CVE Vulnerability Catalog

A flaw was found in FFmpeg that a remote attacker could exploit by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. The vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (application crash) and potentially lead to arbitrary code execution.

An out-of-bounds read exists in Skia in Google Chrome prior to 147.0.7727.101. A remote attacker could obtain potentially sensitive information from process memory via a crafted file.

A use after free exists in Codecs in Google Chrome prior to 147.0.7727.101. A remote attacker could potentially perform out-of-bounds memory access via a crafted video file.

A heap buffer overflow in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium rates this vulnerability as Critical.

A buffer overflow was found in GIMP's file-seattle-filmworks plugin, exploitable when a user opens a specially crafted Seattle Filmworks file. A remote attacker could cause a denial of service (DoS), crashing the plugin and potentially affecting GIMP stability.

In GIMP, processing a specially crafted PVR image file with large dimensions can cause a denial of service. A stack-based buffer overflow and out-of-bounds read in the PVR loader crash the application.

A heap buffer over-read in GIMP's icns_slurp() function occurs when processing specially crafted ICNS image files. An attacker could provide a malicious ICNS file, potentially leading to application crashes or information disclosure.

A flaw was found in GIMP: a stack buffer overflow in the TIM image loader's 4BPP decoding path. Opening a specially crafted TIM image file causes the application to crash due to an unconditional overflow when writing to a variable-length array, allowing a local user to cause a Denial of Service (DoS).

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data.

In ApostropheCMS versions 4.28.0 and prior, the choices and counts query parameters in the REST API execute MongoDB distinct() operations that bypass publicApiProjection restrictions. An unauthenticated attacker can extract all distinct field values, including fields protected by viewPermission, and the counts variant reveals document counts per value.

ApostropheCMS versions 4.28.0 and prior contain a stored XSS vulnerability in the @apostrophecms/color-field module. Color values prefixed with -- bypass TinyColor validation, and launder.string() performs only type coercion without stripping HTML metacharacters. These unsanitized values are concatenated directly into <style> tags in per-widget style elements and the global stylesheet, marked as safe HTML. An editor can inject a value that closes the style tag and executes arbitrary JavaScript in the browser of every visitor.

ApostropheCMS versions 4.28.0 and prior contain an authorization bypass in the getRestQuery method of the @apostrophecms/piece-type module. An unauthenticated attacker can supply a project query parameter in a REST API request, causing publicApiProjection to be skipped and disclosing fields the administrator restricted from the public API, such as internal notes, draft content, or metadata.

The CVE-2026-21726 vulnerability allows an attacker to read files by exploiting double encoding in the namespace parameter at the Ruler API endpoint.

A flaw in KubeVirt's Role-Based Access Control (RBAC) evaluation logic improperly truncates subresource names, leading to incorrect permission evaluations. Authenticated users with specific custom roles may gain unauthorized access to subresources or be wrongly denied access.

A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially trigger this vulnerability by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash, resulting in a local Denial of Service (DoS).

Weblate before 5.17 validates repository boundaries using string prefix checks on resolved absolute paths. Multiple code paths use startswith against the repository root, which is not path-segment aware and can be bypassed when an external path shares the same string prefix (e.g., repo and repo_outside). This is fixed in 5.17.

Weblate versions prior to 5.17 did not utilize existing SSRF protections in the webhook add-on. This could allow an attacker to force requests to internal resources. The issue is fixed in version 5.17.

Weblate is a web-based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body in an error message. This is a Server-Side Request Forgery (SSRF) with partial response read. Fixed in 5.17.

In Weblate versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and did not restrict possible redirects. This may allow bypassing domain restrictions when fetching assets.

Weblate before 5.17 exposed unintended translation memory API endpoints that did not perform proper access control. This issue is fixed in 5.17. If developers cannot update immediately, they can disable this feature as the CDN add-on is not enabled by default.