CVE-2026-111136: Out-of-bounds Write

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatchsf2genisvalid does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write...

CVE-2026-92707: Improperly Controlled Sequential Memory Allocation

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object from each declared array length before the...

CVE-2026-78001: Improper Neutralization of Input During Web Page Generation

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-92429: Insufficient Verification of Data Authenticity

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and...

CVE-2026-111158: Out-of-bounds Read

EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3detect in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2ISVALIDHEADER to msr3parse or ms3detect, over-reading up to 8 bytes and...

CVE-2026-103304: Missing Authorization

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the email...

CVE-2026-47218: Deserialization of Untrusted Data

runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker...

CVE-2026-105474: Improper Neutralization of Special Elements Used in a Template Engine

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root...

CVE-2026-108440: Stack-based Buffer Overflow

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-108452: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-108450: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-108449: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-108446: Use After Free

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...

CVE-2026-108455: Out-of-bounds Read

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network...

CVE-2026-108451: Numeric Truncation Error

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-108448: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

CVE-2026-108439: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-108437: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-108434: Out-of-bounds Read

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-108433: Reliance on Untrusted Inputs in a Security Decision

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-108432: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-108428: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-106708: Undefined Security Weakness

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery CSRF vulnerability in the user management controller JobUserController. The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method...

CVE-2026-108445: Stack-based Buffer Overflow

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-108444: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network...

CVE-2026-108438: Use After Free

Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-108436: Out-of-bounds Read

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-108435: Untrusted Pointer Dereference

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-108431: Stack-based Buffer Overflow

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-108430: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-108427: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-108426: Heap-based Buffer Overflow

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...

CVE-2026-111171: Server-Side Request Forgery (SSRF)

Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because checkipblocked does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA record...

CVE-2026-58100: Concurrent Execution using Shared Resource with Improper Synchronization

kqueueforkcopyknote indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file...

CVE-2026-58099: Concurrent Execution using Shared Resource with Improper Synchronization

When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes used internally to track list traversal position before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent...

CVE-2026-101308: Time-of-check Time-of-use (TOCTOU) Race Condition

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

CVE-2026-101307: Heap-based Buffer Overflow

When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the...

CVE-2026-101303: Incorrectly Specified Destination in a Communication Channel

The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic non-VNET jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail networ...

CVE-2026-109924: Allocation of Resources Without Limits or Throttling

undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields...

CVE-2026-109383: Improper Certificate Validation

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent...

CVE-2026-109932: Uncontrolled Resource Consumption

undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For...

CVE-2026-109829: Origin Validation Error

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...

CVE-2026-110378: Missing Authorization

Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5...

CVE-2026-109131: Improper Neutralization of Input During Web Page Generation

The Hub collection module documentation renderer in the unified Ansible Automation Platform UI built from upstream ansible-ui, frontend/hub renders a documentation URL part formatPartURL in DocumentationParsers.tsx as a link without restricting the URL protocol/scheme. A collection whose...

CVE-2026-106706: Undefined Security Weakness

XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting XSS in the GLUE code editor. JobCodeController.save stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped...

CVE-2026-109869: Uncaught Exception

undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before...

CVE-2026-109841: Improper Handling of Case Sensitivity

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-93483: Use of Less Trusted Source

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including...

CVE-2026-110925: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell...

CVE-2026-110926: Observable Discrepancy

A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths...