414789 matches found
PT-2026-115260
Name of the Vulnerable Software and Affected Versions MP4v2 versions 2.0.0 through 2.1.3 Description A heap-based out-of-bounds read exists in the GetChapters function of the MP4File class. This occurs when an attacker provides a specially crafted MP4 file where the chapter sample is shorter than...
PT-2026-115266
Name of the Vulnerable Software and Affected Versions unarr versions prior to 1.1.2 Description A heap-based out-of-bounds read exists in the zip parse extra fields function within the zip/parse-zip.c file. This issue stems from an incorrect length check for ZIP64 extra fields. An attacker can...
PT-2026-115158
Name of the Vulnerable Software and Affected Versions Game Music Emu libgme versions 0.6.5 and earlier Description A heap out-of-bounds read occurs in the AY loader get data function due to an integer underflow during the track-table bounds check. An attacker can use a specially crafted ZXAYEMUL...
PT-2026-115159
Name of the Vulnerable Software and Affected Versions Game Music Emu libgme versions prior to 0.6.6 Description A global out-of-bounds read occurs in the mute voices function of Classic Emu. This happens when the software processes NSF files with a voice count exceeding the 16-entry voice-type...
PT-2026-115154
Name of the Vulnerable Software and Affected Versions libsidplayfp versions prior to 3.1.2 Description A heap out-of-bounds read occurs when the software processes a PSID/RSID file with an unchecked data offset. An attacker can set the header data offset beyond the file size, causing the length...
PT-2026-115163
Name of the Vulnerable Software and Affected Versions SoX versions prior to 14.4.3 Description A heap out-of-bounds write occurs in the lsx ms adpcm block expand i function within src/adpcm.c. This issue is triggered when a WAV fmt chunk contains an odd samplesPerBlock value. An attacker can use ...
PT-2026-115172
Name of the Vulnerable Software and Affected Versions libmikmod versions prior to 3.3.16 Description A heap out-of-bounds read exists in the IMF Load loader. An attacker can trigger this by providing a specially crafted IMF module with the linear-period header flag enabled and notes mapped to...
PT-2026-115148
Name of the Vulnerable Software and Affected Versions Zziplib versions prior to 0.13.81 Description An out-of-bounds read exists in zzip/mmapped.c, allowing attackers to over-read heap memory through a crafted ZIP central directory. By creating an end-of-central-directory record that places the...
PT-2026-115144
Name of the Vulnerable Software and Affected Versions NetSurf libnsbmp versions prior to 0.1.8 Description An out-of-bounds read exists in the bmp decode rle8 and bmp decode rle4 functions. This occurs because absolute-run bound checks omit the word-alignment pad byte. A remote attacker can provi...
PT-2026-115084
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6...
PT-2026-114945
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection...
PT-2026-122776
Security vulnerability affects the langfuse package. MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients...
PT-2026-115267
Name of the Vulnerable Software and Affected Versions nifti clib versions prior to 3.0.2 Description A stack-based out-of-bounds read and write issue exists in the nifti convert n2hdr2nim function. This occurs because the NIfTI-2 dim0 value is not range-checked. An attacker can provide a speciall...
PT-2026-115230
Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. In Microsoft Office Word, this flaw...
PT-2026-114961
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml. When another user opens the template in edit mode and clientCspDisabled is true, the stored...
PT-2026-114427
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP...
PT-2026-123143
TuxCare rebuilt 21 org.springframework.security packages to address 3 CVEs. Fixed in 5.5.8-tuxcare.2...
PT-2026-123144
TuxCare rebuilt 21 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.11-tuxcare.10...
PT-2026-123145
TuxCare rebuilt 10 packages to address 1 CVE. Fixed in 4.5.0-tuxcare.8...
PT-2026-123139
TuxCare rebuilt 21 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.7-tuxcare.2...
PT-2026-123150
Root has patched AIKIDO-2026-665392 in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...
PT-2026-123140
TuxCare rebuilt 21 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.12-tuxcare.11...
PT-2026-123133
TuxCare rebuilt 21 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.14-tuxcare.8...
PT-2026-123142
TuxCare rebuilt 21 org.springframework.security packages to address 4 CVEs. Fixed in 5.6.10-tuxcare.8...
PT-2026-123141
TuxCare rebuilt 21 org.springframework.security packages to address 3 CVEs. Fixed in 5.6.9-tuxcare.2...
PT-2026-123147
TuxCare rebuilt 19 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1...
PT-2026-123146
TuxCare rebuilt 17 org.apache.logging.log4j packages to address 1 CVE. Fixed in 2.9.1-tuxcare.1...
PT-2026-123131
TuxCare rebuilt 21 org.springframework.security packages to address 11 CVEs. Fixed in 5.8.15-tuxcare.2...
PT-2026-123132
TuxCare rebuilt 4 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.1.4.RELEASE-tuxcare.1...
PT-2026-123135
TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.16-tuxcare.2...
PT-2026-123136
TuxCare rebuilt 4 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.2...
PT-2026-123137
TuxCare rebuilt 4 org.springframework.amqp packages to address 4 CVEs. Fixed in 2.2.12.RELEASE-tuxcare.1...
PT-2026-123138
TuxCare rebuilt 21 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1...
PT-2026-123134
TuxCare rebuilt 3 io.projectreactor packages to address 2 CVEs. Fixed in 3.6.9-tuxcare.1...
PT-2026-122848
Security vulnerability affects the strimzi-kafka-operator package. Uncontrolled Recursion vulnerability in Apache Commons Lang...
PT-2026-115014
Name of the Vulnerable Software and Affected Versions OpenNext Cloudflare versions 0.3.0 through 1.20.1 Description Applications that enable enableCacheInterception and rely on middleware for access control are subject to inconsistent processing of encoded pathnames between middleware matching an...
PT-2026-114798
A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow...
PT-2026-115263
Name of the Vulnerable Software and Affected Versions libmodplug versions prior to 0.8.9.1 Description A heap-based out-of-bounds read exists in the ReadAMS2 function within src/load ams.cpp. This occurs when the software processes specially crafted AMS files where the pattern effect bytes mainta...
PT-2026-115205
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search name and search email GET parameters into both the user-list query and the COUNT query used for pagination without...
PT-2026-115225
Name of the Vulnerable Software and Affected Versions EnergizeLab Eilik and EilikO affected versions not specified Description The FastAPI AI inference and profiling services lack authentication for AI model administration functions. This allows an unauthenticated remote attacker to modify the AI...
PT-2026-122693
Security vulnerability affects the temporal-server-fips package. The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor...
PT-2026-115254
Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description An issue exists where improper limitation of a pathname to a restricted directory, known as path traversal, allows an authorized attacker to execute code over a network...
PT-2026-114773
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
PT-2026-115187
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto prepend file pointing at /var/db/zoneinfo...
PT-2026-115188
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login banner field. Attackers can submit a single-line banner containing '' to escape the unquoted strongswan.co...
PT-2026-115086
Name of the Vulnerable Software and Affected Versions Telegram affected versions not specified Description A numeric truncation issue exists within the rlottie library used by Telegram. The flaw stems from improper validation of user-supplied data, which can lead to a write operation occurring...
PT-2026-115283
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...
PT-2026-114947
Name of the Vulnerable Software and Affected Versions Siemens Software Center versions prior to 4.0.9.8 Description Siemens Software Center loads dynamic-link libraries DLLs from an uncontrolled search path, a behavior known as DLL side-loading. This allows an authenticated local attacker to plac...
PT-2026-115065
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. ...
PT-2026-115085
Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through 3.54.15...