CVE-2026-82987

The ViewSonic vCast media streaming service, included in ViewBoard smartboard devices, contains a vulnerability (CVE-2026-82987 ) allowing a remote attacker to inject arbitrary input into service endpoints via HTTP requests to exposed unauthenticated endpoints . When chained with other vulnerabil...

CVE-2026-88361

SumatraPDF version 3.6.1 is vulnerable to an integer overflow within the EngineMupdf::BuildPageLabelRec() function. This vulnerability occurs when the software parses PDF PageLabels /Nums entries . The technical details do not specify a direct exploitation path or specific remote impact beyond th...

CVE-2026-40661

The AMD Compressonator SDK is vulnerable to an out-of-bounds write (OOW) condition (CVE-2026-40661). An attacker with local access could supply a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline. This vulnerability could potentially result in heap corruption or a...

CVE-2026-40659

The AMD Compressonator SDK is vulnerable to an integer overflow condition (CWE-190). This flaw could allow a local attacker to provide a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline, potentially resulting in a denial of service (DoS) . The vulnerability is as...

CVE-2026-88365

The minimp3 library (commit ea99364f ) is vulnerable to an integer overflow within the mp3dec_skip_id3v1() function. This flaw occurs during the parsing of the APEv2 tag-size field . The vulnerability has a CRITICAL severity score of 9.8 , with potential impacts on confidentiality, integrity, and...

CVE-2026-88376

Bento4 1.6.0.0 is vulnerable to an integer underflow within the AP4_AvccAtom::Create() and AP4_HvccAtom::Create() functions. A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a larg...

CVE-2026-88351

An integer overflow vulnerability exists in the MPack Node API within MPack 1.1.1 on 32-bit platforms . The issue occurs in the mpack_tree_parse_children() function when parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count. This causes the page a...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue within the DNS dissector and serializer deserialization code . The root cause is that specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignme...

CVE-2026-88385

The Mini-XML 4.0.5 library contains a memory leak vulnerability within the mxml_load_data() function during the parsing of malformed XML. Specifically, specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error triggers the cleanup path, le...

CVE-2026-88370

The libconfini 1.16.4 library is vulnerable to a heap out-of-bounds write condition within the load_ini_buffer.h utility and the strip_ini_cache() function. The root cause is that the utility allocates exactly ini_length bytes, but strip_ini_cache() unconditionally writes a NUL terminator at ini_...

CVE-2026-88362

The MuJS e892c9fdb engine is vulnerable to an incorrect numeric conversion in the jsR_isindex() function located in jsrun.c. A specially crafted JavaScript input featuring an excessively large numeric array index can bypass range validation, causing an out-of-range floating-point value to be conv...

CVE-2026-52001

The software geelen mcp-remote versions 0.1.18 through 0.1.38 contains a vulnerability that allows a remote attacker to obtain sensitive information . The root cause is located in the SSE transport eventSourceInit fetch wrapper within the file src/lib/utils.ts. No specific exploit details, in-the...

CVE-2026-51996

The geelen mcp-remote software, versions 0.1.16 through 0.1.38 , is susceptible to a vulnerability that allows a remote attacker to achieve arbitrary code execution . The flaw is located within the src/lib/utils.ts file, specifically originating from the getServerUrlHash function. While the techn...

CVE-2026-88384

The OpenEXR 3.4.14 library is vulnerable to a NULL Pointer Dereference within the C++ attribute parsing path. When processing a specially crafted EXR file that contains an unknown-type attribute with a dataSize of zero, the parser creates an opaque attribute with a NULL packed_data pointer . The ...

CVE-2026-88387

LibRaw 0.22.0 is vulnerable to an incorrect numeric conversion flaw in the LibRaw::parse_tiff_ifd() function. When processing TIFF tag 0x00fe (NewSubfileType) , the parser fails to perform range validation, allowing a specially crafted RAW, TIFF, or DNG file to provide a value outside the range o...

CVE-2026-0482

In AMD Versal™ Adaptive SoC devices, a vulnerability exists due to insufficient boundary checks within the USB boot mode . When this mode is enabled via board modifications, an attacker can use a crafted image to trigger a buffer overflow that overwrites an active function pointer . This flaw all...

CVE-2026-88388

Espruino 2v29 (commit bffc6d0 ) is vulnerable to a stack-based buffer overflow within the JavaScript error stack-trace handling path on 64-bit builds . A remote attacker can provide JavaScript input that triggers an exception, leading to the execution of jslPrintTokenLineMarker(). This function i...

CVE-2026-88373

The libde265 library (commit 4d45a6b ) contains a NULL pointer dereference vulnerability within the NAL parsing path. When the de265_push_NAL() function is invoked with a zero-length NAL unit, it may produce a NAL_unit with a NULL backing buffer . This buffer is then used as the destination argum...

CVE-2026-87906

CVE-2026-87906 affects the Rox Appointment Booking WordPress plugin. While specific technical root causes or impact details are not provided in the documents, the plugin is listed among several others with active, unpatched vulnerabilities. Users are advised to fully delete the plugin from the se...

CVE-2026-88358

The simdjson library version 4.6.1 is susceptible to a one-byte out-of-bounds read vulnerability within the dom::parser::parse_unpadded() function. A specially crafted truncated JSON document, where the final structural token closes a nested array or object, can cause json_iterator::walk_document...

CVE-2026-88360

The libvips 8.19.0 library is vulnerable to a memory access issue when processing little-endian PFM images . The root cause is that an mmap-based loader may expose pixel data at an address improperly aligned for float access if the PFM text header length is not a multiple of four bytes. This occu...

CVE-2026-88386

The libsndfile library (version 1.2.2 ) is vulnerable to a misaligned memory access issue within the psf_binheader_readf() function. This flaw occurs during the parsing of WAV fmt chunks , where a specially crafted WAV file can cause the function to cast an unaligned destination address to an uns...

CVE-2026-88367

The NanoSVG 239e102ec library is vulnerable to an incorrect numeric conversion within the nsvg__curveDivs() function during SVG stroke rasterization. A specially crafted SVG document with an excessively large stroke-width can trigger floating-point rounding that produces a zero subdivision angle....

CVE-2026-88371

The ZBar library (commit 2ea2ca58 ) contains an undefined-behavior vulnerability within the Code 128 decode6() function. When processing specially crafted Code 128 input, the decode_e() function may return -1 for an invalid edge pattern. The decode6() function then performs a left-shift on this n...

CVE-2026-51994

Versions 0.1.32 through 0.1.38 of mcp-remote are vulnerable to Server-Side Request Forgery (SSRF) . The root cause is the insecure processing of the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header . This vulnerability allows an attacker to potentially force the ...

CVE-2026-88359

The libfyaml 0.9.6 library is vulnerable to a stack exhaustion vulnerability within the fy_atom_iter_format() function. When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside ...

CVE-2026-51995

The software geelen mcp-remote (versions 0.1.32 through 0.1.38 ) contains a vulnerability that allows a remote attacker to obtain sensitive information . The flaw is located within the src/lib/authorization-server-metadata.ts and src/lib/utils.ts components. No specific details regarding the root...

CVE-2026-40652

The AMD Compressonator SDK is vulnerable to an out-of-bounds read condition (CWE-125) identified as CVE-2026-40652 . A local attacker could supply a specially crafted Truevision Graphics Adapter (TGA) file to a user or an automated pipeline. This vulnerability could potentially lead to the disclo...

CVE-2026-40660

The AMD Compressonator SDK contains a heap out-of-bounds read vulnerability (CWE-125). This flaw could allow an attacker with local access to read out-of-bounds heap memory, which may lead to information disclosure or cause an application crash . The CVSS base score for this vulnerability is 5.2 .

CVE-2026-96762

The software kvcache-ai mooncake (versions up to 0.3.12 and 0.3.13.post1 ) contains a vulnerability in the RPC Path Handler component. Specifically, the UnmountSegment function is susceptible to an authorization bypass caused by the manipulation of the client_id/segment_id arguments. This flaw al...

CVE-2026-82370

Brocade SANnav versions before 3.0.1a are vulnerable to an unauthenticated remote command injection in the orchestrator HTTP service. This flaw allows network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. Potential impacts ...

CVE-2026-96751

A SQL injection vulnerability exists in the pmTicket Project-Management-Software (up to commit 078fa56a782490c5059a0814f84df27984f4d7e2). The flaw is located in the setSync function within the /ajax/add_project.php file, where manipulation of the conn_settings argument allows for remote attack ex...

CVE-2026-96739

A cross-site scripting (XSS) vulnerability exists in SEMCMS versions up to 4.2 . The flaw is located within the KindEditor Upload Interface component, specifically affecting the functionality of the /Edit/php/upload_json.php file. The issue arises from the improper handling of the imgFile argumen...

CVE-2026-89078

GitLab CE/EE versions 19.2 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are affected by a double free vulnerability. This issue occurs when the system parses a specially crafted regular expression within a CI/CD configuration , which could allow an authenticated user to execute arb...

CVE-2026-92530

GitLab CE/EE versions 19.1 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are vulnerable to an issue where an authenticated user could spoof merge request authorship and attribute content to arbitrary existing users. This occurs due to an improper reliance on ephemeral cache state du...

CVE-2026-92470

GitLab EE versions 18.7 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are vulnerable to a missing authorization check in the Duo AI troubleshooting feature . Under certain conditions, an authenticated user could access sensitive CI/CD variable values from debug-mode job traces. GitL...

CVE-2026-92529

An improper authorization check in GitLab EE allows an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls . This vulnerability specifically affects workflows in namespaces that the user does not control. The issue is present in versions 19.1 ...

CVE-2026-92874

GitLab CE/EE is impacted by a vulnerability in versions 18.3 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 . Due to improper authorization checks , an authenticated user possessing an MCP-scoped token could perform actions exceeding the token's intended scope under certain condition...

CVE-2026-92628

GitLab CE/EE versions 18.6 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are affected by a race condition in the MCP search tool . Improper synchronization during shared state handling could lead to search results being returned under an incorrect user context . GitLab has remediate...

CVE-2026-93577

GitLab CE/EE versions 19.2 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are vulnerable to an integer overflow issue. This flaw occurs during the compilation of a specially crafted regular expression within a CI/CD configuration , which could allow an authenticated user to execute a...

CVE-2026-96680

The ByteDance Coze Scraper Extension (up to version 2.0.2 ) contains a vulnerability in the External Message Handler component. Specifically, the chrome.runtime.onMessageExternal.addListener function within the static/background/index.js file fails to perform proper authorization when handling sp...

CVE-2026-96678

A path traversal vulnerability exists in the Avatar Upload component of weiqingwen spring-boot-forum (affected up to commit 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f). The flaw is located in the validate function within the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java, where ma...

CVE-2026-70125

A Remote Code Execution (RCE) vulnerability exists in Microsoft Office Outlook . An attacker could exploit this flaw to execute arbitrary code or commands on the vulnerable machine or process. Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit systems), Microsoft Offic...

CVE-2026-96676

A stack-based buffer overflow vulnerability exists in the get_alias_name function of the uhttpd component within Fast FAC1900R 20190827_2.0.2 . This flaw can be exploited via a remote attack to cause a buffer overflow. An exploit is reported as publicly available and potentially usable in the wil...

CVE-2026-96606

A security flaw in the LB-Link BL-CPE600EU (version 5.8.13) allows for information disclosure via the Configuration Backup Handler component. The vulnerability specifically affects unknown code within the Mifi_config.bin file. This flaw can be exploited remotely to disclose information. A public ...

CVE-2026-59980

The python-hyper/hpack library, often used as a dependency for the python-hyper/h2 HTTP/2 implementation, is vulnerable to run-away computation due to unbounded variable integer decoding . Malformed input can trigger an O(n^2) runtime, potentially blocking further processing. A fix is available i...

CVE-2026-96604

A SQL injection vulnerability exists in the Search Module of SoftNews Media Group DataLife Engine 18.0 . The flaw is located within the strip_data function of the file engine/modules/search.php , where the manipulation of the story argument allows for remote exploitation. The documents state that...

CVE-2026-96603

A vulnerability exists in the Admin Handler component of Abdurrab5 online-makeup-store . Specifically, the confirm_logged_in and confirm_user functions within the functions.php file are susceptible to missing authorization due to the manipulation of the adminid argument. This flaw can be exploite...

CVE-2026-81537

IBM DataStage on Cloud Pak for Data 5.4.0.0 is susceptible to an OS command injection vulnerability. This flaw could allow a remote authenticated attacker to execute arbitrary code on the target system. No specific exploit information or remediation steps are provided in the documents, though the...

CVE-2026-81536

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to an XML external entity (XXE) injection (CWE-611). This flaw could allow a remote authenticated attacker to obtain sensitive information . To remediate this vulnerability, IBM strongly recommends upgrading to DataStage on Cloud Pak for D...