CVE-2026-92474

A use after free vulnerability exists in the Proto Link Handler component of GPAC 26.08-DEV , specifically in the function gf_inline_get_proto_lib within src/compositor/mpeg4_inline.c. The flaw requires a local attack with low complexity and low privileges. Per CVSS 3.1, the impact is LOW (base s...

CVE-2026-63225

Redocly CLI prior to @redocly/cli 2.33.2 is vulnerable to a path traversal in the split command. The command constructs output file paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying the resolved target remains inside the select...

CVE-2026-63325

@redocly/respect-core and @redocly/cli (Redocly CLI) before version 2.33.0 contain an arbitrary code execution vulnerability in the respect command. The root cause is dynamic evaluation of $faker runtime expressions in Arazzo descriptions: a crafted expression can traverse constructor , prototype...

CVE-2026-86071

CVE-2026-86071 affects Junrar , an open-source Java RAR archive library. Prior to version 7.6.1 , the LocalFolderExtractor class in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. The ro...

CVE-2026-73462

CVE-2026-73462 affects the IGMP snooping agent in Arista EOS . An adjacent, unauthenticated attacker can send malformed packets to trigger an out-of-bounds read (CWE-125) , crashing the agent and causing multicast traffic to flood all ports on the affected VLAN. Repeated exploitation may lead to ...

CVE-2026-92473

A use-after-free vulnerability was identified in the GPAC multimedia framework (version 26.08-DEV), specifically in the function gf_sg_command_del within src/scenegraph/commands.c , part of the BIFS Handler component. An attacker with local access can trigger the flaw, resulting in a low availabi...

CVE-2026-73457

CVE-2026-73457 affects Arista EOS platforms with the gRPC Network Packet Sampling Interface (gNPSI) enabled. When the EosRpcAuth trace facility is explicitly activated on the Gnpsi agent, client credentials (username and password) are written in clear text to local or remote accounting logs, acce...

CVE-2026-91106

HP has identified and remediated multiple externally reported vulnerabilities in HP Linux Imaging and Printing (HPLIP) software. The findings affect several software components and could potentially enable remote code execution , privilege escalation , denial of service , information disclosure ,...

CVE-2026-73456

Arista EOS platforms with the gNPSI (gRPC Network Packet Sampling Interface) enabled are vulnerable to unauthenticated arbitrary code execution via crafted gNPSI requests (CWE-94, code injection), granting full administrative control of the switch. CVSS 3.1 score: 10.0 . Exploitation requires gNP...

CVE-2026-91105

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-91104

HP has remediated multiple externally reported vulnerabilities in HPLIP (HP Linux Imaging and Printing) , a software suite for Linux printing. The findings affect several software components and could potentially enable remote code execution, privilege escalation, denial of service, information d...

CVE-2026-91103

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-86043

Skipper (an HTTP router and reverse proxy) has a vulnerability in the opaAuthorizeRequestWithBody filter prior to version 0.27.37 . The truncated_body signal is derived from the Content-Length header rather than the actual read result. When a body is truncated at maxBodyBytes, the header is not u...

CVE-2026-91102

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-73442

CVE-2026-73442 affects Arista EOS switches with VRRP configured (any version; authentication not required). The root cause is CWE-532 : peer device VRRP authentication credentials are written in cleartext to agent trace logs on the switch. An authenticated user with sufficient privileges (or a sy...

CVE-2026-91101

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-81876

HAPI FHIR (a Java implementation of the HL7 FHIR healthcare standard) is vulnerable to a denial of service in versions prior to 6.9.12 . The flaw is in SHCParser , where processing a Smart Health Card JWT with a zip: "DEF" header and an empty or truncated raw-DEFLATE payload causes Inflater.infla...

CVE-2026-91100

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

CVE-2026-73443

Arista EOS is vulnerable to a VRRPv2 IP-AH authentication capture-replay attack (CWE-294). An unauthenticated attacker on the same layer 2 segment can replay a legitimate authenticated VRRP advertisement to advertise stale state, preventing a backup router from assuming the virtual gateway role a...

CVE-2026-91099

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...