🚨 CVE-2026-86141
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
🎖@cveNotify
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
🎖@cveNotify
GitHub
xmlregexp: Calc string length after null checking · GNOME/libxml2@e89a8aa
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107
🚨 CVE-2026-86142
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
🎖@cveNotify
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
🎖@cveNotify
GitHub
xpointer: Check overflow in xmlXPtrEvalXPtrPart · GNOME/libxml2@6b3a736
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113
🚨 CVE-2026-86143
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
🎖@cveNotify
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
🎖@cveNotify
GitHub
xmlIO: Check for int overflow before calling writecallback · GNOME/libxml2@90f293b
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111
🚨 CVE-2026-86144
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
🎖@cveNotify
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
🎖@cveNotify
GitHub
fix(xinclude): propagate parseFlags in xmlXIncludeProcess and xmlXInc… · GNOME/libxml2@b63cd51
…ludeProcessTree
🚨 CVE-2026-48707
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
🎖@cveNotify
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
🎖@cveNotify
GitHub
Fix SSRF redirect/DNS rebinding · instantsoft/icms2@04b8fe0
Self-hosted Site Management System. Contribute to instantsoft/icms2 development by creating an account on GitHub.
🚨 CVE-2026-54611
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.
🎖@cveNotify
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.
🎖@cveNotify
GitHub
Установка дополнений через временную директорию; отсутствует возможно… · instantsoft/icms2@44f3a9d
…сть доступа к распакованным файлам по URL; защита от Zip Slip; проверка и запрет символических ссылок (symlink) в ZIP-архивах; защита от Zip Bomb (лимит количества файлов, размера архива и размера...
🚨 CVE-2026-57098
Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-57099
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-62762
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
🎖@cveNotify
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-67376
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-67383
Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-67386
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-67389
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-67629
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-67630
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-67641
Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.
🎖@cveNotify
Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-67648
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-68777
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-68778
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-68779
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-68780
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify