Fraunhofer HHI VVdeC versions before 3.2.1 have a heap out-of-bounds read vulnerability in the SEIReader::xParseSEIScalableNesting function. This flaw allows attackers to read memory beyond allocated heap buffers by miscasting the SEI wrapper object instead of its payload. Exploitation requires supplying a crafted VVC bitstream with a scalable nesting SEI containing a nested buffering period SEI, which can cause the decoder to crash or leak adjacent heap memory.
A vulnerability in ESEngine DeepSeek-Reasonix up to version 1.33.0 affects the loadGitStatus function in the build.rs file of the Build Script Execution component. This flaw can cause permission issues when manipulated, and the attack can be initiated remotely. The issue is addressed by upgrading to version 1.34.0.
Fraunhofer HHI VVdeC versions before 3.2.1 have a heap use-after-free vulnerability in the DecLibRecon::createSubPicRefBufs function. This occurs because decompressPicture clears m_subPicExtTasks without waiting for pending tasks to complete. An attacker can exploit this by supplying a crafted multi-subpicture VVC bitstream to decoders running with two or more threads, potentially causing heap memory corruption or a decoder crash.
Fraunhofer HHI VVdeC versions through 3.2.1 have a heap out-of-bounds read vulnerability. This flaw allows attackers to crash the decoder by providing a collocated picture of a different resolution in a crafted VVC bitstream. The vulnerability occurs when TMVP is enabled and error concealment is active, causing the function getColInfo to read beyond allocated memory.
Fraunhofer HHI VVdeC versions before 3.2.1 contain a heap use-after-free vulnerability. This flaw allows attackers to corrupt memory by redefining an ALF adaptation parameter set ID that is still referenced by slices. Exploitation involves supplying a crafted VVC bitstream that triggers multithreaded decoding to dereference freed APS objects, causing crashes or heap corruption.
Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 have a missing authorization vulnerability in the get_linked_payments_for_doc method. This flaw allows any authenticated user, including portal users, to supply arbitrary parameters and access Payment Ledger Entry allocation data for invoices and vouchers belonging to other companies.
Fraunhofer HHI VVdeC versions through 3.2.1 have a NULL pointer dereference vulnerability in the InterPrediction::xPredInterBlk function. This flaw can be triggered by a crafted VVC bitstream that switches the Sequence Parameter Set (SPS) to enable reference wrap-around, causing the decoder to read from missing buffers and crash. The vulnerability leads to a denial of service condition without impacting confidentiality or integrity.
Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 have a missing authorization vulnerability in the erpnext.crm.utils.get_open_activities function. This flaw allows any authenticated user, including those with portal or no roles, to supply arbitrary reference document types and names to enumerate ToDo and Event records, exposing private calendar event details.
Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 have a missing authorization vulnerability in the get_bom_items and get_bom_diff methods. These methods skip Bill of Materials (BOM) read permission checks, allowing any authenticated user, including those with portal or no roles, to retrieve sensitive BOM data such as raw materials, quantities, rates, and costs.
Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 have a missing authorization vulnerability in the erpnext.buying.utils.get_linked_material_requests method. This flaw allows authenticated users, including portal users or users without roles, to retrieve open Purchase-type Material Requests from other companies by supplying item codes. The vulnerability arises because the method lacks proper document or company permission checks.
Fraunhofer HHI VVdeC versions before 3.2.1 have an out-of-bounds read vulnerability that can cause the decoder to crash. This occurs when attackers supply bitstreams with overlapping slice CTU coverage, leading to a negative reference index in a bi-predicted BDOF coding unit. The flaw triggers an out-of-bounds read in the Slice::getRefPic function, resulting in a denial of service via decoder crash.
Treeio versions through 2.0 have an insecure deserialization vulnerability in the UpdateRecord.get_format_strings and ModuleSetting.loads functions. This flaw allows staff users to execute arbitrary code by storing crafted base64-encoded pickle payloads in the UpdateRecord format_strings field via the Django admin interface. When news feeds render, the malicious pickle data is deserialized, leading to code execution as the web server user.
A use-after-free vulnerability was identified and fixed in the Linux kernel's sch_teql network scheduler. The flaw occurs when the teql_master_xmit() function incorrectly handles the return value of a slave's ndo_start_xmit(), leading to use of a freed socket buffer (skb) after a lower queuing discipline (qdisc) drop. The fix involves improved checking of transmission completion status to prevent accessing freed memory.
A vulnerability in the Linux kernel's ksmbd component related to session procfs readers and table reference management has been resolved. The flaw involved dropping table references while per-session procfs entries were still accessible, potentially causing improper cleanup and resource handling. The fix ensures procfs entries are removed before dropping table references and properly drains procfs readers during connection cleanup to prevent access to destroyed resources.
A vulnerability in the Linux kernel's tun driver allowed attaching to ownerless tun devices without requiring CAP_NET_ADMIN capability. This issue has been fixed by enforcing CAP_NET_ADMIN for attaching to devices that have no assigned owner or group, closing a loophole that previously allowed unauthorized access. The fix preserves existing ownership checks and corrects the capability check placement.
CVE-2026-99279 addresses a vulnerability in the Linux kernel's ksmbd component related to session management. The flaw involved ended SMB sessions retaining memory and connection slots after logoff or expiration, potentially leading to resource retention issues. The fix ensures that ended sessions are properly reclaimed and removed from global tables and procfs entries, preventing stale session data from persisting. This includes unlinking sessions from connections and disposing of them safely outside locks to avoid concurrency issues.
A security vulnerability in OpenBMB Internet of Agents affects the Agent Registry component, specifically the register function in im_server/app.py. Manipulation of the desc/name argument can bypass authentication, allowing remote attackers to exploit the flaw. The product does not use versioning, so affected versions cannot be precisely identified. The vulnerability has a high severity with a CVSS score of 7.3. Public exploit code has been disclosed, but no official patch or response from the project is available yet.
A critical heap-based buffer overflow vulnerability exists in the saveParentControlInfo function of the Tenda AC19 firmware version 16.03.10.07. This flaw allows remote attackers to manipulate the deviceId argument, potentially leading to complete system compromise. The vulnerability has a CVSS score of 10.0, indicating maximum severity, and public exploit code has been disclosed.
A vulnerability in the Linux kernel SMB client allows acceptance of short SESSION_SETUP responses that lack required fields. This causes the parser to read stale data from a reused buffer, potentially leaking up to about 64 KB of memory back to the server during NTLMv2 authentication. The issue affects all supported stable kernel trees and was reproduced on version 6.6.87.2. The vulnerability has been resolved by rejecting short SESSION_SETUP responses and validating buffer lengths before processing.
A vulnerability in the Linux kernel SMB client was fixed involving improper validation of the data area in SMB2_read(). The flaw allowed a malicious SMB server to craft a response that caused the client to copy more data than was actually received, leading to out-of-bounds memory access. This could result in memory corruption or crashes when processing SMB2 read responses with manipulated DataOffset and DataLength fields.