Threat database

A NULL pointer dereference vulnerability exists in the QCborValue to JSON conversion component affecting Qt version 3.0. This vulnerability can cause application crashes or undefined behavior when processing certain inputs.

A vulnerability in libslirp's if_output() function causes queue pointer corruption, which can lead to a denial of service condition. This issue affects version 3.0 of the affected software. No CVSS score or patch information is currently available.

CVE-2026-120830 is an out-of-bounds heap read vulnerability in the libslirp component's icmp_forward_error() function. This flaw can lead to information disclosure. The affected product is Microsoft software version 3.0. No CVSS score or patch information is provided.

CVE-2026-119602 is a vulnerability in libmspack version 3.0 involving uninitialized memory disclosure through the MS-ZIP decompressor window. This flaw could potentially expose sensitive memory contents during decompression operations.

An integer underflow vulnerability in the HDF5 Szip filter can lead to an out-of-bounds read via a truncated chunk. This vulnerability is identified as CWE-125 and affects specific versions of Microsoft products including version 3.0 and the hdf5 component. No CVSS score or detailed impact information is provided.

CVE-2026-120754 is a vulnerability involving uninitialized heap memory disclosure through a truncated chunk in the HDF5 Scale-Offset filter. This flaw could potentially expose sensitive memory contents due to improper handling of heap memory during data processing.

This vulnerability in Microsoft product version 3.0 involves allocation of resources without limits or throttling in Elasticsearch, which can lead to a denial of service condition. The flaw is identified as CWE-770. No CVSS score or exploit in the wild is currently reported.

This vulnerability involves the use of a cache containing sensitive information in Elasticsearch within Microsoft product version 3.0, which can lead to information disclosure.

An incorrect authorization vulnerability in Microsoft product version 3.0 can lead to information disclosure. The issue relates to improper access control, potentially allowing unauthorized users to access sensitive information. No CVSS score or detailed impact metrics are provided. No patch or remediation details are available at this time.

A denial of service vulnerability exists in rsync versions prior to 3.5.2 due to checksum collisions in the hash_search() function. This flaw can cause the application to crash or become unresponsive when processing crafted input that triggers these collisions.

A use-after-free (UAF) vulnerability exists in the tcp component's reqsk_timer_handler function in Microsoft software version 3.0. This flaw could potentially lead to memory corruption issues. No CVSS score or detailed impact information is provided.

A NULL pointer dereference vulnerability exists in the H5HL_unprotect function when processing corrupted files. This flaw can cause the affected software to crash or behave unexpectedly due to improper handling of corrupted input data.

CVE-2026-120757 is a heap buffer over-read vulnerability in Microsoft products related to the H5L__extern_traverse function. The flaw involves non-terminated link data leading to out-of-bounds memory reads. No CVSS score or detailed impact information is provided.

CVE-2026-120756 is a heap buffer over-read vulnerability in HDF5's H5O__chunk_deserialize function caused by a malformed message size. This flaw could lead to reading memory beyond allocated buffers, potentially causing application crashes or information disclosure.

A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is recommended to address this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. It is recommended to upgrade the affected component.

A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes memory corruption. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The strands-aidr package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.

A security vulnerability identified as CVE-2026-93879 affects the Keycloak package. The issue is resolved in Keycloak version 26.8.1-r1 and later. Versions prior to 26.8.1-r1 are vulnerable. No CVSS score or detailed impact information is provided.

A security vulnerability exists in Keycloak due to an issue in pgjdbc, the PostgreSQL JDBC Driver, specifically affecting versions prior to 26.8.1-r1. The vulnerability has a CVSS score of 5.3, indicating medium severity, and impacts confidentiality without affecting integrity or availability. A patch is available in version 26.8.1-r1.