CVE-2026-120243 is a vulnerability in FFmpeg versions 2.0 through 9.0.2 involving the use of an uninitialized variable in the Go2Meeting decoder. This flaw allows attackers to leak stack memory by exploiting out-of-range palette indices in crafted G2M3/G2M4 streams. The vulnerability arises because the function kempf_restore_buf() copies uninitialized stack bytes, potentially exposing sensitive data such as pointers or stack guards.
CVE-2026-120190 is a cross-site scripting (XSS) vulnerability in PostyBirb Plus versions 3.1.0 through 3.1.19. It affects an unknown functionality within the Submission Description Editor component, specifically the file DescriptionInput.tsx. The vulnerability allows remote attackers to perform XSS attacks. A public exploit exists. Upgrading to version 3.1.76 resolves this issue.
A security flaw exists in ken678 YznCMS versions up to 2.2.0 in the Backend function of app/admin/controller/auth/Group.php related to improper privilege management. This vulnerability can be exploited remotely and is fixed in version 2.2.1.
The pystr-codec package on PyPI contains malicious code that executes on every Python startup. It runs obfuscated JavaScript via a Bun engine to exfiltrate credentials to a public GitHub repository, establish persistence, accept remote commands, spread using stolen credentials, and perform destructive actions if credentials become invalid. This malware is linked to the Miasma-family worm.
CVE-2026-120189 is a critical stack-based buffer overflow vulnerability in the D-Link DIR-505 router version 1.10B02. The flaw exists in the TFTP Upload Filename Handler component, specifically in the save_upload_file/mp_upload_file functions within /usr/bin/tftpd. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of exploitation.
XS::libbrotli versions before 1.2.1.0 include a bundled brotli library with an out-of-bounds write vulnerability in the decoder. This flaw allows an attacker to supply crafted brotli streams that can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. The vulnerability is fixed in version 1.2.1.0, which updates the bundled brotli library to version 1.2.1. Upgrading the system brotli library does not mitigate this issue because the vulnerable library is statically linked.
Red Hat has issued a security advisory for the java-17-openjdk packages in Red Hat Enterprise Linux 9, addressing multiple vulnerabilities across various components of the OpenJDK 17 runtime and development kit. The update includes enhancements and fixes for issues related to PKCS5 padding, TLS certificate handling, LDAP logins, SASL authentication, HTTP client and server handling, XML processing, image and font rendering, Kerberos validation, and more. These fixes collectively address a broad range of security concerns in the Java environment provided by OpenJDK 17.
TànPhá V3 is an open-source, modular penetration testing framework designed for Termux on Android and lightweight Linux environments. It automates discovery, fingerprinting, vulnerability assessment, validation, and reporting using a state-machine architecture. The tool supports multiple exploitation vectors including SQL injection, command injection, file upload, local file inclusion, and a stateful PHP remote access trojan (RAT). It features automatic CSRF token bypass for authenticated scans and basic web application firewall evasion. The project is actively maintained with plans for advanced evasion techniques and additional modules in future releases. It is intended solely for authorized security testing and educational purposes.
CVE-2026-114605 is a vulnerability in dnspython's dns.name.from_wire_parser() function that can cause excessive CPU usage when processing maliciously crafted DNS messages. This can degrade or deny service to applications that handle untrusted DNS wire format messages using dnspython. The issue is fixed in dnspython version 2.9.0. No known workarounds exist.
CVE-2026-115585 is a vulnerability in pypdf that allows an attacker to craft a PDF with repeated malformed cross-reference streams, causing long runtimes during processing. This issue was a follow-up to a previous advisory and has been fixed in pypdf version 6.21.2. Users unable to upgrade immediately can apply the changes from a specific pull request as a workaround.
CVE-2026-115580 is a vulnerability in pypdf that allows an attacker to craft a PDF file with large or incorrect upper limits in the xref table, causing long runtimes when the file is opened. This can lead to denial of service due to resource exhaustion. The issue has been fixed in pypdf version 6.21.2. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-115572 is a vulnerability in pypdf that allows an attacker to craft a PDF causing long runtimes when the same missing indirect object is referenced repeatedly. This can degrade performance during file processing. The issue has been fixed in pypdf version 6.21.2. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
A vulnerability in the OpenTelemetry Python package (opentelemetry-api) affects the TraceState.from_header function, which parses the W3C tracestate header. The parsing uses a regular expression with an unbounded optional-whitespace run and no length limit, causing an O(N²) CPU cost when processing a tracestate header with a long run of spaces or tabs without commas. This can lead to significant CPU consumption and blocking of asyncio servers handling requests. The issue is present in versions from 1.0.0 through 1.45.0 and fixed in version 0.15.7. The vulnerability allows an unauthenticated attacker to cause denial of service by sending a specially crafted large tracestate header.
CVE-2026-113791 is a vulnerability in pypdf that allows an attacker to craft a PDF file causing large memory usage during parsing of content streams with many small operations. This can lead to resource exhaustion on the system processing the PDF. The issue has been fixed in pypdf version 6.21.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-113790 is a vulnerability in pypdf that allows an attacker to craft a PDF file causing large memory usage during parsing of arrays and dictionaries with many elements. This can lead to resource exhaustion on the system processing the PDF. The issue has been fixed in pypdf version 6.21.0. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
CVE-2026-113789 is a vulnerability in pypdf that allows an attacker to craft a PDF causing excessive memory usage and long runtimes when retrieving form fields. This can degrade performance or cause denial of service. The issue is fixed in pypdf version 6.21.0.