FreeImage (danoli3 fork) versions before 3.19.22 have a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp. This flaw arises from missing bounds checks on ByteRun1 runs, allowing crafted IFF/LBM PBM files to write up to 127 bytes beyond the allocated heap buffer.
CVE-2026-118619 is a path traversal vulnerability in Ultralytics version 8.4.103 related to handling downloads from Google Drive. It allows remote attackers to execute arbitrary code by supplying a crafted path that is not properly validated before file operations. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability has a high severity with a CVSS score of 8.8.
A vulnerability in the Linux kernel's p54 wifi firmware parser allows reading beyond the bounds of firmware records due to insufficient validation of record lengths. This flaw can cause the parser to read past the intended data fields when processing malformed firmware records. The issue has been addressed by validating component ID and version record lengths and rejecting descriptor values that cause underflow or empty ranges before updating driver state.
CVE-2026-110879 is a critical deserialization vulnerability in FasterXML jackson-databind affecting versions from 2.10.0 up to but not including fixed releases 2.18.12, 2.21.8, 2.22.4, 3.1.8, and 3.2.4. The flaw allows attacker-controlled classes inside generic type arguments to bypass validation, enabling deserialization of malicious payloads. This can lead to arbitrary code execution, notably when combined with Spring on the classpath and attacker-controlled XML input.
Asterisk is an open source private branch exchange and telephony toolkit. From 21.0.0-pre1 until Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, the `chan_ooh323` `Q.931 party-number parser` lacks the `CVE-2022-37325` fix because that fix was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an `OOH323 request` can therefore crash Asterisk. This issue affects Asterisk versions greater than 20. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
CVE-2026-108303 is a high-severity vulnerability in Tanium Certificate Manager that allows unauthorized code execution due to improper neutralization of special elements in commands, commonly known as command injection. The flaw affects versions 1.17 up to but not including 1.17.417, 1.18 up to but not including 1.18.368, and 1.22 up to but not including 1.22.119. Tanium has released fixed versions to address this issue.
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured, and its `textsupport` option must be enabled; `textsupport` defaults to no. `The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions.` Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required `chan_sip` driver was removed there.
CVE-2026-82118 is a critical stack-based buffer overflow vulnerability affecting Hitachi HiRDB Server versions 9 and 10. The flaw exists in versions from 10-00 up to but not including 10-12-01, and in various 9.x versions up to 09-66-22. This vulnerability allows an attacker to execute arbitrary code or cause a denial of service due to memory corruption.
Libpff versions up to 20260926 contain a heap out-of-bounds read vulnerability in the function libpff_table_read_values_array. This occurs because the values_array_size of a 7c column definition is not properly checked against the remaining buffer bytes. An attacker can exploit this by supplying a crafted PST, OST, or PAB file, causing applications to read adjacent heap memory or crash.
libpff versions up to 20260926 contain an off-by-one bounds check vulnerability in the function libpff_table_read_6c_record_entries. This flaw allows attackers to trigger a heap out-of-bounds read by supplying crafted 6c table record entries in PST, OST, or PAB files. Applications using libpff, such as pffexport or pypff, may read adjacent heap memory or crash when processing malicious files.
libfvde versions through 20260923 contain a heap out-of-bounds read vulnerability in the function libfvde_encrypted_metadata_read_type_0x001a(). This flaw is caused by an unbounded strlen operation on embedded XML plist data. An attacker can exploit this by supplying a crafted FileVault 2 volume with non-NUL-terminated plist data, leading to a read beyond the allocated heap buffer during libfvde_volume_open() execution. The vulnerability has a low severity score and does not impact confidentiality or integrity but may affect availability.
libfvde versions up to 20260923 contain a heap out-of-bounds read vulnerability in the function libfvde_encrypted_metadata_read_type_0x0024(). This occurs because the size xml_plist_data_size is not validated against the source metadata block, allowing crafted FileVault 2 Core Storage volumes to cause out-of-bounds reads and crash the application.
A vulnerability in snappy-java prior to version 1.1.10.9 allows out-of-bounds memory access due to improper validation of array ranges passed to native memcpy. This can cause JVM crashes. The issue is fixed in version 1.1.10.9.
libosmocore versions through 1.14.1 contain an out-of-bounds read vulnerability in the iuup_rx_initialization() function located in src/gsm/iuup.c. This flaw allows a remote attacker to read memory beyond intended boundaries, potentially exposing sensitive information. The vulnerability affects multiple specific package versions of libosmocore. No CVSS score or public exploit code is available, and there is no indication of active exploitation in the wild.
libosmocore versions through 1.14.1 contain out-of-bounds read vulnerabilities in the GSM 04.80 supplementary-service component parsers located in src/gsm/gsm0480.c. This flaw allows a remote attacker to read memory beyond intended boundaries, potentially exposing sensitive information. The vulnerability affects multiple specific versions of libosmocore, including various builds from 0.9.0 through 1.11.0. There is no information provided about available patches or fixes.
A timing side-channel vulnerability in the pure-Erlang fallback implementation of X25519 in the jose library allows an attacker to recover a long-term private key by measuring decryption timing. The vulnerability arises because the scalar multiplication operation's execution time depends on the secret private key bits. This affects jose versions from 1.10.0 before 1.11.13. Exploitation compromises confidentiality and authenticity of data protected by the key.
The jose library versions from 10-2 through 14-2build2 use a password hashing scheme with insufficient computational effort when exporting password-encrypted private keys. The key derivation uses PBKDF2-HMAC-SHA256 with only 2048 iterations and a 64-bit salt, both significantly weaker than current security recommendations. This weakness allows an attacker who obtains an exported encrypted private key to perform an offline password-cracking attack and potentially recover the private key.
Asterisk versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and certain Certified Asterisk versions contain a reflected cross-site scripting vulnerability in phone provisioning HTTP error pages. This flaw allows an unauthenticated attacker to potentially steal an authorized user's AMI session cookie and impersonate that user if the res_phoneprov module and related HTTP services are enabled. The HTTP server binds to 127.0.0.1 by default, limiting exposure. The vulnerability is fixed in the specified versions.