Search: 22.9-18

Apache Traffic Server versions including 5.3.0-2ubuntu1 through 9.2.3+ds-1+deb12u1build1 contain a vulnerability (CVE-2025-31699) that can cause an origin connection to be returned to the shared pool improperly. This vulnerability has a high severity with a CVSS score of 8.9, indicating a network attack vector with high impact on confidentiality and integrity and low impact on availability.

A heap-based buffer overflow vulnerability exists in the GStreamer rtpL16depay plugin (gst-plugins-good1.0) due to improper validation of RTP payload length. This flaw allows remote attackers to execute arbitrary code within the context of the affected process. Multiple specific versions of gst-plugins-good1.0 are affected. The vulnerability is rated critical with a CVSS score of 9.8.

CVE-2026-92205 is a vulnerability in BusyBox related to libarchive that allows arbitrary file creation via a symlink directory traversal. It affects multiple Ubuntu package versions of BusyBox. The vulnerability has a medium severity with a CVSS score of 6.1. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

A stack-based buffer overflow vulnerability exists in the APNG file parsing functionality of GIMP. This flaw allows for remote code execution when a specially crafted APNG file is processed. The vulnerability affects multiple specific versions of GIMP as listed. The CVSS v3.0 score is 7.8, indicating high severity with high impact on confidentiality, integrity, and availability.

A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

CVE-2026-113795 is a medium severity vulnerability affecting multiple versions of pypdf2, a pure-Python PDF library. The vulnerability was published on October 23, 2026. The CVSS 4.0 score is 6.0, indicating a network attack vector with low attack complexity but requiring user interaction and partial attack complexity. The vulnerability impacts various Ubuntu package versions of pypdf2. No public exploit or known active exploitation is reported. No patch or remediation details are provided in the available data.

CVE-2026-113794 is a medium severity vulnerability affecting multiple versions of the pypdf2 library, a free and open-source pure-Python PDF library. The vulnerability is present in various released versions including some Ubuntu package builds. The CVSS 4.0 score is 6.0, indicating a moderate risk. No public exploit or known exploitation in the wild has been reported. Patch or remediation details are not provided in the available data.

CVE-2026-113793 is a medium severity vulnerability affecting multiple versions of pypdf2, a free and open-source pure-Python PDF library. The vulnerability was published on October 23, 2026. The CVSS 4.0 base score is 6.0, indicating a network attack vector with low attack complexity but requiring user interaction and resulting in high impact on availability. No public exploit code or known exploitation in the wild is reported. The affected versions include various specific builds from 1.23+git20141008-1 through 6.9.2-2 and others as listed. No patch or remediation information is provided in the source data, so the patch status is not confirmed.

CVE-2026-113792 is a medium severity vulnerability in pypdf2, a free and open-source pure-Python PDF library. The issue affects multiple specific versions of pypdf2, including various Ubuntu package versions. The CVSS 4.0 score is 6.0, indicating a network attack vector with low attack complexity but requiring user interaction and partial attack type privileges. No public exploits or known active exploitation have been reported.

CVE-2026-113791 is a medium severity vulnerability affecting multiple versions of pypdf2, a pure-Python PDF library. The vulnerability was published on October 23, 2026. It has a CVSS 4.0 base score of 6.0, indicating a network attack vector with low attack complexity and partial attack requirements. The vulnerability requires user interaction and results in high impact on availability. No public exploit or known active exploitation is reported. Multiple specific versions of pypdf2 are affected, including various Ubuntu package versions.

CVE-2026-113790 is a medium severity vulnerability affecting multiple versions of pypdf2, a free and open-source pure-Python PDF library. The vulnerability was published on October 23, 2026. It has a CVSS 4.0 base score of 6.0, indicating a network attack vector with low attack complexity but requiring user interaction and partial attack complexity. No public exploits or known exploitation in the wild have been reported. The affected versions include various builds from 1.23+git20141008-1 through 6.9.2-2 and others as listed. No patch or remediation information is provided in the source data.

CVE-2026-113789 is a medium severity vulnerability affecting multiple versions of pypdf2, a free and open-source pure-Python PDF library. The vulnerability was published on October 23, 2026. The CVSS 4.0 base score is 6.0, indicating a medium impact with network attack vector and low attack complexity. The vulnerability requires user interaction and privileges are not required for exploitation. No known exploits in the wild have been reported. The affected versions include various specific builds and releases of pypdf2, as listed.

A path traversal vulnerability (CWE-22) exists in Bold Grid weForms allowing attackers to access restricted directories. This affects versions up to and including 1.6.28. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability. No patch or remediation information is currently provided.

A segmentation violation vulnerability exists in the check_media_profile function of the gpac software. This flaw can cause a crash when processing media profiles. The issue affects multiple specific versions of gpac. The vulnerability has a CVSS score of 5.5, indicating a medium severity impact primarily due to availability disruption.

A heap use-after-free vulnerability exists in the dasher_flush_segment function of gpac. This flaw can lead to a denial of service due to application crash. The issue affects multiple specific versions of gpac as listed. The vulnerability has a medium severity rating with a CVSS score of 5.5.

A heap use-after-free vulnerability exists in the gpac software within the gf_filter_pid_send_event_downstream function. This flaw can lead to a denial of service by causing application crashes. The vulnerability requires local access and user interaction to exploit and does not impact confidentiality or integrity.

CVE-2026-98869 is a high-severity vulnerability in the Linux kernel's BPF verifier related to incorrect zero extension logic for 32-bit operations on the s390 architecture. The flaw arises from changes in the verifier's register liveness analysis that can allow the upper half of a 64-bit register to contain arbitrary values, potentially leading to incorrect program behavior or privilege escalation. The issue has been resolved by revising the zero extension inference to be based on static register liveness analysis. Multiple specific Linux kernel versions are affected.

A segmentation violation vulnerability exists in the GetESD function within the /isomedia/track.c file of the gpac software. This flaw can cause an application crash or denial of service when the affected function is triggered. The vulnerability has a medium severity rating with a CVSS score of 5.5. Multiple specific versions of gpac are affected. No public exploit code or known exploitation in the wild has been reported. No patch or remediation information is currently available.

A stack overflow vulnerability exists in the gf_bifs_dec_node function of the gpac software. This flaw can cause a denial of service by crashing the application. The vulnerability has a medium severity rating with a CVSS score of 5.5. Multiple specific versions of gpac are affected. No public exploits or patches are currently documented.

A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.