CVE-2026-125173

FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevdreceiveframe in libavcodec/libxevd.c that fails to free pktau when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only parameter sets or non-frame NAL units to...

CVE-2026-125172

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevdreceiveframe in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read...

CVE-2026-125170

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targadecoderle in libavcodec/targa.c caused by missing packet length checks. Attackers can supply truncated RLE-compressed TGA images so decoded frames contain leftover heap buffer data and replicated uninitialized...

CVE-2026-125171

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7decodeinit does not validate lastframelen against MPCFRAMESIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to rea...

CVE-2026-125104

FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in apedecodeframe in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale...

CVE-2026-125103

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ffmlzdecompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized hea...

CVE-2026-125101

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap byt...

CVE-2026-125102

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in takdecodeframe in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting channels from the list, causing undecoded...

CVE-2026-125100

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decodeframe in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to skip decoding and disclose uninitialized...

CVE-2026-125099

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to copy uninitialized heap memory into...

CVE-2026-125098

FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8lossydecodealpha in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width height to disclose...

CVE-2026-125097

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in rawdecode in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets...

CVE-2026-125096

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seqdecodeop1 copies an uninitialized 64-byte stack block...

CVE-2026-125095

FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decodeframe never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so drawncolor writes uninitialized stack bytes...

CVE-2026-125073

FFmpeg through 9.0.2 contains an infinite loop vulnerability in bitallocation in libavcodec/imc.c that allows attackers to hang decoding by supplying audio blocks with a negative bit budget. Attackers can craft IMC or IAC audio files that drive freebits negative, causing the reduction loop to nev...

CVE-2026-125071

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/jvdec.c that allows attackers to crash applications by supplying oversized JV video packets. Attackers can pass a roughly 268435460-byte packet through the libavcodec API, overflowing the bit count so decodeframe...

CVE-2026-125072

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mpdecodeframe in libavcodec/mpegaudiodectemplate.c because initgetbits failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu decoder through the libavcodec API, causing rea...

CVE-2026-125070

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqidecodeframe in libavcodec/eatqi.c, which ignores initgetbits failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial o...

CVE-2026-125069

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mpdecodeframe ignores initgetbits failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, causing reads from a NULL buffer that crash the...

CVE-2026-125068

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decodeframe in libavcodec/bink.c ignores initgetbits failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowing the bit count and crashing the process for...

CVE-2026-125067

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vbledecodeframe in libavcodec/vble.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer that...

CVE-2026-125066

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decodeframe ignores initgetbits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads...

CVE-2026-125065

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgvdecodeinter in libavcodec/eatgv.c that ignores initgetbits failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block section,...

CVE-2026-125064

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726decodeframe in libavcodec/g726.c because it ignores initgetbits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL buffer,...

CVE-2026-112314

clnttcpcall in lib/rpc/clnttcp.c in MIT Kerberos 5 aka krb5 does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service memory leak in GSS-RPC client programs by injecting RPC replies with mismatched XIDs or by triggering authentication retries...

CVE-2026-112321

The AUTHGSSAPI handler in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 aka krb5 does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service memory exhaustion in kadmind via crafted AUTHGSSAPIINIT requests that trigger authentication failures...

CVE-2026-112320

The GSS-RPC transport layer in MIT Kerberos 5 aka krb5 1.4 and later does not release the previous authentication context when a client switches from an RPCSECGSS or AUTHGSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service memory...

CVE-2026-112319

The GSS-RPC layer in MIT Kerberos 5 aka krb5 does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service memory exhaustion or excessive CPU consumption in kadmind via crafted RPC requests that trigger unbounded memory allocations during X...

CVE-2026-112318

The policy RPC stubs in kadmin/server/serverstubs.c in MIT Kerberos 5 aka krb5 1.5.3 and later do not reject a NULL policy name decoded by xdrnullstring, which allows remote authenticated users to cause a denial of service kadmind crash via NULL pointer dereference by sending a policy request wit...

CVE-2026-112316

xdrkrb5tldata in lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service memory leak in kadmind via crafted RPC requests that trigger a decode failure...

CVE-2026-112317

krb5ktkdbgetentry in lib/kdb/keytab.c in MIT Kerberos 5 aka krb5 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service memory leak in the KDC or kadmind via requests that repeatedly trigger key decryptio...

CVE-2026-112315

The RPCSECGSS authentication routines in lib/rpc/authgssprot.c in MIT Kerberos 5 aka krb5 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service memory leak in kadmind via crafted RPCSECGSS messages...

CVE-2026-12977

A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of...

CVE-2026-123804

SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated...

CVE-2026-123803

SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsByIdTransaction and getUserInfoByCredentialIdTransaction perform application-scoped WebAuthn lookups without constraining them to the...

CVE-2026-124001

NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission DGR convergence layer that allows attackers to corrupt heap memory by sending a maliciously crafted 64-bit svcDataLength value that wraps a 32-bit allocation size calculation. Attackers...

CVE-2026-119079

decodesequenceof in lib/krb5/asn.1/asn1encode.c in MIT Kerberos 5 aka krb5 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service CPU consumption in the KDC by sending an unauthenticated AS-REQ or TGS-REQ with a large number ...

CVE-2026-112323

The AUTHGSSAPI handler in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 aka krb5 1.5.2 and later allows remote attackers to cause a denial of service memory exhaustion in kadmind by sending repeated failed AUTHGSSAPIINIT requests. Each failed request allocates client state that is only freed after a...

CVE-2026-112322

cleanclient in lib/rpc/svcauthgssapi.c in MIT Kerberos 5 aka krb5 restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service CPU consumption in kadmind by accumulating a large number of AUTHGSSAPI client...

CVE-2026-124000

NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon amsd that allows a rogue or misconfigured peer to trigger an out-of-bounds write by sending crafted Meta-AMS MAMS configuration management messages that are...

CVE-2026-123999

NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer overflow in the Network Management daemon nmmgr string-formatting logic that allows a malicious or misconfigured agent to trigger an out-of-bounds write by sending deeply nested AMP payloads that exceed fixed-size buffer allocation...

CVE-2026-70555

rConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices through the device-credentials API due to automatic decryption on read and missing authorization checks...

CVE-2026-123802

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider...

CVE-2026-123801

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiated flow, an attacker who obtains a...

CVE-2026-125041

A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause an out-of-bounds heap read while the...

CVE-2026-125040

A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of unmatched markup-like text can force...

CVE-2026-123800

SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in...

CVE-2026-123799

SuperTokens Core is an open source authentication server. From 11.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, and 12.1.2, Dashboard.isValidUserSession treats any stored session row as valid without comparing DashboardSessionInfo.expiry to the current time...

CVE-2026-123798

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. The Core can therefore accept a cryptographically valid...

CVE-2026-84503

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git ls-remote, clone, fetch with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that...