101752 matches found
CVE-2026-112059 libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...
CVE-2026-112059 libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...
CVE-2026-112051 Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/modeltype with name...
CVE-2026-112051
Xinference versions through 4.0.1 are vulnerable to a path traversal vulnerability on Windows systems. This flaw allows unauthenticated attackers to write or delete arbitrary .json files by using backslash sequences within the model_name parameter. Specifically, an attacker can register a persist...
EUVD-2026-103513
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/modeltype with name...
CVE-2026-112051 Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in modelname. Attackers can register a persisted custom model through POST /v1/modelregistrations/modeltype with name...
CVE-2026-112018
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...
CVE-2026-112016
Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into...
DEBIAN-CVE-2026-112007
Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmtultloadsong in fmt/ult.c that fails to clamp the one-byte sample count to MAXSAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csfdestroy to free...
CVE-2026-112012
libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in ttadecoderprocessstream and ttadecoderprocessframe because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache-1 with...
CVE-2026-112007
Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmtultloadsong in fmt/ult.c that fails to clamp the one-byte sample count to MAXSAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csfdestroy to free...
CVE-2026-112005
WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use readtext, readblob, COPY ... ...
CVE-2026-112018 cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...
CVE-2026-112018 cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...
EUVD-2026-103471
cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltfaccessorunpackfloats that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash...
CVE-2026-112018
The cgltf library (through version 1.15 ) is vulnerable to a heap out-of-bounds write within the cgltf_accessor_unpack_floats() function. The root cause is the processing of unchecked sparse accessor indices , which allows an attacker to write outside the designated output buffer. By providing a ...
CVE-2026-112016 Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files
Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into...
EUVD-2026-103469
Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into...
CVE-2026-112016
Netcore NR256CN through 1.5.140116 is vulnerable to an unauthenticated file write vulnerability within the Boa-derived /bin/boa web server . A remote attacker can exploit this by sending a POST request to a non-existent .cgi pathname. This action allows the attacker to write controlled content in...
CVE-2026-112012
The libtta library (versions through 2.3 ) contains a stack out-of-bounds read and write vulnerability within the tta_decoder_process_stream() and tta_decoder_process_frame() functions. The root cause is that header checks fail to reject a zero channel count . An attacker can provide a specially ...