CVE-2026-111132 GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element

GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in pathgeometrystartelement that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XP...

CVE-2026-111131 libxmp through 4.7.4 Stack Out-of-Bounds Read via P61A Depacker

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...

CVE-2026-111129 Assimp through 6.0.5 NULL Pointer Dereference via Ogre Animation Track

Open Asset Import Library assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation trac...

CVE-2026-111130 OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position

OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slidepositions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts,...

CVE-2026-111128 Assimp through 6.0.5 NULL Pointer Dereference via Ogre Importer Bone Assignment

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById to return...

CVE-2026-111127 catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string

catdoc through 0.95 contains an out-of-bounds read vulnerability in copyunicodestring in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST record...

CVE-2026-111126 catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler

catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of processitem in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2c...

CVE-2026-111125 CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111124 CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fitsrandvalue table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVEDITHER1 compress...

CVE-2026-111123 FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

CVE-2026-110878 Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse...

CVE-2026-110877 AdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

CVE-2026-110876 AdPlug through 2.4 Out-of-Bounds Read via CxsmPlayer::play_note in XSM Files

AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before notetable by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read duri...

CVE-2026-110875 AdPlug through 2.4 Heap Buffer Overflow via CksmPlayer::update in ksm.cpp

AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update in src/ksm.cpp that writes past the fixed databuf2048 array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory...

CVE-2026-110874 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-111252 OpenNMS denial of service via XML entity expansion

A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server...

CVE-2026-87029 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while...

CVE-2026-111234 SimplePie through 1.9.0 Local File Read via file:// Redirect

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

CVE-2026-111233 Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewallrules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewa...

CVE-2026-111232 Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color

Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator color value that...

CVE-2026-111231 Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because configrestore and configinstall ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for servicesacb.php,...

CVE-2026-111230 Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

CVE-2026-111229 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in servicescaptiveportalhasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connectedusers with shell...

CVE-2026-111228 Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in servicesunboundadvanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sockqueuetimeout parameter...

CVE-2026-111227 Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php

Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in servicesunboundacls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields...

CVE-2026-111225 Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolat...

CVE-2026-111226 Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values...

CVE-2026-111224 Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connectasync.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes an...

CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner

Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the loginbanner field. Attackers can submit a single-line banner containing '' to escape the unquoted strongswan.con...

CVE-2026-111222 Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting

Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add autoprependfile pointing at /var/db/zoneinfo,...

CVE-2026-111220 Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfacespppsedit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit...

CVE-2026-111221 Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to...

CVE-2026-111219 Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in servicespppoeedit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making...

CVE-2026-111217 Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via...

CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...

CVE-2026-111216 Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated...

CVE-2026-111215 Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;...

CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated...

CVE-2026-109131 Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)

The Hub collection module documentation renderer in the unified Ansible Automation Platform UI built from upstream ansible-ui, frontend/hub renders a documentation URL part formatPartURL in DocumentationParsers.tsx as a link without restricting the URL protocol/scheme. A collection whose...

CVE-2026-62322 Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/ Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no...

CVE-2026-108334 Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides

A flaw was found in the internal WebAssembly WASM shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create o...

CVE-2026-109932 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For...

CVE-2026-104150 AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...

CVE-2026-57496 NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensinggetproduct passes the caller-controlled productnumber to src/netlicensingmcp/tools/products.py, which interpolat...

CVE-2026-87018 undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

CVE-2026-105660 Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit

Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target. Bandit validate...

CVE-2026-104828 HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...

CVE-2026-92707 MessagePack: Nested arrays can blow past buffer length limits

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

CVE-2026-109383 undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...