pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions

A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the pcre2dfamatch function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction...

pcre2: pcre2: Out-of-bounds write via crafted regular expression

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt...

Security Bulletin: IBM App Connect Enterprise is vulnerable to an arbitrary file write (CVE-2026-17437)

Summary IBM App Connect Enterprise Toolkit is vulnerable to an arbitrary file write. Vulnerability Details CVEID:CVE-2026-17437 DESCRIPTION: IBM App Connect Enterprise could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction...

OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files

A flaw was found in OpenEXR. A remote attacker could exploit this vulnerability by providing a specially crafted EXR image file with a nonzero dataWindow.min. This could cause the TypedFlatImageChannel::row function to return an invalid memory pointer, leading to out-of-bounds or use-after-free...

OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing

A flaw was found in OpenEXR, an image storage format for the motion picture industry. A remote attacker or local user could exploit this vulnerability by providing a specially crafted B44 or B44A EXR file. This crafted file can cause an out-of-bounds write during file decoding, which may lead to...

Important: Red Hat Security Advisory: openexr security update

An update for openexr is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

SUSE-SU-2026:24282-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin bsc1261939....

Exploit for Write-what-where Condition in Linux Linux_Kernel

GalaxyCrash Root on a locked bootloader. No custom kernel, no O...

wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write

A flaw was found in Wireshark. This vulnerability allows a remote attacker to cause a denial of service DoS by sending a specially crafted Universal Mobile Telecommunications System UMTS RRC protocol packet. The flaw resides in the UMTS RRC protocol dissector, which can lead to a crash of the...

CVE-2026-94294 App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...

WordPress App Builder plugin 3.8.4-5.7.0 - Unauthenticated Option Write and Redirect vulnerability

Unauthenticated Option Write and Redirect vulnerability discovered by RIA Labs in WordPress Plugin App Builder versions 3.8.4-5.7.0...

CVE-2026-94294 App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...

CVE-2026-94294

The App Builder WordPress plugin (versions 3.8.4 through 5.7.0) contains a vulnerability where the application fails to require authentication or authorization before writing attacker-supplied data to one of its options. In a separate unauthenticated request, the plugin redirects the visitor's br...

CVE-2026-111880

A flaw was found in FreeRDP. An out-of-bounds write vulnerability in the server-side NT LAN Manager NTLM authentication path can result in a Denial of Service DoS. When processing authentication messages with hash callbacks enabled, FreeRDP fails to properly validate the Message Integrity Check M...

CVE-2026-111881

A flaw was found in FreeRDP. An integer underflow vulnerability exists in its bitmap image processing component due to an incorrect calculation when handling sub-byte images. A remote attacker acting as a malicious peer in a Remote Desktop Protocol RDP session can exploit this by supplying a...

dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network...

dotnet: .NET Framework Remote Code Execution Vulnerability

A flaw was found in .NET. An out-of-bounds write vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the target system over the network. By convincing a user to process specially crafted input, an attacker can trigger memory corruption and compromise the affected...

dotnet: dotnet: Arbitrary code execution via out-of-bounds write

A flaw was found in .NET. An out-of-bounds write vulnerability allows an unauthenticated remote attacker to execute arbitrary code over the network. By sending specially crafted input to an affected application, an attacker can corrupt system memory and compromise the host environment...

mariadb: mariadb: Arbitrary code execution via CONNECT engine out-of-bounds write

A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the allocated stack buffer. This flaw could lead to arbitrary code execution or cause the database server to...

CVE-2026-112007

A flaw was found in Schism Tracker. An attacker could exploit this vulnerability by enticing a user to open a specially crafted UltraTracker .ult audio file. Due to missing boundary checks on sample counts during file parsing, the application performs an out-of-bounds memory write on the heap. Th...