QloApps versions 1.6.0 through 1.7.0 have a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action. This flaw allows unauthenticated attackers to submit reviews for arbitrary orders by reusing a publicly exposed review_ajax_token and enumerating sequential order IDs. The vulnerability enables attackers to post fake ratings and reviews attributed to other customers without authentication.
Transmission versions 4.0.0 up to but not including 4.1.3 have a permissive CORS vulnerability in the handle_request() function of rpc-server.cc. This flaw exposes the X-Transmission-Session-Id anti-CSRF token to any web origin, allowing malicious web pages to read the token from the 409 handshake response and reuse it to perform unauthorized RPC calls. These calls can lead to actions such as executing script-torrent-done, changing the download directory, or deleting torrents and data.
ntop nDPI versions through 6.0 have an out-of-bounds read vulnerability in the dissect_softether_host_fqdn() function within softether.c. This flaw arises because the function compares host_name using the consumed byte count rather than the actual data length. An attacker can exploit this by sending crafted short UDP datagrams on already-classified SoftEther flows, causing the strncmp function to read beyond the packet payload buffer, potentially leading to a denial of service.
QloApps versions up to 1.7.0 have an information disclosure vulnerability in the OrderConfirmationController::init() function. This flaw allows unauthenticated attackers to enumerate guest order references and associated emails by supplying sequential guest id_cart values. Attackers can read the Location redirect header to access booking details via guest tracking and potentially convert guest accounts into full user accounts with attacker-chosen passwords.
Kener versions from 3.0.0 up to but not including 4.1.10 have an authentication bypass vulnerability. This flaw allows unauthenticated attackers to forge session tokens by exploiting a hardcoded fallback key (DUMMY_SECRET) used when the KENER_SECRET_KEY is unset or empty. Attackers who know an administrator's email can sign a user cookie to gain full administrative access to the management API or forge password-reset tokens.
A cross-site scripting (XSS) vulnerability exists in Argilla up to version 2.8.0 within the Dataset.from_disk function of the Settings Page component. This flaw allows remote attackers to manipulate the Name argument, potentially leading to XSS attacks. The vulnerability has a low CVSS score of 3.5 and requires user interaction with low privileges. The project has been informed but has not yet responded or issued a fix. Exploit code is publicly available.
A heap out-of-bounds read vulnerability exists in libfvde through version 20260923. The flaw occurs in the function libfvde_encrypted_metadata_read_type_0x001a() due to an unbounded strlen operation on embedded XML plist data that is not properly NUL-terminated. An attacker can craft a malicious FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read beyond the allocated heap buffer. This vulnerability has a low severity score and does not impact confidentiality or integrity but can cause availability issues.
HTSlib versions through 1.24 have a heap out-of-bounds read and write vulnerability in the function bgzf_index_load_hfile() located in bgzf.c. This flaw allows an attacker to corrupt heap memory by providing a specially crafted .gzi index entry count. Specifically, a count value of 0xFFFFFFFF causes truncation of an internal variable to zero, leading to writes beyond a zero-sized malloc buffer and an out-of-bounds read in bgzf_useek(). This can result in heap corruption or crashes in dependent tools such as samtools and bcftools.
Speex (libspeex) versions through 1.2.1 have an out-of-bounds write vulnerability in the speex_bits_read_whole_bytes() function. This flaw occurs due to improper handling of length truncation for non-owned SpeexBits buffers, allowing attackers to stream crafted data that can corrupt heap or stack memory and cause application crashes.
A double free vulnerability exists in libyal libmsiecf through version 20260525 in the function libmsiecf_url_values_read_data(). This flaw allows attackers to corrupt heap memory by supplying a crafted MSIE cache index.dat file with an oversized unknown_offset in a partial URL record. The vulnerability can cause forensic tools processing such files to crash.
A medium-severity information disclosure vulnerability exists in TOTOLINK A950RG version 4.1.2cu.5268_B20221104. The flaw is in the getLanguageCfg function of the global.so file and can be exploited remotely without authentication. Public exploit code is available for this vulnerability.
VMime versions through 0.9.2 have an information disclosure vulnerability in the uuEncoder::decode function. This flaw causes uninitialized stack memory to be written into decoded output when processing over-long lines in uuencode or x-uuencode MIME parts. An attacker can exploit this by sending crafted MIME parts with large line length bytes, potentially leaking up to 15 bytes of stack memory per line in decoded attachments.
libcss versions through 0.9.2 have a NULL pointer dereference vulnerability in the mq_parse_media_query() function. This flaw allows remote attackers to cause a denial of service by supplying media lists that end with a trailing comma, which can crash parsers like NetSurf when processing @media or @import rules in stylesheets.
A heap out-of-bounds read vulnerability exists in libphdi through version 20260902 in the function libphdi_data_files_get_extent_data_file_path. The flaw arises because the function uses the directory prefix length instead of the basename length when processing Parallels disk image descriptors. An attacker can craft a descriptor with a long directory prefix and short basename to cause a process crash or potentially expose adjacent heap memory.
Furnace versions up to 0.6.8.3 have an out-of-bounds write vulnerability in the DivEngine::loadFTM() function. This flaw allows attackers to corrupt heap memory by using an unchecked subsong index in the GROOVES block of a crafted FamiTracker module. Specifically, a subsong count of 2 or more can cause a groove pattern to be written past the subsong vector, leading to a crash when Furnace opens the module.
libpff versions through 20260926 have an off-by-one bounds check vulnerability in the function libpff_table_read_6c_record_entries. This flaw allows attackers to trigger a heap out-of-bounds read by supplying crafted 6c table record entries in PST, OST, or PAB files. Exploitation can lead to reading adjacent heap memory or application crashes in tools like pffexport or pypff.
VMime versions through 0.9.2 have an integer underflow vulnerability in the uuEncoder::decode function. This flaw allows remote attackers to craft uuencoded MIME parts in emails that trigger a stack-based buffer overflow. Specifically, sending a uuencoded line with a length character 'b' that is not a 'begin' line can corrupt stack memory, potentially crashing the application or enabling code execution.
Libpff through 20260926 has a heap out-of-bounds read vulnerability in the function libpff_table_read_values_array. This occurs because the values_array_size of a 7c column definition is not validated against the remaining buffer bytes. An attacker can exploit this by supplying a crafted PST, OST, or PAB file, potentially causing applications to read adjacent heap memory or crash.
flatcc versions up to 0.6.4 have an out-of-bounds read vulnerability in the __flatcc_json_parser_number function. This flaw allows attackers to read beyond the input buffer when parsing JSON numbers that end with a decimal point. Supplying crafted JSON input ending immediately after a decimal point can cause the parser to access unmapped memory, leading to application crashes.
libdwarf versions through 2.3.3 have a heap out-of-bounds read vulnerability in the dwarf_debug_addr_table() function. This flaw occurs because the function omits the table starting offset when validating the .debug_addr unit length. An attacker can exploit this by supplying a crafted object file with a non-zero offset table, causing dwarf_debug_addr_by_index() to read beyond the allocated heap buffer. This can lead to disclosure of adjacent heap memory or cause a crash in the consuming application.