Search: 5.1.8.7

FLTK versions up to and including 1.4.5 have a stack-based buffer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw occurs when processing BMP or ICO files with a colors_used field value exceeding 256, which overflows a 768-byte colormap array. Exploitation can lead to application crashes or potentially allow code execution.

A vulnerability in go-jose versions prior to 4.1.5 allows an attacker to cause a denial of service by triggering a stack overflow through deeply nested JSON arrays or objects. This uncontrolled recursion exceeds Go's stack limit during parsing of attacker-controlled JSON. The issue is fixed in version 4.1.5.

A cross-site scripting (XSS) vulnerability exists in the lxsmnsyc seroval library's JavaScript-output APIs prior to version 1.0.0 and from 1.5.5 up to but not including 1.6.10. The issue arises when regular expressions containing a less-than character are serialized without proper escaping for embedding in HTML script elements. This can allow an attacker to inject malicious scripts if untrusted input is serialized and embedded in a web page. The vulnerability is fixed in version 1.6.10.

CVE-2026-113913 is a vulnerability in Apple iOS and iPadOS where processing web content may disclose sensitive information due to an input validation issue. The flaw affects multiple Apple operating systems and has been addressed with improved input validation. Fixed versions include iOS 26.7.2, iOS 27.2, iPadOS 26.7.2, iPadOS 27.2, and macOS versions 15.8.2 and 27.2. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-86971 is an out-of-bounds write vulnerability in Apple iOS and iPadOS that can cause unexpected app termination when processing a maliciously crafted image. The issue has been addressed with improved bounds checking and fixed in iOS 26.7.2, 27.2, iPadOS 26.7.2, 27.2, and macOS versions 15.8.2 and later. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-116576 is an OS command injection vulnerability in the systeminformation Node.js library prior to version 5.33.16. The issue arises from improper sanitization of service names used in PowerShell commands on Windows, allowing an attacker to inject arbitrary PowerShell expressions. Exploitation requires local or forwarded attacker-controlled input to the vulnerable services() or getDynamicData() functions. The vulnerability is fixed in version 5.33.16.

CVE-2026-70382 is a cross-site scripting (XSS) vulnerability affecting multiple WolfVision Cynap devices. The issue arises because some externally supplied values stored by the device are rendered in the web interface without proper output encoding. An attacker who can influence these stored values may cause script execution in the browser of users who view the affected pages. Exploitation requires both the ability to influence stored values and a user viewing the vulnerable page. The vulnerability has a medium severity rating with a CVSS score of 5.1.

CVE-2026-65628 is a vulnerability in the potatosalad jose library versions 1.5.0 up to but not including 1.11.13. It involves uncontrolled recursion in the function jose_jwk:shared_secret/2 when deriving an ECDH shared secret from two JSON Web Keys (JWKs) of differing key types. An attacker can supply a crafted JWK with a mismatched key type to cause an infinite tail-recursive loop, resulting in 100% CPU usage on an Erlang scheduler and potential denial of service due to resource exhaustion.

CVE-2026-116478 is a medium severity vulnerability in a2aproject a2a-go up to version 2.4.0. It affects the CreateExecutor function in the Push Notification Handler component, causing information exposure through error messages. The vulnerability can be exploited remotely. Upgrading to version 2.5.0 mitigates the issue.

OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

HashiCorp Consul and Consul Enterprise versions 1.17.0 up to 2.0.4 have an authorization bypass vulnerability in the agent's service mesh leaf certificate API. This flaw could allow an attacker without a valid ACL token to retrieve a cached service leaf certificate and its private key. The vulnerability is identified as CVE-2026-105765 and has a high severity rating with a CVSS score of 7.5. Fixed versions are available in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a non-default access configuration “public”, include an anonymous attacker) to issue database specific functions that should not be allowed. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.

CVE-2026-115907 is a high-severity vulnerability in the zip-rs zip2 library for Rust, affecting versions from 5.1.0 up to but not including 9.0.0. The issue involves uncontrolled resource consumption due to unbounded preallocation of output capacity based on attacker-controlled ZIP64 uncompressed sizes before validating the compressed stream. This can cause a panic due to capacity overflow in certain decoder paths, potentially terminating an archive-processing service. The vulnerability is fixed in version 9.0.0.

Mattermost versions 11.7.x through 11.10.x (up to specified patch levels) contain a vulnerability in the WebSocket msgpack decoder where allocation limits are not properly enforced. This flaw allows an authenticated remote attacker to cause excessive server memory allocation by sending a crafted binary WebSocket frame with a large declared Bin32 payload length. The issue leads to a denial-of-service condition due to resource exhaustion.

Mattermost versions 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.10, and 11.10.x up to 11.10.1 contain a vulnerability where the application fails to properly bind the volume of text extracted from an uploaded PDF. This flaw allows an authenticated user to cause a denial of service by uploading a crafted PDF whose compressed content stream expands into a very large amount of text, exhausting server memory.

CVE-2026-90885 is an XML External Entity (XXE) vulnerability in the Apache Camel Saxon component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2. The vulnerability arises because the default Saxon Configuration used by the XQueryBuilder allows DOCTYPE declarations and external entity resolution when the message body is already a javax.xml.transform.Source. This can lead to disclosure of files readable by the Camel process and can cause the process to issue network requests to attacker-controlled hosts. Fixed versions are 4.18.5, 4.22.2, and 4.23.0.

A weakness in Kameleo up to version 5.0.1.26 affects the Local API component, specifically the /profiles file, allowing remote attackers to cause information disclosure. The issue is mitigated by upgrading to version 5.2.0.