CVE-2026-110875: Out-of-bounds Write

AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update in src/ksm.cpp that writes past the fixed databuf2048 array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory...

CVE-2026-110877: Out-of-bounds Read

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

CVE-2026-111131: Out-of-bounds Read

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...

CVE-2026-111141: Out-of-bounds Read

zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzipparserootdirectory in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central...

CVE-2026-111142: Out-of-bounds Read

Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing...

CVE-2026-111143: Out-of-bounds Read

Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilovexbin in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer...

CVE-2026-100350: Uncontrolled Resource Consumption

kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An...

CVE-2026-111129: NULL Pointer Dereference

Open Asset Import Library assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation trac...

CVE-2026-111133: Out-of-bounds Read

libfsapfs through 20260921 contains an integer underflow in libfsapfskeyencryptedkeyreaddata that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash...

CVE-2026-111134: Out-of-bounds Read

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpfileentryvaluesreaddata that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files,...

CVE-2026-111140: Out-of-bounds Read

libregf through 20260526 contains a heap out-of-bounds read in libregfvalueitemreadvaluedata because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacen...

CVE-2026-111156: Out-of-bounds Write

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in initsoundfont in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry...

CVE-2026-111125: Out-of-bounds Read

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111155: Out-of-bounds Read

libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through midsetsoundfont to read heap memory out of...

CVE-2026-111159: Out-of-bounds Read

libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewflefextendedattributereaddata because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or lea...

CVE-2026-76668: Improper Handling of Overlap Between Protected Memory Ranges

A security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped data...

CVE-2026-72528: URL Redirection to Untrusted Site

"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user may become a victim of a phishing attack...

CVE-2026-46694: Missing Authorization

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hid...

CVE-2026-110904: Incorrect Authorization

ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call...

CVE-2023-32198: Improper Certificate Validation

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...

CVE-2026-95179: Uncontrolled Recursion

An issue in lottie-android 6.7.1 and earlier and master allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer...

CVE-2026-111214: Improper Neutralization of Special Elements used in an OS Command

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated...

CVE-2026-58393: Improper Limitation of a Pathname to a Restricted Directory

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override commonname field accepts path traversal sequences and openvpncscconfwrite concatenates the value into /var/etc/openvpn-csc/ / without normalization or a basename check. The...

CVE-2026-108587: Unrestricted Upload of File with Dangerous Type

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

CVE-2026-110911: Improper Neutralization of Special Elements used in an SQL Command

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders such as findOneByEmail, the query builder's whereproperty, value and whereproperty, operator, value, string/UUID-key lookup paths findByKey, updateByKey, deleteByKey and...

CVE-2026-76666: Out-of-bounds Read

A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read...

CVE-2026-73799: Stack-based Buffer Overflow

A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption...

CVE-2026-109688: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

CVE-2026-71490: Incorrect Authorization

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write...

CVE-2026-61838: Improper Authorization

Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload and PhotoPolicy::canDownload without first enforcing AlbumPolicy::canAccess. For a public, password-protected album with grantsdownload enabled...

CVE-2026-111144: NULL Pointer Dereference

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

CVE-2026-110927: Allocation of Resources Without Limits or Throttling

A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection...

CVE-2026-76659: Missing Authentication for Critical Function

A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service...

CVE-2026-102475: Allocation of Resources Without Limits or Throttling

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerabilit...

CVE-2026-110907: Incorrect Resource Transfer Between Spheres

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string like node:title or user:name used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit...

CVE-2026-79835: Improper Input Validation

A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server...

CVE-2026-55871: Improper Neutralization of Special Elements used in an SQL Command

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...

CVE-2026-79829: Improper Input Validation

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt...

CVE-2026-101309: Concurrent Execution using Shared Resource with Improper Synchronization

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-97667: Improper Neutralization of Input During Web Page Generation

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

CVE-2026-76667: Out-of-bounds Read

A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read...

CVE-2026-8145: Improper Privilege Management

The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'processregistration' due to missing validation on the 'wholesalexregistrationrole' parameter. This...

CVE-2026-76663: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS...

CVE-2026-3712: Server-Side Request Forgery (SSRF)

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for...

CVE-2026-34009: Improper Isolation or Compartmentalization

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following...

CVE-2026-102631: Improper Authentication

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

CVE-2026-111221: Improper Neutralization of CRLF Sequences

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to...

CVE-2026-34007: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later...

CVE-2026-84731: Missing Authentication for Critical Function

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

CVE-2026-109702: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31...