE-2026-44894 via io.netty:netty-codec-classes-quic (>=4.2.1.final, <=4.2.14.final)

io.netty:netty-codec-classes-quic MAVEN version =4.2.1.final, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-44894 Source advisory: SNYK:JAVA-IONETTY-17265116...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +6978 more potentially affected by CVE-2026-44249 via io.netty:netty-handler (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-handler MAVEN version =4.2.0.final, =0.4.0, =0.4.0, =1.0.0-beta, =0.6.4, =0.6.4, =0.6.4, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-44249 Source advisory: SNYK:JAVA-IONETTY-17254120...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +6978 more potentially affected by CVE-2026-44249 via io.netty:netty-handler (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-handler MAVEN version =4.2.0.final, =0.4.0, =0.4.0, =1.0.0-beta, =0.6.4, =0.6.4, =0.6.4, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-44249 Source advisory: OSV:GHSA-3QP7-7MW8-WX86...

EUVD-2026-34916

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attacker...

CVE-2026-5506

The Wavr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wave shortcode in all versions up to, and including, 0.2.6. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

EUVD-2026-34870

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval, allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview window.eval and presentation mode plus HTML export the bundled WaveDrom.ProcessAll/ev...

Linux Distros Unpatched Vulnerability : CVE-2026-45928

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: chips-media: wave5: Fix memory leak on codecinfo allocation failure In wave5vpuopenenc and wave5vpuopendec, a vpu instance is allocated via kzalloc. If t...

CVE-2026-39553

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4...

CVE-2026-39553

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4...

CVE-2026-39553

CVE-2026-39553 concerns WordPress WaveRide theme versions up to 1.4, due to improper control of the filename for include/require in a PHP program, enabling Local File Inclusion (LFI). Affected software: WaveRide theme (Select-Themes) with PHP-based inclusion vulnerability. Root cause: inadequate ...

CVE-2026-39553 WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4...