CVE-2019-19511

The Chevereto content management system is vulnerable to Remote Code Execution (RCE) in versions 1.0.0 Free through 1.1.4 Free and up to 3.13.4 Core . The root cause is located in the installer.php file, which allows authenticated administrators to inject arbitrary PHP code into the installation ...

CVE-2026-96891

A vulnerability exists in the D-Link DIR-825 router software (version 3.00b32 ) within the rp-l2tp component. The issue resides in the tunnel_set_params function of the tunnel.c file, where improper handling of the peer_hostname argument leads to an out-of-bounds write . An attacker can initiate ...

CVE-2026-96884

A security flaw exists in MantisZip versions up to 0.4.5 . The vulnerability is located in the Path.Combine function within the MainWindow.UI.cs file of the Preview component. This flaw allows for path traversal , which can be triggered remotely. Public exploits are available for this vulnerabili...

CVE-2026-96882

The TaleLin lin-cms-spring-boot software, specifically versions up to 0.2.1 , contains an improper authorization vulnerability. The issue resides in the searchBook function within the src/main/java/io/github/talelin/latticy/controller/v1/BookController.java file of the book Endpoint component. Th...

CVE-2026-97149

In OpenStack Swift versions before 2.38.2 , a vulnerability exists because the tempurl middleware fails to reject the X-Copy-From header on PUT requests. Since the TempURL signature only validates the method, expiry, and path, an attacker with a valid PUT TempURL for a single object can include a...

CVE-2026-96881

The TaleLin lin-cms-spring-boot software, version up to 0.2.1 , contains an improper authorization vulnerability in the book Endpoint. Specifically, the getBooks function within the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java is susceptible to manipulation. This...

CVE-2026-96880

A vulnerability exists in TaleLin lin-cms-spring-boot (up to version 0.2.1 ) within the book Endpoint . Specifically, the getBook function in src/main/java/io/github/talelin/latticy/controller/v1/BookController.java is susceptible to improper authorization when an attacker manipulates the ID argu...

CVE-2026-97056

SigNoz versions v0.98.0 through v0.142.x are vulnerable to insufficient session expiration when using the opaque session tokenizer . The root cause is that the UpdatePasswordByResetPasswordToken and DeleteUser code paths fail to call DeleteTokensByUserID, leaving cached tokens active. An attacker...

CVE-2026-97055

SigNoz versions v0.8.0 before v0.143.0 are vulnerable to an authentication bypass because the JWT tokenizer signing secret defaults to an empty string. Since Config.Validate() fails to reject empty values, deployments without a configured secret sign and verify session tokens with an empty HMAC k...

CVE-2026-96810

A cross-site scripting (XSS) vulnerability exists in the huanzi-qch base-admin software (up to commit 52816b760cd53244989fd664bbb2b3d4edbfdbf1). The flaw is located within the Add User Handler component, specifically affecting the Save function of the base-admin-master\src\main\java\cn\huanzi\qch...

CVE-2026-96803

A SQL injection vulnerability exists in java110 MicroCommunity up to version 2.0 . The flaw is located within the QueryServiceSMOImpl.fallBack function of the BusinessApi.java file, specifically affecting the fallBack API Endpoint component. An attacker can exploit this by manipulating the fallBa...

CVE-2026-18467

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation in versions up to and including 5.0.3 . The root cause is a logic flaw where the pt_cf_checkout_meta() filter copies $_POST['pt_form_field'][*] keys into the payment meta array...

CVE-2026-96777

A SQL injection vulnerability exists in Forma LMS versions up to 4.1.43 . The flaw is located in the Multi-User-Selector AJAX Endpoint , specifically within the UserselectorAdmController::getDataTask function of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData. An attacker can ini...

CVE-2026-96774

A vulnerability exists in the SPON Communications IP Network Audio Device XC-9603 (version 1.2.3_20181106 Build 107). The flaw impacts the loadCfg function within the /ini/sys_cfg.txt file of the Configuration File Download component. This issue allows for information disclosure via a remote atta...

CVE-2026-96773

A vulnerability exists in Intelliants Subrion CMS versions up to 4.2.1 . The flaw resides in the iaUsers::authorize function within the front/login.php file of the Login Page component. By manipulating the $_SERVER['HTTP_REFERER'] argument, a remote attacker can trigger an open redirect . Public ...

CVE-2026-96772

A security flaw in Intelliants Subrion CMS (up to version 4.2.1 ) allows for information disclosure via a remote attack. The vulnerability exists in an unspecified part of the /actions.json?action=assign-owner endpoint, where manipulating the q argument triggers the disclosure. While an exploit h...

CVE-2026-96764

A vulnerability exists in kvcache-ai mooncake versions up to 0.3.12/0.3.14-rc1 . The flaw is located in the Regular Expression Handler component, specifically within the MasterService::GetReplicaListByRegex function. An attacker can perform a remote manipulation that leads to an allocation of res...

CVE-2026-96763

The kvcache-ai mooncake software (versions up to 0.3.12 , 0.3.13.post1 , and 0.3.14-rc1 ) contains a security flaw in the MountSegment Request Processing component. Specifically, the ScopedSegmentAccess::MountSegment function within the segment.cpp file is susceptible to improper access controls ...

CVE-2026-82988

The ViewSonic vCast software, included in ViewBoard smartboard devices, contains a vulnerability (CVE-2026-82988 ) in its Android Package Kit (APK) delivery mechanism . An unauthenticated remote attacker can trigger the installation of unprivileged files by providing a malicious APK URL through a...

CVE-2026-88369

The zserge jsmn library, specifically commit 25647e6 , is vulnerable to a Buffer Overflow in the example/jsondump.c file within the dump() function. While the vulnerability is documented across multiple distributions (including Debian and Ubuntu), some sources indicate that the vendor may not hav...

CVE-2026-88355

A vulnerability exists in tinyexpr (commit 4a7456e) within the new_expr() function due to an incorrect buffer size calculation . For arity-0 expression nodes, such as constants, variables, and zero-argument functions, the function allocates less memory than sizeof(te_expr) but treats the result a...

CVE-2026-88378

The QuickJS engine (commit 04be24600) is affected by a heap out-of-bounds write condition located in the JS_ReadFunctionTag() function. This vulnerability is present in various Linux distributions, though some sources indicate that a vendor-supplied patch may not be available for certain impacted...

CVE-2026-51997

An issue in geelen mcp-remote versions 0.1.16 through 0.1.38 allows a remote attacker to achieve arbitrary code execution . The vulnerability originates from the open() functions within the software. No specific remediation, exploit links, or MITRE ATT&CK IDs are provided in the documents.

CVE-2026-88383

The libical 4.0.6 library is vulnerable to a denial of service due to an incompatible function pointer in icalparameter_string_to_kind() . When parsing iCalendar data with a parameterized property, the function incorrectly passes icalparameter_compare_kind_map() to bsearch() through a mismatched ...

CVE-2026-82989

The ViewSonic vCast media streaming service, included in ViewBoard smartboard devices, is vulnerable to unauthenticated screen exfiltration. A remote attacker can send GET requests to unauthenticated /snapshot or /screen API endpoints to exfiltrate JPEG images of the displayed screen content. Whe...

CVE-2026-88372

The libsndfile 1.2.2 library contains an integer overflow vulnerability within the mat4_read_header() function. This flaw can be triggered when the software attempts to parse crafted MAT4 (MATLAB v4) files . The provided documents do not specify the practical consequences of this overflow, the sp...

CVE-2026-88390

Espruino 2v29 (commit bffc6d0) is vulnerable to an out-of-bounds write within the jslGetTokenValueAsString() function. This flaw occurs when crafted JavaScript input containing an overlong token triggers a one-byte write beyond the JsLex.token buffer in RELEASE/NO_ASSERT builds. The write corrupt...

CVE-2026-88366

The NanoSVG library (commit 239e102ec ) contains an incorrect numeric conversion vulnerability in the nsvg__pathArcTo() function during SVG arc command parsing. When processing a specially crafted SVG document with extreme arc radius values, intermediate calculations can produce a NaN delta angle...

CVE-2026-88368

The NanoSVG library (commit 239e102ec) contains an incorrect numeric conversion vulnerability within the rasterizer's nsvg__addActive() function. A specially crafted SVG document with large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the representable range of an ...

CVE-2026-88382

The hiredis library (commit 29ea279, post-v1.5.0) contains an uncontrolled memory allocation vulnerability within its RESP aggregate parser . This flaw allows for the allocation of resources without sufficient limits or throttling. While the vulnerability is documented across multiple security ad...

CVE-2026-88377

Bento4 1.6.0.0 is vulnerable to an integer underflow in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE triggers an underflow during payload-size calculation within AP4_AvccAtom::Create() or AP4_H...

CVE-2026-82987

The ViewSonic vCast media streaming service, included in ViewBoard smartboard devices, contains a vulnerability (CVE-2026-82987 ) allowing a remote attacker to inject arbitrary input into service endpoints via HTTP requests to exposed unauthenticated endpoints . When chained with other vulnerabil...

CVE-2026-88361

SumatraPDF version 3.6.1 is vulnerable to an integer overflow within the EngineMupdf::BuildPageLabelRec() function. This vulnerability occurs when the software parses PDF PageLabels /Nums entries . The technical details do not specify a direct exploitation path or specific remote impact beyond th...

CVE-2026-88365

The minimp3 library (commit ea99364f ) is vulnerable to an integer overflow within the mp3dec_skip_id3v1() function. This flaw occurs during the parsing of the APEv2 tag-size field . The vulnerability has a CRITICAL severity score of 9.8 , with potential impacts on confidentiality, integrity, and...

CVE-2026-88351

An integer overflow vulnerability exists in the MPack Node API within MPack 1.1.1 on 32-bit platforms . The issue occurs in the mpack_tree_parse_children() function when parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count. This causes the page a...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue within the DNS dissector and serializer deserialization code . The root cause is that specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignme...

CVE-2026-88385

The Mini-XML 4.0.5 library contains a memory leak vulnerability within the mxml_load_data() function during the parsing of malformed XML. Specifically, specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error triggers the cleanup path, le...

CVE-2026-88384

The OpenEXR 3.4.14 library is vulnerable to a NULL Pointer Dereference within the C++ attribute parsing path. When processing a specially crafted EXR file that contains an unknown-type attribute with a dataSize of zero, the parser creates an opaque attribute with a NULL packed_data pointer . The ...

CVE-2026-88376

Bento4 1.6.0.0 is vulnerable to an integer underflow within the AP4_AvccAtom::Create() and AP4_HvccAtom::Create() functions. A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a larg...

CVE-2026-88370

The libconfini 1.16.4 library is vulnerable to a heap out-of-bounds write condition within the load_ini_buffer.h utility and the strip_ini_cache() function. The root cause is that the utility allocates exactly ini_length bytes, but strip_ini_cache() unconditionally writes a NUL terminator at ini_...

CVE-2026-88362

The MuJS e892c9fdb engine is vulnerable to an incorrect numeric conversion in the jsR_isindex() function located in jsrun.c. A specially crafted JavaScript input featuring an excessively large numeric array index can bypass range validation, causing an out-of-range floating-point value to be conv...

CVE-2026-52001

The software geelen mcp-remote versions 0.1.18 through 0.1.38 contains a vulnerability that allows a remote attacker to obtain sensitive information . The root cause is located in the SSE transport eventSourceInit fetch wrapper within the file src/lib/utils.ts. No specific exploit details, in-the...

CVE-2026-51996

The geelen mcp-remote software, versions 0.1.16 through 0.1.38 , is susceptible to a vulnerability that allows a remote attacker to achieve arbitrary code execution . The flaw is located within the src/lib/utils.ts file, specifically originating from the getServerUrlHash function. While the techn...

CVE-2026-88387

LibRaw 0.22.0 is vulnerable to an incorrect numeric conversion flaw in the LibRaw::parse_tiff_ifd() function. When processing TIFF tag 0x00fe (NewSubfileType) , the parser fails to perform range validation, allowing a specially crafted RAW, TIFF, or DNG file to provide a value outside the range o...

CVE-2026-40659

The AMD Compressonator SDK is vulnerable to an integer overflow condition (CWE-190). This flaw could allow a local attacker to provide a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline, potentially resulting in a denial of service (DoS) . The vulnerability is as...

CVE-2026-40661

The AMD Compressonator SDK is vulnerable to an out-of-bounds write (OOW) condition (CVE-2026-40661). An attacker with local access could supply a specially crafted DirectDraw Surface (DDS) file to a user or an automated pipeline. This vulnerability could potentially result in heap corruption or a...

CVE-2026-88388

Espruino 2v29 (commit bffc6d0 ) is vulnerable to a stack-based buffer overflow within the JavaScript error stack-trace handling path on 64-bit builds . A remote attacker can provide JavaScript input that triggers an exception, leading to the execution of jslPrintTokenLineMarker(). This function i...

CVE-2026-88373

The libde265 library (commit 4d45a6b ) contains a NULL pointer dereference vulnerability within the NAL parsing path. When the de265_push_NAL() function is invoked with a zero-length NAL unit, it may produce a NAL_unit with a NULL backing buffer . This buffer is then used as the destination argum...

CVE-2026-88358

The simdjson library version 4.6.1 is susceptible to a one-byte out-of-bounds read vulnerability within the dom::parser::parse_unpadded() function. A specially crafted truncated JSON document, where the final structural token closes a nested array or object, can cause json_iterator::walk_document...

CVE-2026-88360

The libvips 8.19.0 library is vulnerable to a memory access issue when processing little-endian PFM images . The root cause is that an mmap-based loader may expose pixel data at an address improperly aligned for float access if the PFM text header length is not a multiple of four bytes. This occu...