Tagged “cve.org”
CVEs tagged cve.org, newest first.
47244 CVEsRSS
CVE-2026-116842Medium· 6.1PoCDevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup
DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routine when opening crafted MPQ archives. Attackers can supply an MPQ archive whose block table count exceeds its ha…
CVE-2026-116829Medium· 6.6PoCllama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader
llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF …
CVE-2024-58399Medium· 6.1llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGU…
CVE-2026-116841Medium· 5.5PoCDevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup
DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_hash function that allows attackers to read heap memory via unchecked block_table_index values. Attackers can pla…
CVE-2026-116816High· 7.8llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer
llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> w…
CVE-2025-71439Medium· 5.5PoCllama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info
llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a sho…
CVE-2026-116836High· 8.8A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.
A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.
CVE-2026-116608Medium· 5.4PoCDAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check
A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load_pretrained_model of the file videollama2/model/__init__.py of the component Model Loading. The manipulation of …
CVE-2026-116605Medium· 5.3PoCSourceCodester Online Food Ordering System order.php client-side enforcement of server-side security
A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-sid…
CVE-2026-34157High· 7.6PoCWails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
CVE-2026-33944High· 8.8Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
CVE-2026-49272High· 8.5PoCOAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
CVE-2026-116591High· 8.7compress zstd: Panic on two-block frames
compress zstd: Panic on two-block frames
CVE-2026-114619Medium· 4.6Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
CVE-2026-114618Medium· 6.8Authlib: Default JWT bearer grant accepts assertions for the wrong audience
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
CVE-2026-114617Medium· 4.2⚖ disputedAuthlib: ID token can disable its own nonce validation via the nonce_supported claim
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
CVE-2026-114615High· 7.4Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
CVE-2026-114614Low· 2.6Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback…
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
CVE-2026-114613High· 7.5MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
CVE-2026-108357High· 8.8PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
CVE-2026-108358High· 8.8PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
CVE-2026-114607Critical· 9.1better-auth: OAuth state can be used as a Magic Link to sign in as another user
better-auth: OAuth state can be used as a Magic Link to sign in as another user
CVE-2026-59158High· 7.5PoCNuxt Ollama: public runtime configuration discloses the configured cloud API key
Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. …
CVE-2026-116742Medium· 4.4HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count
HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncat…
CVE-2026-116726Low· 3.3gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title
Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to r…
CVE-2026-116507Medium· 5.3PoCTOTOLINK A950RG global.so getLanguageCfg information disclosure
A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The a…
CVE-2026-116734Low· 3.7flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header
flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps t…
CVE-2026-116738High· 8.8VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder
VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line…
CVE-2026-116730Medium· 5.5Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import
Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in src/engine/fileOps/ftm.cpp, triggered by an unbounded DPCM note count during FamiTracker module import. Attackers can craft a .ftm, .dnm…
CVE-2026-116515Medium· 6.3PoCitsourcecode Online Book Store book.php sql injection
A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql injection. The attack is possible to …