CVE-2026-111148

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs reads...

CVE-2026-111156

libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in initsoundfont in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry...

CVE-2026-111163

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in WMParseNewHmi in src/fhmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation,...

CVE-2026-111376

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStreamNew that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTSSIZE request with a cbRequested of fewer...

CVE-2026-111380

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends audinmac.m, audinios.m, which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^...

CVE-2026-111166

libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMFLoad loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex...

CVE-2026-111165

libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTMLoad because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and...

CVE-2026-111155

libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through midsetsoundfont to read heap memory out of...

CVE-2026-111143

Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilovexbin in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer...

CVE-2026-111137

libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets...

CVE-2026-111151

OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row pa...

CVE-2026-110876

AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before notetable by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read duri...

CVE-2026-111153

Game Music Emu libgme through 0.6.5 contains a global out-of-bounds read vulnerability in ClassicEmu::mutevoices that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chipflags 0x3F, opene...

CVE-2026-111142

Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing...

CVE-2026-111146

ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read,...

CVE-2026-111127

catdoc through 0.95 contains an out-of-bounds read vulnerability in copyunicodestring in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST record...

CVE-2026-111123

FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, wri...

CVE-2026-111135

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpvolumevaluesreaddata that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump li...

CVE-2026-109413

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure recursed through lexInlineMapping and lexInlineSequence for every and of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A documen...

CVE-2026-111379

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistentcachereadentryv3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persistcachegetdata,...

CVE-2026-111381

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistentcachereadentryv2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes...

CVE-2026-111382

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in generalLumaToYUV444 and generalChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface...

CVE-2026-111373

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

CVE-2026-111377

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory...

CVE-2026-111273

unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname in tar/parse-tar.c, reachable through the arentrygetname API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashi...

CVE-2026-111126

catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of processitem in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2c...

CVE-2026-111125

CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via inputnnybble in fitshdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS1 declaring oversized til...

CVE-2026-111131

libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depackp61a in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sampl...

CVE-2026-111162

WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser WMParseNewHmp that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing application...

CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-111128

Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById to return...

CVE-2026-100351

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...

CVE-2026-110922

Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-104715

A non-privileged user can control a CIFS credentials file consumed by a privileged mount.cifs invocation, and the value from the credentials file is copied into the mount option string without validation. As a result, attacker-controlled mount options can be injected into the privileged mount...

CVE-2026-110913

Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-110914

Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-110915

Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-110916

Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-110917

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110918

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-110919

Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-110920

Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-110921

Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-111154

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parsegen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

CVE-2026-111375

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOWORDERFIELDTITLE update that wfrailwindowcommon...

CVE-2026-18662

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...

CVE-2026-111145

ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PTBINARY MAPI property to crash ytnefprint or libytn...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

CVE-2026-104827

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-111270

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...