CVE-2026-113352 - uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers
CVE ID :CVE-2026-113352
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113352
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113353 - LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers
CVE ID :CVE-2026-113353
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113353
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113354 - Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content
CVE ID :CVE-2026-113354
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113354
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113355 - Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
CVE ID :CVE-2026-113355
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
Severity: 4.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113355
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.
Severity: 4.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113356 - DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
CVE ID :CVE-2026-113356
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113356
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113357 - @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
CVE ID :CVE-2026-113357
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113357
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113358 - LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
CVE ID :CVE-2026-113358
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113358
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113382 - arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload
CVE ID :CVE-2026-113382
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue. The name of the patch is 04573681420295f7b327c9da3b101aed2f3cf432. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113382
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue. The name of the patch is 04573681420295f7b327c9da3b101aed2f3cf432. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113383 - Optimal IdM OptimalCloud Login cross site scripting
CVE ID :CVE-2026-113383
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113383
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113384 - Optimal IdM OptimalCloud social redirect
CVE ID :CVE-2026-113384
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113384
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-9589 - Unblu Spark Authorization Bypass in Configuration Cascade Operations
CVE ID :CVE-2026-9589
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities. The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope. Exploitation requires an authenticated session but no user interaction.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-9589
Published : Oct. 20, 2026, 11:17 a.m. | 22 minutes ago
Description :Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities. The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope. Exploitation requires an authenticated session but no user interaction.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-112941 - filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
CVE ID :CVE-2026-112941
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the first acquisition to redirect lock-record writes into directories writable by the lock user. This issue is fixed in version 4.2.1.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-112941
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the first acquisition to redirect lock-record writes into directories writable by the lock user. This issue is fixed in version 4.2.1.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-112942 - launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
CVE ID :CVE-2026-112942
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-112942
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-112943 - launch-editor: escapeCmdArgs() omits % escaping on Windows
CVE ID :CVE-2026-112943
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-112943
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-112944 - launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
CVE ID :CVE-2026-112944
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-112944
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113397 - DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection
CVE ID :CVE-2026-113397
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Severity: 7.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113397
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Severity: 7.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113411 - Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme
CVE ID :CVE-2026-113411
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113411
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authorization in handler for custom url scheme. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 2.3.3 can resolve this issue. The patch is identified as f4df21bbc290f6c1956d899cf4da9e963074a6e4. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113466 - MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
CVE ID :CVE-2026-113466
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113466
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-95109 - Cortex-A7 module data validation checks only the first address of a caller-supplied range
CVE ID :CVE-2026-95109
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start. A memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range. Because every protected-module dispatcher that consumes a buffer or an extra-parameter array goes through this one macro, the defect is not in any individual service: it is in the primitive all of them rely on.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-95109
Published : Oct. 20, 2026, 3:17 p.m. | 27 minutes ago
Description :The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating **one address** — the first byte. The common Module Manager hands its range check the module instance, the start address and the complete byte size; the Cortex-A7 implementation discarded the instance and the size and asked the MMU a single question about the start. A memory-protected module therefore passed any range whose first byte was user-readable, however far the rest of it reached. Privileged dispatch code then read or wrote the whole range. Because every protected-module dispatcher that consumes a buffer or an extra-parameter array goes through this one macro, the defect is not in any individual service: it is in the primitive all of them rely on.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-91059 - JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size
CVE ID :CVE-2026-91059
Published : Oct. 20, 2026, 3:17 p.m. | 26 minutes ago
Description :The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it. Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path. Reproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-91059
Published : Oct. 20, 2026, 3:17 p.m. | 26 minutes ago
Description :The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it. Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path. Reproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-91186 - PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
CVE ID :CVE-2026-91186
Published : Oct. 20, 2026, 3:17 p.m. | 26 minutes ago
Description :The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth *after* the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it. The buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.
Severity: 8.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-91186
Published : Oct. 20, 2026, 3:17 p.m. | 26 minutes ago
Description :The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth *after* the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it. The buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.
Severity: 8.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...