CVE-2026-125182: FFmpeg: FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because…

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder jointdecode function because cookdecodeinit does not check jssubbandstart against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decodebuffer0, leaking pointers and...

CVE-2026-125183: FFmpeg: FFmpeg through 9.0.2 contains a denial of service vulnerability in pps_3d_extension() in libavcodec/hevc/ps.c that…

FFmpeg through 9.0.2 contains a denial of service vulnerability in pps3dextension in libavcodec/hevc/ps.c that allows attackers to exhaust CPU through unbounded depth lookup table loops. Attackers can supply crafted HEVC files with repeated PPS NAL units that trigger hundreds of millions of bit...

CVE-2026-125179: FFmpeg: FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c…

FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF0/CBFZ codebook chunk, causing...

CVE-2026-125180: FFmpeg: FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows…

FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF block in TIFF, JPEG, PNG or WebP images to trigger...

CVE-2026-125176: FFmpeg: FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decode_hybrid() in libavcodec/flashsv.c…

FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decodehybrid in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated data ends mid-pixel to leak heap memory in...

CVE-2026-125216: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to…

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/dpxenc.c that allows attackers to crash the process via unvalidated bitsperrawsample for RGB48 input. Attackers can supply a 12-bit RGB image, such as JPEG 2000, that when transcoded to DPX selects encodegbrp12 a...

CVE-2026-125222: FFmpeg: FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that…

FFmpeg through 9.0.2 contains an integer overflow vulnerability in happarseframeheader in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap texsize, causing decompresschunksthrea...

CVE-2026-63497: titraio titra: titra is an open source time tracking project

titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches...

CVE-2026-115864: Memory Allocation with Excessive Size Value

Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, s...

CVE-2026-102643: ronf asyncssh: AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on…

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.mappath uses posixpath.normpath on a client-supplied path and removes only one leading slash before passing the...

CVE-2026-125101: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap byt...

CVE-2026-125201: FFmpeg: FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in vk_av1_decode_slice()…

FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in vkav1decodeslice in libavcodec/vulkanav1.c because the tile-count limit is checked only on entry. Attackers can supply a crafted AV1 stream with more than 256 tiles decoded via the Vulkan hardware...

CVE-2026-124506: Dianping CAT: A vulnerability has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1

A vulnerability has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This vulnerability affects the function Model.getDomain of the file WEB-INF/tags/hourlyReport.tag of the component Report Handler. The manipulation of the argument domain leads to cross site scripting. It is possible to initiate...

CVE-2026-125187: FFmpeg: FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta_encode_frame() in…

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's ttaencodeframe in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame,...

CVE-2026-124624: n/a PipraPay: A weakness has been identified in PipraPay 3.0.0

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hashhmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

CVE-2026-125063: Red Hat Red Hat Ansible Automation Platform 2: A flaw was found in the rrule validation of schedules in automation controller

A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length...

CVE-2026-119756: arendst Tasmota: Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in…

Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the...

CVE-2026-113970: Apple: A use-after-free issue was addressed with improved memory management

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS...

CVE-2026-112319: Red Hat: The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote…

The GSS-RPC layer in MIT Kerberos 5 aka krb5 does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service memory exhaustion or excessive CPU consumption in kadmind via crafted RPC requests that trigger unbounded memory allocations during X...

CVE-2026-123816: pyload: pyLoad is a free and open-source download manager written in Python

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.checkapikey caches successful validation in self.apikeycache using only the attacker-controlled keyid. After a legitimate key populates the cache, a forged API key with the same keyid reaches the...

CVE-2026-120834: Tobias WP2LEADS: Incorrect Privilege Assignment vulnerability in Tobias WP2LEADS wp2leads allows Privilege Escalation.This issue affects…

Incorrect Privilege Assignment vulnerability in Tobias WP2LEADS wp2leads allows Privilege Escalation.This issue affects WP2LEADS: from n/a through 3.5.17...

CVE-2026-113702: n/a iomad: A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4

A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function localiomadpluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in authorization bypass. The attack can be...

CVE-2026-124588: huggingface finetrainers: A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolvecomponentcls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The atta...

CVE-2026-119503: Welcart Welcart e-Commerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart…

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Code Injection.This issue affects Welcart e-Commerce: from n/a through 2.12.6...

CVE-2026-125221: FFmpeg: FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in score_header() in libavcodec/flac_parser.c…

FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in scoreheader in libavcodec/flacparser.c that allows attackers to exhaust the thread stack via crafted FLAC input. Attackers can supply a FLAC stream packed with many small valid-looking frame headers, forcing deep recursion...

CVE-2026-123812: dynatrace-oss dynatrace-mcp: Dynatrace MCP Server is an MCP server for Dynatrace Observability

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the createdynatracenotebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator...

CVE-2026-123810: dynatrace-oss dynatrace-mcp: Dynatrace MCP Server is an MCP server for Dynatrace Observability

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping. The src/capabilities/find-monitored-entity-by-name.ts capability embeds entityNames in string...

CVE-2026-125264: FFmpeg: FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parse_frame_header() in…

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parseframeheader in libavcodec/jpegxlparser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toccount, making the...

CVE-2026-123797: supertokens supertokens-core: SuperTokens Core is an open source authentication server

SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In...

CVE-2026-125263: FFmpeg: FFmpeg 9.0 through 9.0.2 built with liblcevc_dec fails to validate LCEVC enhanced output dimensions against max_pixels…

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...

CVE-2026-125254: FFmpeg: FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to…

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ffvvcslicerpl fails to validate numrefidxactive against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ffvvcmvscale,...

CVE-2026-124959: Spotify, hnswlib: The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized…

The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causin...

CVE-2026-125251: FFmpeg: FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder alloc_frame() function in…

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder allocframe function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC H.266 file with a very large number of NAL units per access un...

CVE-2026-125236: FFmpeg: FFmpeg through 9.0.2 contains a memory leak vulnerability in alloc_frame() in libavcodec/vvc/refs.c that leaks SPS and…

FFmpeg through 9.0.2 contains a memory leak vulnerability in allocframe in libavcodec/vvc/refs.c that leaks SPS and PPS references when frame buffer allocation fails. Attackers can supply a crafted VVC H.266 stream that repeatedly replaces parameter sets, steadily growing memory use and causing...

CVE-2026-124625: n/a PipraPay: A security vulnerability has been detected in PipraPay 3.0.0

A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selectedids/ItemID leads to sql injection. It is possible to initiate t...

CVE-2026-112314: Red Hat: clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries,…

clnttcpcall in lib/rpc/clnttcp.c in MIT Kerberos 5 aka krb5 does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service memory leak in GSS-RPC client programs by injecting RPC replies with mismatched XIDs or by triggering authentication retries...

CVE-2026-125098: FFmpeg: FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c…

FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8lossydecodealpha in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk is shorter than width height to disclose...

CVE-2026-125197: FFmpeg: FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to…

FFmpeg through 9.0.2 contains an integer underflow in decodeframe in libavcodec/lcldec.c that allows attackers to trigger a heap out-of-bounds read via short ZLIB packets with FLAGMULTITHREAD. Attackers can supply a crafted AVI or MKV file with an LCL video stream whose packet is shorter than 8...

CVE-2026-124035: Amazon amazon-braket-schemas: Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote…

Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote authenticated user with S3 write access to the quantum task output location to execute arbitrary code on any machine that retrieves the quantum task results via a crafted task...

CVE-2026-121576: AtlasAiDev MCP Server for WordPress: Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub…

Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.1...

CVE-2026-120856: Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment...

CVE-2026-119524: Aguila Technologies WP Customer Area: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3...

CVE-2026-125234: FFmpeg: FFmpeg through 9.0.2 contains an integer overflow vulnerability in wavpack_encode_init() in libavcodec/wavpackenc.c…

FFmpeg through 9.0.2 contains an integer overflow vulnerability in wavpackencodeinit in libavcodec/wavpackenc.c that causes an infinite loop when computing block size from sample rate and channel count. Attackers can supply a crafted audio file, such as a WAV header declaring a huge sample rate...

CVE-2026-113969: Apple: A logic issue was addressed with improved state management

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An...

CVE-2026-124637: Kompini Tankuam Places: A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom…

A stored Cross-Site Scripting XSS vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a request to https://www.luxorgymtarrega.com/dadespersonals/modificarClient/ID. User-provided data is neither validated nor escaped before being displayed in th...

CVE-2026-124499: Fengoffice Feng Office: A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2

A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function writetranslations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulation of the argument lang leads to code injection. The attack...

CVE-2026-123870: Eclipse Foundation otterdog: The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval()

The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval. When the GITHUBWEBHOOKSECRET configuration value is unset or empty the code default is None, the HMAC signature check is skipped entirely, allowing an unauthenticated network client...

CVE-2026-121780: Gijo Varghese Flying Images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Gijo Varghese Flying Images nazy-load allows Stored XSS.This issue affects Flying Images: from n/a through 2.4.15...

CVE-2026-125109: rack: Rack is a modular Ruby web server interface

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-123796: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable reference...