🚨 CVE-2026-111145
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory.
🎖@cveNotify
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory.
🎖@cveNotify
GitHub
GitHub - Yeraze/ytnef: Yeraze's TNEF Stream Reader - for winmail.dat files
Yeraze's TNEF Stream Reader - for winmail.dat files - Yeraze/ytnef
🚨 CVE-2026-111150
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBlk to over-read heap memory and crash consumers.
🎖@cveNotify
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBlk to over-read heap memory and crash consumers.
🎖@cveNotify
GitHub
GitHub - ValleyBell/libvgm: A more modular rewrite of most components from VGMPlay. will include sub-libraries for audio output…
A more modular rewrite of most components from VGMPlay. will include sub-libraries for audio output, sound emulation and VGM playback - ValleyBell/libvgm
🚨 CVE-2026-111155
libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through mid_set_soundfont() to read heap memory out of bounds and crash the application.
🎖@cveNotify
libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through mid_set_soundfont() to read heap memory out of bounds and crash the application.
🎖@cveNotify
GitHub
GitHub - sezero/libtimidity: libtimidity: MIDI to WAVE converter library. (mirror of git repo at https://sf.net/projects/libtimidity/)
libtimidity: MIDI to WAVE converter library. (mirror of git repo at https://sf.net/projects/libtimidity/) - sezero/libtimidity
🚨 CVE-2026-111160
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.
🎖@cveNotify
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.
🎖@cveNotify
GitHub
GitHub - ModelTC/LightLLM: LightLLM is a Python-based LLM (Large Language Model) inference and serving framework, notable for its…
LightLLM is a Python-based LLM (Large Language Model) inference and serving framework, notable for its lightweight design, easy scalability, and high-speed performance. - ModelTC/LightLLM
🚨 CVE-2026-111165
libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and crashing the loading application.
🎖@cveNotify
libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and crashing the loading application.
🎖@cveNotify
GitHub
GitHub - sezero/mikmod: Mikmod Sound System (mirror of git repo at https://sf.net/projects/mikmod/)
Mikmod Sound System (mirror of git repo at https://sf.net/projects/mikmod/) - sezero/mikmod
🚨 CVE-2026-111170
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.
🎖@cveNotify
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.
🎖@cveNotify
GitHub
GitHub - kedro-org/kedro-plugins: First-party plugins maintained by the Kedro team.
First-party plugins maintained by the Kedro team. Contribute to kedro-org/kedro-plugins development by creating an account on GitHub.
🚨 CVE-2026-111270
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.
🎖@cveNotify
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.
🎖@cveNotify
GitHub
GitHub - Konstanty/libmodplug: libmodplug GitHub repository
libmodplug GitHub repository. Contribute to Konstanty/libmodplug development by creating an account on GitHub.
🚨 CVE-2026-111275
nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.
🎖@cveNotify
nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.
🎖@cveNotify
GitHub
GitHub - NIFTI-Imaging/nifti_clib: C libraries for NIFTI support
C libraries for NIFTI support. Contribute to NIFTI-Imaging/nifti_clib development by creating an account on GitHub.
🚨 CVE-2026-111281
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.
🎖@cveNotify
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.
🎖@cveNotify
Rahul R
From Temu to Root: Breaking the Jooan C9TS
How a cheap IP camera and some 'procrastination' led to a full Remote Code Execution vulnerability.
🚨 CVE-2026-111313
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.
🎖@cveNotify
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.
🎖@cveNotify
GitHub
GitHub - DaKheera47/job-ops: job-ops: DevOps principles applied to job hunting. A self-hosted pipeline to track, analyze, and assist…
job-ops: DevOps principles applied to job hunting. A self-hosted pipeline to track, analyze, and assist your application process - DaKheera47/job-ops
🚨 CVE-2026-111324
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.
🎖@cveNotify
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.
🎖@cveNotify
GitHub
GitHub - lejianwen/rustdesk-api: Custom Rustdesk Api Server, include web admin ,web client, web client v2 preview and oidc login
Custom Rustdesk Api Server, include web admin ,web client, web client v2 preview and oidc login - lejianwen/rustdesk-api
🚨 CVE-2026-111343
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.
🎖@cveNotify
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.
🎖@cveNotify
GitHub
GitHub - pig-mesh/pig: ↥ ↥ ↥ Follow for updates An RBAC permission management system based on Spring Cloud 2025, Spring Boot 4…
↥ ↥ ↥ Follow for updates An RBAC permission management system based on Spring Cloud 2025, Spring Boot 4, and OAuth2. - pig-mesh/pig
🚨 CVE-2026-111348
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
🎖@cveNotify
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
🎖@cveNotify
GitHub
GitHub - likeadmin-likeshop/likeshop: 🔥🔥🔥 likeshop开源免费商用电商系统，PC商城、H5商城、小程序商城、安卓APP商城、苹果APP商城，免费商用。场景：B2C商城，新零售商城，社交电商商城，分销系统商城…
🔥🔥🔥 likeshop开源免费商用电商系统，PC商城、H5商城、小程序商城、安卓APP商城、苹果APP商城，免费商用。场景：B2C商城，新零售商城，社交电商商城，分销系统商城，分销电商商城，小程序商城，商城源码，商城系统，单商户，多商户，电商系统，直播，uniapp，uni-app，B2B2C，B2B，O2O，ERP，Wechat，交易系统，内容系统，雷达，crm - likeadmin-...
🚨 CVE-2026-111353
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.
🎖@cveNotify
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.
🎖@cveNotify
GitHub
peppermint/apps/api/src/controllers/storage.ts at 0.5.5 · Peppermint-Lab/peppermint
An open source issue management & help desk solution. A zendesk & jira alternative - Peppermint-Lab/peppermint
🚨 CVE-2026-111359
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
🎖@cveNotify
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
🎖@cveNotify
GitHub
GitHub - crmeb/CRMEB: 🔥CRMEB开源商城免费开源多语言商城系统，Tp6框架商城，系统可商用；包含小程序商城、H5商城、公众号商城、PC商城、App，支持分销、拼团、砍价、秒杀、优惠券、积分、会员等级、小程序直播、页面DIY，前后…
🔥CRMEB开源商城免费开源多语言商城系统，Tp6框架商城，系统可商用；包含小程序商城、H5商城、公众号商城、PC商城、App，支持分销、拼团、砍价、秒杀、优惠券、积分、会员等级、小程序直播、页面DIY，前后端分离，方便二开，更有详细使用文档、接口文档、数据字典、二开文档/视频教程，欢迎大家提出宝贵意见和建议 - crmeb/CRMEB
🚨 CVE-2026-111237
A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_metadata_map of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument imgsz/names/kpt_shape causes improper neutralization of directives in dynamically evaluated code. The attack requires local access. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
🎖@cveNotify
A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_metadata_map of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument imgsz/names/kpt_shape causes improper neutralization of directives in dynamically evaluated code. The attack requires local access. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
🎖@cveNotify
GitHub
[Security] Model load-time code execution: ONNX metadata strings evaluated with eval() in vendored ultralytics 8.0.120 · Issue…
Summary This repository vendors a copy of ultralytics (8.0.120) at ultralytics/nn/autobackend.py, and its model-loading code evaluates ONNX metadata strings with eval(): AutoBackend.__init__ reads ...
🚨 CVE-2026-111375
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client.
🎖@cveNotify
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client.
🎖@cveNotify
GitHub
Windows RAIL title is passed to SetWindowTextW without NUL termination
## Executive Summary
In FreeRDP's Windows RAIL client, a malicious RDP server can send a `WINDOW_ORDER_FIELD_TITLE` update whose UTF-16 title is full-length and contains no NUL. In a Windows...
In FreeRDP's Windows RAIL client, a malicious RDP server can send a `WINDOW_ORDER_FIELD_TITLE` update whose UTF-16 title is full-length and contains no NUL. In a Windows...
🚨 CVE-2026-95183
An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.
🎖@cveNotify
An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.
🎖@cveNotify
Deepseek
DeepSeek | 深度求索
深度求索（DeepSeek），探索未至之境。专注于研究世界领先的通用人工智能底层模型与技术，开源 DeepSeek-V4、DeepSeek-R1 等前沿大模型。和 DeepSeek AI 对话，轻松接入 API。
🚨 CVE-2026-26846
Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component
🎖@cveNotify
Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component
🎖@cveNotify
GitHub
VulnDisclos/HMI/weintek_rce/weintek_rce.md at main · PRISMI-Team/VulnDisclos
This is a repository for batch vulnerability research, containing publicly available security research and vulnerability information. - PRISMI-Team/VulnDisclos
🚨 CVE-2026-111943
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
🎖@cveNotify
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.
🎖@cveNotify