CVE-2026-123096 is a memory exhaustion vulnerability in the anacrolix/torrent client up to version 1.61.0. It arises from the tracker/http package where malicious HTTP trackers can send unbounded announce or scrape responses. These responses are buffered without limits by Client.Announce and Client.Scrape, leading to potential process memory exhaustion and client crashes.
mpv versions from 0.29.0 up to but not including 0.42.0 contain a CRLF injection vulnerability in the bundled ytdl_hook script. This flaw allows remote attackers who control a feed or page to inject unchecked playlist entries by embedding newline characters in playlist URLs. Exploitation can bypass url_is_safe() checks to open local file URLs or av:// inputs, potentially leading to local file reading or code execution via loading shared objects through ladspa.
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing JavaScript when victims attach it to Agents and view them, exposing Credentials, Agents and Events, and admin actions if the victim is an administrator.
Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.
SDL_mixer versions 3.1.2 through 3.2.4 contain a stack-based buffer overflow vulnerability in the FetchXLaw() function within src/decoder_aiff.c. This flaw arises from miscalculated output offsets when expanding A-law or mu-law audio samples, allowing an attacker to craft a malicious AIFF-C file that overwrites approximately 1 KB of adjacent stack memory during decoding. Exploitation can lead to application crashes or potentially arbitrary code execution.
SDL_mixer versions 3.1.2 through 3.2.4 have a stack-based buffer overflow vulnerability in the FetchXLaw() function when decoding A-law or mu-law WAV files. This flaw allows crafted WAV files to overwrite approximately 1 KB of adjacent stack memory, potentially causing application crashes or arbitrary code execution.
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or /videos/:idOrSlug, or POST to /songs/:idOrSlug/merge, to alter genres, reassign tracks and merge songs.
Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded id can obtain image filenames, viewer and direct file URLs, and download private images.
fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense notes, recurrence schedules, and full user rows of participants and group members.
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar, currency, and bankingId and obapiProviderId open-banking identifiers.
SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries.
Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0.
A vulnerability has been fixed in the firmware of the Zyxel GS1900-24E network switch, specifically in version 2.90(AAHK.2)C0 and earlier. The issue relates to a security flaw identified as CWE-787. No CVSS score or detailed impact information is provided.
A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function ConnectionManager.connect of the file im_server/app.py of the component WebSocket Connection Manager. The manipulation of the argument agent_name results in missing authentication. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.08.
Users are recommended to upgrade to version 24.09.08, which fixes the issue.
Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz.
An authenticate user with access to sfa component can override the service to use on vcard import and access to other service.
This issue affects Apache OFBiz: before 24.09.08.
Users are recommended to upgrade to version 24.09.08, which fixes the issue.
Apache OFBiz before version 24.09.08 contains a code injection vulnerability (CWE-94) that allows an unauthenticated attacker to exploit temporary-file handling and inject a malicious file URI. This causes OFBiz to load an attacker-controlled Screen definition, potentially leading to arbitrary code execution or unauthorized actions. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an authentication bypass vulnerability in the RequestHandler component. This flaw allows a remote unauthenticated attacker to access protected views by appending the protected path as a suffix to a public request path, causing improper authorization. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authentication bypass vulnerability in the RequestHandler.renderView function. This flaw allows remote unauthenticated attackers to bypass request-map authentication by manipulating the _LAST_VIEW_NAME_ value stored in the anonymous session. As a result, protected views and associated business data may be exposed without proper authorization. The issue is fixed in version 24.09.08.