CVE-2026-112060

The librtmp library in RTMPDump versions through 2.6 is vulnerable to an out-of-bounds read and heap out-of-bounds write vulnerability. The root cause is that AMF3_Decode ignores AMF3 property decode failures. A malicious RTMP server or a man-in-the-middle attacker can exploit this by sending ove...

CVE-2026-112059

Versions of libLAS through 1.8.1 are vulnerable to a heap out-of-bounds write in the point record reader. The root cause is the truncation of the schema byte size to 16 bits when sizing the point buffer. An attacker can exploit this by crafting a .las file containing a LASSchema variable length r...

EUVD-2026-103521

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112059 libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112059

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112059 libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

CVE-2026-112051 Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration

Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/modeltype with name...

CVE-2026-112051

Xinference versions through 4.0.1 are vulnerable to a path traversal vulnerability on Windows systems. This flaw allows unauthenticated attackers to write or delete arbitrary .json files by using backslash sequences within the model_name parameter. Specifically, an attacker can register a persist...

EUVD-2026-103513

Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/modeltype with name...

CVE-2026-112051 Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration

Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/modeltype with name...

CVE-2026-112016

Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into...

CVE-2026-112018

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...

DEBIAN-CVE-2026-112007

Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmtultloadsong in fmt/ult.c that fails to clamp the one-byte sample count to MAXSAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csfdestroy to free...

CVE-2026-112007

Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmtultloadsong in fmt/ult.c that fails to clamp the one-byte sample count to MAXSAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csfdestroy to free...

CVE-2026-112012

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...

CVE-2026-112005

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use readtext, readblob, COPY ... ...

CVE-2026-112018 cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...

CVE-2026-112018 cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...

EUVD-2026-103471

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...

CVE-2026-112018

The cgltf library (through version 1.15 ) is vulnerable to a heap out-of-bounds write within the cgltf_accessor_unpack_floats() function. The root cause is the processing of unchecked sparse accessor indices , which allows an attacker to write outside the designated output buffer. By providing a ...