CVE-2026-107737 is a medium severity vulnerability in SumatraPDF versions 3.6.1 and earlier, and in certain pre-release 3.7.0 builds without WebView2 support. It involves improper validation of an array index in the handling of its:// URLs, leading to an out-of-bounds pointer read and process termination when opening crafted CHM files via the IE fallback backend. No fixed version is currently available.
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying SumatraPDF with this INI file, including a malformed file or zero-valued permission settings, can silently bypass configured disk, network, printing, registry, clipboard, preference, and fullscreen restrictions. The -restrict command-line path works correctly and is not affected. No fixed version is available as of this review.
SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW(). A user with an external editor configured or auto-detected who opens a PDF with a crafted .synctex.gz file and invokes inverse search can inject command-line flags; the resulting impact depends on the target editor interpreting those flags and can include unintended editor actions or code execution through a malicious extension. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
SumatraPDF versions 3.6.1 and earlier contain a NULL pointer dereference vulnerability in the FrameOnCommand() function when handling CmdExec commands. This occurs if no document tab is open, allowing a local process with appropriate integrity level to cause the application to crash by dispatching CmdExec via DDE or WM_COPYDATA. The impact is limited to abrupt termination and loss of unsaved state, with no broader effects reported. No fix is currently available.
SumatraPDF versions 3.6.1 and earlier contain a code injection vulnerability where untrusted document paths and PDF link targets are improperly handled in notification text. This allows an attacker to inject commands that execute a local program when a user clicks a crafted link. No fixed version is currently available.
TP-Link Tapo C325WB v2 cameras use a time-seeded pseudo-random number generator to create the pre-shared key for their local media streaming service. This method produces predictable keys that an unauthenticated attacker on the adjacent network can recover. Exploiting this vulnerability allows unauthorized access to live video and audio streams, compromising their confidentiality and integrity.
TP-Link Tapo C325WB v2 has an unauthenticated authorization bypass vulnerability in its HTTPS JSON API on TCP port 443. An attacker on the adjacent network can exploit this flaw by appending an onboarding-scoped object to a JSON request, bypassing session verification and performing privileged actions without authentication. This can lead to unauthorized access to live video and audio streams, modification of device settings, and exposure of sensitive device information or secrets.
An
unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the
RTSP streaming service on TCP port 554 when the Camera Account feature is
enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory
corruption and crash the streaming daemon.
Successful
exploitation may allow an unauthenticated adjacent-network attacker to disrupt
live video and related streaming functions until the affected service recovers
or restarts.
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include contentOffset, the directory expression dirOff64 + dirLen64, and the decoded-section offset + size, along with secondary-header range handling. Opening a crafted LIT file that reaches one of these variants can cause invalid pointer reads and deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation overflow to a negative value, pointer construction reaches an invalid read in LitU32(), causing deterministic application termination. The supplied evidence does not demonstrate code execution, information disclosure, arbitrary read, or integrity impact. No fixed version is available as of this review.
CVE-2026-107651 is a heap-based buffer overflow vulnerability in the Eye of GNOME (eog) PNG metadata reader on Red Hat Enterprise Linux 6. It arises from improper state handling when parsing split metadata chunks in PNG files. A remote attacker could exploit this by tricking a user into opening a maliciously crafted PNG file, potentially causing a denial of service through application crash or arbitrary code execution. The vulnerability has a medium severity with a CVSS score of 5.5. No specific affected versions or patch information is provided in the available data.
SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.
Mechanize versions prior to 2.14.1 have a vulnerability where credential headers supplied by the caller are sent to a different host after an HTTP redirect. This occurs because Mechanize improperly reapplies request headers after redirects, potentially exposing bearer tokens or session cookies to an attacker controlling the redirect target. The issue does not affect Mechanize's cookie jar or authentication store. The vulnerability is fixed in version 2.14.1.
CVE-2026-107714 is a vulnerability in the sparklemotion mechanize library prior to version 2.14.1. It involves improper handling of HTTP redirects in Mechanize::HTTP::Agent#response_redirect, where redirects are treated as same-origin based only on host matching without consistent scheme and port comparison. This can cause sensitive headers like Authorization and Cookie to be sent over unencrypted HTTP or to unintended ports, potentially exposing credentials. The issue affects caller-supplied headers but does not impact integrity or availability. The vulnerability is fixed in version 2.14.1.
CVE-2026-96207 is a critical vulnerability in Microsoft Partner Center involving improper certificate validation. This flaw allows an unauthorized attacker to elevate privileges over a network, potentially compromising confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity. An official fix is available from Microsoft to remediate this issue.
CVE-2026-94510 is a critical authorization bypass vulnerability in Microsoft Bookings. It involves an attacker exploiting a user-controlled key to elevate privileges over a network. The vulnerability has a CVSS score of 9.9, indicating high severity with potential impact on confidentiality, integrity, and availability. An official fix is available from Microsoft.
CVE-2026-88131 is a critical vulnerability in Microsoft Dataverse involving deserialization of untrusted data. This flaw allows an unauthorized attacker to execute arbitrary code remotely without any user interaction or privileges. The vulnerability has a CVSS score of 9.8, indicating a high severity impact on confidentiality, integrity, and availability. An official fix is available from Microsoft.
CVE-2026-83947 is a high-severity vulnerability in Microsoft Azure Event Grid System involving missing authorization. This flaw allows an authorized attacker to perform network-based spoofing attacks. The vulnerability has been officially fixed by Microsoft. Since Azure Event Grid is a cloud service, Microsoft manages the remediation server-side. There are no known exploits in the wild at this time.
CVE-2026-83943 is a high-severity vulnerability in Microsoft Azure API Center that allows unauthorized actors to expose sensitive information over a network. The vulnerability is classified under CWE-200, indicating exposure of sensitive data to unauthorized parties. Microsoft has issued an official fix for this vulnerability. Since Azure API Center is a cloud service, Microsoft manages the remediation on their side.