Archive
9 November 2026
Vulnerabilities first published on this day (UTC), newest first.
50 results · Clear filters · Feed
-
Low 3.1
Movim through 0.35.5 Authorization Bypass via Post::ajaxGetPost Cached Post Read
Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or…
-
Low 3.1
Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint
Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many ge…
-
Low 2.3
djust: A template binding inherits a context safety grant it never earned (XSS)
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replac…
-
Low 3.7
Out-of-bounds read in Zephyr HTTP client debug logging of response header fields
The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser data-callback slice with a %s conversion: snprintk(output, len + 1, "%s", str). The parser hands its callbacks a pointer and a length into the ca…
-
Low 3.7
Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore p…
-
Low 3.7
Wagtail: Identification of documents by SHA1 hash
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, Wagtail applies ETag conditional request processing to the document serve endpoint before document permission and filename checks complete. An unaut…
-
Low 3.7
Dynatrace MCP Server: create_dynatrace_notebook missing the human-approval gate
Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write …
-
Low 3.3
nushell Data Conversion ser.rs escape_bytes control sequence
A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escape_bytes of the file crates/nu-json/src/ser.rs of the component Data Conversion Handler. The manipulation leads to improper neutralization of escape, meta, or control sequen…
-
Low 3.5
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.7.12 and iPad…
-
Low 3.7
iomad Password Field company_user.php store_temporary_password information disclosure
A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipula…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwt_tmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeigh…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23
FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline …
-
Low 3.3
FFmpeg through 9.0.2 Integer Overflow via dng_decode_tiles() in libavcodec/tiff.c
FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng_decode_tiles() that allows attackers to leak uninitialized memory via crafted DNG tile dimensions. Attackers can set TileWidth or TileLength near INT_MAX so the tile loop never runs, outpu…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in ff_jpegls_decode_picture() in libavcodec/jpeglsdec.c, which decodes 16-bit line-interleaved JPEG-LS scans as 8-bit samples. Attackers can supply a crafted single-component JPEG-…
-
Low 3.3
FFmpeg through 9.0.2 VVC Decoder Memory Leak via alloc_frame()
FFmpeg through 9.0.2 contains a memory leak vulnerability in alloc_frame() in libavcodec/vvc/refs.c that leaks SPS and PPS references when frame buffer allocation fails. Attackers can supply a crafted VVC (H.266) stream that repeatedly replaces parameter sets…
-
Low 3.3
FFmpeg through 9.0.2 RoQ DPCM Encoder Uninitialized Heap Memory Disclosure
FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq_dpcm_encode_frame() in libavcodec/roqaudioenc.c that encodes stale heap contents when flushed early. Attackers can supply short audio streams under eight frames for RoQ DPCM transc…
-
Low 2.5
FFmpeg through 9.0.2 Out-of-Bounds Read via prores_ks Interlaced Alpha Encoding
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the prores_ks encoder's get_alpha_data() that reads before the blocks buffer for interlaced frames with odd heights. Attackers can supply video with alpha and odd height encoded to interlace…
-
Low 2.5
FFmpeg through 9.0.2 Memory Leak via MediaCodec JNI setBuffer
FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking nat…
-
Low 2.5
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via ADPCM_MS Trellis Encoding
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in adpcm_encode_frame() in libavcodec/adpcmenc.c that leaks heap bytes when encoding mono ADPCM_MS audio with trellis enabled. Attackers submitting audio to a service using this en…
-
Low 3.3
FFmpeg through 9.0.2 Heap Memory Disclosure via DXA Decoder Uninitialized Buffer
FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that allows attackers to disclose heap memory via crafted DXA files. Attackers can supply a DXA video with a type 4 frame that copies the uninitialized …
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via MVC2 Decoder
FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referenc…
-
Low 2.5
FFmpeg through 9.0.2 ProRes prores_aw Heap Out-of-Bounds Read in Interlaced Encoding
FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in libavcodec/proresenc_anatoliy.c that occurs when the prores_aw encoder processes interlaced, odd-height frames. Attackers can supply odd-height video that causes subimage_with_fill_templ…
-
Low 3.3
FFmpeg 6.1 through 9.0.2 Information Disclosure via CamStudio Decoder cscd.c
FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerability in the CamStudio decoder (libavcodec/cscd.c) that copies uninitialized heap memory into decoded frames when decompressed payloads are short. Attackers can supply a crafted AVI with a CS…
-
Low 3.3
FFmpeg through 9.0.2 Out-of-Bounds Read via Cook Decoder js_subband_start
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes rea…
-
Low 3.3
FFmpeg through 9.0.2 Heap Memory Disclosure via VQA Video Decoder
FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in the VQA video decoder in libavcodec/vqavideo.c that allows attackers to disclose heap memory via a crafted VQA file. Attackers can supply a Westwood VQA file omitting or truncating the CBF…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via MSCC/SRGC Decoder
FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outputs uninitialized heap bytes when RLE data ends early. Attackers can craft an MSCC or SRGC stream, such as in AVI, whose RLE data term…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Memory Read in Flash Screen Video 2 Decoder
FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decode_hybrid() in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated d…
-
Low 3.3
FFmpeg through 9.0.2 Information Disclosure via Flash Screen Video Decoder
FFmpeg through 9.0.2 contains an information disclosure vulnerability in flashsv_decode_block() in libavcodec/flashsv.c that copies uninitialized heap memory into decoded frames when inflate output is short. Attackers can supply a crafted FLV with an FSV1 str…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via targa_decode_rle()
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targa_decode_rle() in libavcodec/targa.c caused by missing packet length checks. Attackers can supply truncated RLE-compressed TGA images so decoded frames contain leftover heap…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder
FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff_mlz_decompression() in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or ou…
-
Low 3.3
FFmpeg through 9.0.2 VMnc Decoder Uninitialized Heap Memory Disclosure
FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor…
-
Low 3.3
FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in tak_decode_frame() in libavcodec/takdec.c that fails to verify multichannel decorrelation lists cover every channel. Attackers can supply crafted multichannel TAK files omitting…
-
Low 3.3
FFmpeg through 9.0.2 Integer Overflow in OpenEXR Decoder Tile Count
FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode_frame() in libavcodec/exr.c that miscalculates the tiled block count. Attackers can supply a crafted tiled OpenEXR image with large dimensions and small tiles to s…
-
Low 3.3
FFmpeg through 9.0.2 WebP Decoder Information Disclosure via Short ALPH Chunk
FFmpeg through 9.0.2 contains an information disclosure vulnerability in vp8_lossy_decode_alpha() in libavcodec/webp.c that leaves alpha plane memory uninitialized for short uncompressed ALPH chunks. Attackers can supply a crafted WebP image whose ALPH chunk …
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via GEM Raster Decoder
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the GEM raster image decoder in libavcodec/gemdec.c that exposes uninitialized row-buffer bytes. Attackers can supply a crafted GEM .img image using SKIP or pattern opcodes to c…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via rawdec.c Raw Video Decoder
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with…
-
Low 3.3
FFmpeg through 9.0.2 C93 Decoder Uninitialized Stack Memory Disclosure
FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in the C93 video decoder in libavcodec/c93.c, where decode_frame() never checks how many color table bytes were copied. Attackers can supply a crafted truncated Interplay C93 file so draw…
-
Low 3.3
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via Tiertex SEQ Decoder
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attackers to leak stack contents by triggering failed RLE unpacking. Attackers can supply a crafted Tiertex SEQ file so seq_decode_op1() cop…
-
Low 2.3
compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolve…
-
Low 2.3
compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. The same issue affec…