Search: 16.5-2

smpeg versions through 2.0.0 contain a heap out-of-bounds read vulnerability that can cause a denial of service by crashing the affected application. The vulnerability has a medium severity with a CVSS score of 5.5 and requires local access with user interaction to exploit.

Schism Tracker versions up to 20260524 contain a heap out-of-bounds write vulnerability. This flaw can lead to a denial of service due to application crash but does not impact confidentiality. The vulnerability requires local access and user interaction to exploit. It has a medium severity rating with a CVSS score of 6.1.

LobsterAI versions before 2026.10.16 contain a vulnerability due to a hardcoded cryptographic key. This flaw allows attackers who obtain an exported provider file to decrypt third-party AI provider API keys by deriving the AES-GCM key using PBKDF2 with an embedded salt. The vulnerability is fixed in version 2026.10.16.

Admidio versions from 5.0.11 up to but not including 5.0.16 contain a broken access control vulnerability in the inventory module. This flaw allows any authenticated user to bypass the inventory_module_enabled restriction and access the DataTables JSON feed, exposing all inventory items and keeper names even when the module is disabled.

Admidio versions prior to 5.0.16 have an information disclosure vulnerability due to missing authorization checks in the rss/links.php component. This flaw allows unauthenticated attackers to access role-restricted weblinks by bypassing the category_view role-visibility filter. Exploiting this issue, attackers can retrieve sensitive information such as link names, URLs, descriptions, categories, and creator names from restricted link categories via the RSS feed.

Admidio versions from 5.0.0 up to but not including 5.0.16 have an authorization bypass vulnerability. Authenticated users with list view rights can export member lists as PDF files despite export restrictions by exploiting a missing check for the 'pdfl' mode in the export functionality. This issue is fixed in version 5.0.16.

Admidio versions from 5.0.0 up to but not including 5.0.16 contain an authorization bypass vulnerability in the ForumService::saveTopic() function. Authenticated users can manipulate the topic_uuid parameter in their topic save requests to modify forum topics belonging to other users. This allows overwriting the title and first post of victim topics without proper authorization.

FreeRDP versions from 2.0.0 up to but not including 3.32.0 contain a heap out-of-bounds write vulnerability in the server hash-callback NTLM path. This flaw occurs due to improper validation of the MIC offset in an AUTHENTICATE_MESSAGE, allowing unauthenticated attackers to write 16 zero bytes beyond allocated memory. The issue is fixed in version 3.32.0.

Coder versions 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 have an open redirect vulnerability in the login page. This occurs because the redirect query parameter is not properly sanitized, allowing attackers to craft login URLs that redirect logged-in users to attacker-controlled sites, potentially facilitating phishing attacks. The issue is fixed in versions 2.14.4, 2.15.3, and 2.16.1.

A heap-based buffer overflow vulnerability exists in parted when processing specially crafted FAT32 filesystem images due to an integer calculation error during buffer allocation. A local attacker could exploit this by tricking a user or automated service into opening a malicious filesystem image, potentially causing an application crash (Denial of Service) or memory corruption.

A critical vulnerability exists in Text::CSV_XS versions before 1.65 for Perl, where the module returns a 0xFF byte under certain conditions. This flaw affects multiple specific versions of the libtext-csv-xs-perl package. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

A high-severity vulnerability (CVE-2026-110758) affects multiple specific versions of the libtext-csv-xs-perl library (Text::CSV_XS module for Perl) prior to version 1.65. The vulnerability involves reading before the start of an input, which may lead to a high impact on confidentiality. This flaw does not affect integrity or availability and requires no privileges or user interaction to exploit. The affected versions are explicitly listed, and the vulnerability has a CVSS score of 7.5.

Text::CSV_XS versions before 1.65 for Perl contain a critical vulnerability allowing record splitting by unspecified means. This vulnerability has a CVSS score of 9.8, indicating a severe impact on confidentiality, integrity, and availability. Multiple older versions of the libtext-csv-xs-perl package are affected. No patch or remediation details are provided in the input data.

A critical vulnerability (CVE-2026-110756) affects Text::CSV_XS versions before 1.65 for Perl, causing the end of a CSV record to be dropped. This flaw impacts multiple versions of the libtext-csv-xs-perl package. The vulnerability has a high CVSS score of 9.8, indicating severe confidentiality, integrity, and availability impacts.

Text::CSV_XS versions before 1.65 for Perl contain a vulnerability that allows quadratic CPU usage, potentially leading to denial of service conditions. This vulnerability affects multiple specific versions of the libtext-csv-xs-perl package. The issue is classified as high severity with a CVSS score of 7.5, indicating a significant impact on availability without affecting confidentiality or integrity.

A vulnerability in Text::CSV_XS Perl module versions before 1.65 causes leakage of parsed fields data. This issue affects multiple specific versions of the libtext-csv-xs-perl package. The vulnerability has a medium severity rating with a CVSS score of 6.5, indicating a moderate impact primarily affecting availability. No public exploits or patches are currently documented.