Search: Value

Tinyexr versions up to 3.2.0 have a heap out-of-bounds read vulnerability in the function ParseEXRMultipartHeaderFromMemory(). This flaw allows attackers to craft multi-part EXR files that bypass bounds checks, potentially causing application crashes or leaking adjacent heap memory. The vulnerability arises from a stale remaining-size value leading to reading beyond buffer limits.

CVE-2026-110258 is a vulnerability in OW2 ASM versions 3.0 up to but not including 9.11. It involves excessive memory allocation in the method Label.addSubroutineRetSuccessors() due to improper enforcement of the single-RET-per-JSR rule. An attacker can craft an invalid class file with multiple RET instructions for one JSR, causing the JVM to allocate approximately 2 GB of memory and crash.

CVE-2026-110257 is a vulnerability in OW2 ASM versions 5.0 up to but not including 9.11. It involves excessive memory allocation in the ClassReader.readBootstrapMethodsAttribute() method, where an int array is sized based on an unvalidated attribute_length. A crafted class file of about 100 bytes can trigger allocation of roughly 2 GB of memory, causing an OutOfMemoryError that crashes the JVM or consumes the thread.

A vulnerability in the Linux kernel's drm/virtio component was fixed to address a NULL versus ERR_PTR() return value bug in the function virtio_gpu_user_framebuffer_create(). The issue could lead to a NULL pointer dereference in drm_mode_addfb2().

CVE-2026-98395 is a vulnerability in the Linux kernel's powerpc architecture interrupt handling code. It involves corruption of the irq_soft_mask value during replayed interrupt exits, which causes a warning and incorrect interrupt masking state. The issue occurs because local_irq_disable() overwrites irq_soft_mask incorrectly, stripping the IRQS_PMI_DISABLED bit. The flaw is fixed by replacing local_irq_disable() with hard_irq_disable(), which preserves the correct mask bits and is appropriate for both PPC64 and PPC32 architectures.

CVE-2026-100229 is an out-of-bounds write vulnerability in the GStreamer H.266 codec parser library (libgstcodecparsers) on Red Hat Enterprise Linux 10. The flaw occurs in the DCI parsing function, where a reserved field value is improperly accepted, leading to memory corruption. Exploitation requires a specially crafted H.266 bitstream provided to a third-party application using this library API. No standard GStreamer pipeline element currently triggers the vulnerable code path. The vulnerability has a medium severity with a CVSS score of 6.5.

CVE-2026-92409 is a cross-site scripting (XSS) vulnerability in the Donation Thermometer WordPress plugin versions 2.2.9 up to but not including 2.3.0. The flaw arises because the plugin does not properly escape a colour value taken from a shortcode attribute before inserting it into the legend markup. This allows users with Contributor role or higher to inject arbitrary event handlers that execute when the page is viewed.

CVE-2026-86797 is a cross-site scripting (XSS) vulnerability in the Pricing Table WordPress plugin before version 2.1.5. It occurs because the plugin does not validate the scheme of a user-supplied link value in one of its blocks before rendering. This allows users with contributor-level access or higher to store malicious scripts that execute when other users view or interact with the affected content.

Curl versions prior to fixed releases improperly handle HSTS max-age values that exceed calendar time structure bounds on 64-bit systems. This causes serialization failures during cache saves, leading to truncation and deletion of the HSTS cache file, resulting in data loss. The error is silently ignored, and curl exits successfully despite the cache corruption.

A vulnerability in curl allows a remote HTTP server to cause the client to write an excessively long cookie record to a Netscape cookie jar. This malformed cookie line exceeds curl's line-length parsing limit, causing subsequent curl invocations that read the same cookie jar with --cookie to silently abort parsing prematurely and ignore all valid cookies following the long line. This can lead to denial of service by disrupting cookie handling.

CVE-2026-50216 is an integer underflow vulnerability in the DNS proxy component of the macOS NetworkExtension system extension used by Akamai Guardicore Platform Agent (GPA). When a UDP datagram shorter than 96 bytes with a specific initial value is processed, a size calculation underflows, leading to an allocation failure and an uncaught Objective-C exception that aborts the root system extension. This results in a denial of service condition. The vulnerability affects GPA versions from 0 up to but not including 7.4. A patch is available to address this issue.

Memory allocation with excessive size value in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

QloApps versions up to 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the back-office Additional Facilities form. This flaw allows remote attackers to inject malicious scripts via the price parameter. When an authenticated back-office user submits a crafted request with an unescaped price value that fails validation, the injected JavaScript executes in their administrative session.

Mistral Vibe versions before 2.25.4 have a command permission gate bypass vulnerability that enables attackers to execute arbitrary commands. This occurs by embedding a command substitution inside a single-quoted variable value, which the tree-sitter-bash static parser fails to detect. The vulnerability leverages bash's promptvars feature to execute hidden commands at runtime, resulting in silent arbitrary command execution with the privileges of the agent's terminal session.

A code injection vulnerability exists in dataclasses-avroschema versions 0.38.0 through 0.70.5. The vulnerability arises because the BaseGenerator.parse_fixed method interpolates a fixed type's aliases value directly into generated Python code without proper sanitization. If the aliases value is a bare string, it is emitted as an unquoted Python expression and evaluated when the generated module is imported, enabling arbitrary code execution. This issue is fixed in version 0.70.6 by rejecting aliases values that are not lists.

A code injection vulnerability (CWE-94) exists in dataclasses-avroschema versions 0.44.0 through 0.70.5. The vulnerability arises because the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value into generated Python code annotations without proper restriction, allowing arbitrary Python code execution when the generated module is imported. This issue is fixed in version 0.70.6 by restricting the inserted value to a bare name or a call to a bare name with literal arguments.

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.

A code injection vulnerability exists in dataclasses-avroschema versions 0.38.0 through 0.70.5. The issue arises from improper handling of the fixed type's namespace value in generated Python code, allowing an attacker to inject arbitrary code. This is fixed in version 0.70.6 by enforcing namespace validation.

CVE-2026-88833 is an integer underflow vulnerability in the BusyBox udhcpc DHCP client used in Red Hat Hardened Images. The flaw occurs when the client processes raw DHCP packets and replaces the validated packet length with an attacker-controlled value from the IP header without re-validation. This leads to an integer underflow during header size subtraction, causing a memory copy operation with an excessively large length. An attacker on the same network segment can exploit this to crash the DHCP client, resulting in denial of service and loss of network connectivity.