Archive
26 October 2026
Vulnerabilities first published on this day (UTC), newest first.
407 results · Clear filters · Feed
-
Medium 6.1
libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries
libpff through 20260926 contains an off-by-one bounds check in libpff_table_read_6c_record_entries that allows attackers to trigger a heap out-of-bounds read via crafted 6c table record entries. Attackers can supply crafted PST, OST or PAB files to applicatio…
-
Medium 4.4
libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table
libdwarf through 2.3.3 contains a heap out-of-bounds read vulnerability in dwarf_debug_addr_table() that omits the table starting offset when validating .debug_addr unit length. Attackers can supply a crafted object file with a non-zero offset table, causing …
-
Medium 5.5
Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm or 0CC/E-FamiTracker …
-
Medium 6.1
Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that allows attackers to corrupt heap memory via an unchecked subsong index in the GROOVES block. Attackers can craft a FamiTracker module with a subsong count of 2 …
-
Medium 5.5
libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x0024
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block. Attackers can supply a crafted FileVault 2 Core Storage vo…
-
Medium 5.5
gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index
gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious…
-
Medium 5.9
snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without v…
-
Medium 4.3
itsourcecode Airline Reservation System book_flight.php cross site scripting
A weakness has been identified in itsourcecode Airline Reservation System 1.0. This affects an unknown part of the file /book_flight.php. Executing a manipulation of the argument max can lead to cross site scripting. The attack can be executed remotely. The e…
-
Medium 5.3
TOTOLINK A950RG global.so getLanguageCfg information disclosure
A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched …
-
Medium 6.9
Go JOSE: Panics in JSON parsing
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controll…
-
Medium 6.9
Go JOSE: Panic during CBC-HMAC processing
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE …
-
Medium 5.3
Seroval: Code injection through a typed array's own constructor property
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replace…
-
Medium 4.7
Seroval: Script injection through RegExp sources in serialized output
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without th…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, m…
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An ap…
-
Medium 5.5
A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequ…
-
Medium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 an…
-
Medium 5.5
An authorization issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, mac…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, …
-
Medium 6.5
An information leakage was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS S…
-
Medium 6.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2…
-
Medium 5.5
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may b…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, mac…
-
Medium 5.5
An authorization issue was addressed with improved entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2.…
-
Medium 5.3
A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8…
-
Medium 4.7
A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Golden Gate 27.2,…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 an…
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macO…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and i…
-
Medium 4.4
An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7…
-
Medium 5.5
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Golden Gate 27, macOS Sequo…
-
Medium 5.5
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27, macOS Seq…
-
Medium 5.1
An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11,…
-
Medium 4.4
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequ…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2. An app m…
-
Medium 5.5
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …
-
Medium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 an…
-
Medium 5.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS …
-
Medium 5.5
A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequ…