UBUNTU-CVE-2026-111280

snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into...

CVE-2026-111280

snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into...

PT-2026-115386

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.29.0 through 3.31.0 Description An integer overflow exists in the Apple audin backends audin mac.m, audin ios.m. The issue occurs during the calculation of the audio queue buffer size using the formula FramesPerPacket 2...

UBUNTU-CVE-2026-111136

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatchsf2genisvalid does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write...

CVE-2026-111137

libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets...

CVE-2026-111380: Integer Overflow or Wraparound

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

CVE-2026-111151

OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row pa...

CVE-2026-111154

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

UBUNTU-CVE-2026-111154

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

CVE-2026-111123

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

UBUNTU-CVE-2026-111123

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

PT-2026-116042

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter...

Adobe Substance 3D Sampler < 6.0.4 Multiple Vulnerabilities (APSB26-159)

The version of Adobe Substance 3D Sampler installed on the remote host is prior or equal to 6.0.3. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-159 advisory. - Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in...

Adobe Substance 3D Designer <= 16.0.5 Multiple Vulnerabilities (APSB26-169)

The version of Adobe Substance 3D Designer installed on the remote host is prior or equal to 16.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-169 advisory. - Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in...

Adobe FrameMaker 2022 < 17.0.10.928 (2022.0.10.928) / Adobe FrameMaker 2026 < 18.0.1.312 (2026.0.1.312) Multiple Vulnerabilities (APSB26-172)

The version of Adobe FrameMaker installed on the remote Windows host is prior to Adobe FrameMaker 2022 17.0.10.928 / Adobe FrameMaker 2026 18.0.1.312. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-172 advisory. - Adobe Framemaker is affected by an out-of-bound...

Linux Distros Unpatched Vulnerability : CVE-2026-111123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont...

Linux Distros Unpatched Vulnerability : CVE-2026-110717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside...

Linux Distros Unpatched Vulnerability : CVE-2026-111136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatchsf2genisvalid does not range-check generato...

PT-2026-115900

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a craft...

PT-2026-115912

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a craft...