Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
394,547 results · page 239 of 7891
Oct 15, 2026UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inCVE-2026-111164 · Other software · UADE · reported by VulnCheckMedium 6.8
UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applications that probe or play it.
- Product
- uade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-eventCVE-2026-111163 · Other software · Mindwerks · reported by VulnCheckMedium 6.8
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.
- Product
- WildMIDI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via undCVE-2026-111162 · Other software · Mindwerks · reported by VulnCheckMedium 6.9
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidi_GetInfo().
- Product
- WildMIDI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memorCVE-2026-111161 · Other software · Wohlstand · reported by VulnCheckMedium 6.9
libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the hosting media player or game engine.
- Product
- libADLMIDI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal CVE-2026-111160 · Other software · ModelTC · reported by VulnCheckHigh 8.7
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams, killing the inference thread while /health stays up and all later requests hang until restart.
- Product
- LightLLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name and value sizes are vaCVE-2026-111159 · Other software · libyal · reported by VulnCheckMedium 6.9
libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or leak uninitialized heap memory through extended attributes.
- Product
- libewf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record bCVE-2026-111158 · Other software · EarthScope · reported by VulnCheckMedium 6.8
EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2_ISVALIDHEADER to msr3_parse() or ms3_detect(), over-reading up to 8 bytes and potentially crashing the process.
- Product
- libmseed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value CVE-2026-111157 · Other software · SoX · reported by VulnCheckMedium 6.9
SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt().
- Product
- sox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplyiCVE-2026-111156 · Other software · sezero · reported by VulnCheckMedium 6.9
libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset arrays, causing heap memory reads, writes, and application crashes.
- Product
- libtimidity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrumenCVE-2026-111155 · Other software · sezero · reported by VulnCheckMedium 6.9
libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through mid_set_soundfont() to read heap memory out of bounds and crash the application.
- Product
- libtimidity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via uncheckedCVE-2026-111154 · Other software · sezero · reported by VulnCheckMedium 6.9
libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse_gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen 16-bit values near the stack Layer object, causing crashes and stack memory corruption.
- Product
- libtimidity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applicationCVE-2026-111153 · Other software · libgme · reported by VulnCheckMedium 6.8
Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip_flags 0x3F, opened through gme_open_data or gme_open_file, to read past the static array during loading and cause denial of service.
- Product
- game-music-emu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer underflow in the CVE-2026-111152 · Other software · libgme · reported by VulnCheckMedium 6.8
Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gme_track_info or gme_start_track, crashing libgme consumers.
- Product
- game-music-emu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row cCVE-2026-111151 · Other software · aous72 · reported by VulnCheckMedium 6.9
OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row past the codeblock buffer, resulting in memory corruption and crashes.
- Product
- OpenJPH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compressionCVE-2026-111150 · Other software · ValleyBell · reported by VulnCheckMedium 6.8
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBlk to over-read heap memory and crash consumers.
- Product
- libvgm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked CVE-2026-111149 · Other software · danoli3 · reported by VulnCheckMedium 6.9
FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap, leaking memory into decoded pixels or crashing the process.
- Product
- FreeImage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unCVE-2026-111148 · Other software · libsidplayfp · reported by VulnCheckMedium 6.8
libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs() reads up to 64 KiB past the heap buffer.
- Product
- libsidplayfp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past bufferCVE-2026-111147 · Other software · libyal · reported by VulnCheckMedium 6.9
Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to about 32 KiB of adjacent heap memory.
- Product
- libesedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed CVE-2026-111146 · Other software · Yeraze · reported by VulnCheckMedium 6.9
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and leaking adjacent heap bytes.
- Product
- ytnef
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTCVE-2026-111145 · Other software · Yeraze · reported by VulnCheckMedium 6.9
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak adjacent heap memory.
- Product
- ytnef
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() that allows attackers to crash applications by supplying a CVE-2026-111144 · Other software · ansilove · reported by VulnCheckMedium 6.8
libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar() to index a NULL high_font_data_xbin pointer and terminate the process.
- Product
- libansilove
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressedCVE-2026-111143 · Other software · ansilove · reported by VulnCheckMedium 6.8
Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing applications that render untrusted XBIN art.
- Product
- libansilove
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central CVE-2026-111142 · Other software · gdraheim · reported by VulnCheckMedium 6.8
Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.
- Product
- zziplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mappeCVE-2026-111141 · Other software · gdraheim · reported by VulnCheckMedium 5.7
zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.
- Product
- zziplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4-CVE-2026-111140 · Other software · libyal · reported by VulnCheckMedium 6.9
libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacent heap bytes or crash parsers like regfexport and plaso.
- Product
- libregf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer byCVE-2026-111139 · Other software · NetSurf · reported by VulnCheckMedium 6.8
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash applications calling bmp_decode().
- Product
- libnsbmp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.netsurf-browser.orggithub.com
Oct 15, 2026NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit thCVE-2026-111138 · Other software · NetSurf · reported by VulnCheckMedium 6.8
NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing applications decoding untrusted images.
- Product
- libnsbmp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.netsurf-browser.orggithub.com
Oct 15, 2026libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte staticCVE-2026-111137 · Other software · amartin755 · reported by VulnCheckMedium 6.9
libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00 byte to corrupt adjacent library globals and crash smidump or other consumers.
- Product
- libsmi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check geCVE-2026-111136 · Other software · swami · reported by VulnCheckMedium 6.9
libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.
- Product
- libinstpatch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bouCVE-2026-111135 · Other software · libyal · reported by VulnCheckMedium 6.9
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag to crash consuming processes.
- Product
- libfwsi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past bufferCVE-2026-111134 · Other software · libyal · reported by VulnCheckMedium 6.9
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or shell bags to crash libfwsi consumers.
- Product
- libfwsi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads viCVE-2026-111133 · Other software · libyal · reported by VulnCheckMedium 6.9
libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash fsapfsinfo, pyfsapfs, dfVFS or plaso and read adjacent heap memory before password checks.
- Product
- libfsapfs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBCVE-2026-111132 · Other software · GNOME · reported by VulnCheckMedium 6.9
GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.
- Product
- libgxps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.gnome.orggitlab.gnome.org
Oct 15, 2026libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c.CVE-2026-111131 · Other software · libxmp · reported by VulnCheckMedium 6.9
libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sample metadata or disrupt loading.
- Product
- libxmp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crCVE-2026-111130 · Other software · OpenSlide · reported by VulnCheckMedium 6.9
OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts, crashing applications that open it and corrupting tile geometry.
- Product
- openslide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReCVE-2026-111129 · Other software · assimp · reported by VulnCheckMedium 6.8
Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames() handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation track targeting a missing submesh or absent shared geometry to crash the host process.
- Product
- assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone iCVE-2026-111128 · Other software · assimp · reported by VulnCheckMedium 6.8
Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById() to return null and crash the host process.
- Product
- assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unCVE-2026-111127 · Other software · catdoc · reported by VulnCheckMedium 6.9
catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process.
- Product
- catdoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read pCVE-2026-111126 · Other software · catdoc · reported by VulnCheckMedium 6.9
catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2csv to disclose adjacent process memory as CSV cells or crash the process.
- Product
- catdoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tilCVE-2026-111125 · Other software · HEASARC · reported by VulnCheckMedium 6.9
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory.
- Product
- cfitsio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before CVE-2026-111124 · Other software · HEASARC · reported by VulnCheckMedium 6.9
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels.
- Product
- cfitsio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFontCVE-2026-111123 · Other software · FluidSynth · reported by VulnCheckMedium 6.9
FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice generator array and updated_gen_bit, causing memory corruption and crashes.
- Product
- fluidsynth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type andCVE-2026-110878 · Other software · aureuserp · reported by VulnCheckMedium 5.1
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.
- Product
- aureuserp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation byCVE-2026-110877 · Other software · adplug · reported by VulnCheckMedium 6.8
AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read bytes beyond packed_module and potentially crash the application.
- Product
- adplug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note indeCVE-2026-110876 · Other software · adplug · reported by VulnCheckMedium 6.8
AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback that may crash affected applications.
- Product
- adplug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds chCVE-2026-110875 · Other software · adplug · reported by VulnCheckMedium 6.9
AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of service.
- Product
- adplug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restriCVE-2026-110874 · Other software · Dolibarr · reported by VulnCheckHigh 7.5
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.
- Product
- dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Ninja Forms Signature Contract Add-On: Missing AuthorizationCVE-2026-110378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5.
- Product
- Ninja Forms Signature Contract Add-On
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Ninja Forms Signature Contract Add-On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Download Monitor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110375 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.
- Product
- Download Monitor
- Affected
- up to 5.3.3
- What to do
- Affects up to 5.3.3. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2026Login with phone number: Missing AuthorizationCVE-2026-110374 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
- Product
- Login with phone number
- Affected
- up to 1.8.77
- What to do
- Affects up to 1.8.77. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.