CVE Vulnerability Catalog

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows leaking heap memory into decoded pixels via short packed-BGR bitstreams. A crafted Huffyuv BGR24/BGRA video can cause decode_slice() to add uninitialized s->temp[0] bytes into output frames.

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. A crafted type-0 CDXL file can expose stack bytes and pointer fragments in the BGR24 output.

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. A crafted truncated Sun Raster file can cause the uncleared temporary bitmap to be expanded into PAL8 pixels, exposing stale heap contents.

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.

A weakness has been identified in Presenton up to 0.9.11-beta in some unknown functionality of the API component, causing missing authentication. The attack can be initiated remotely, and the exploit has been made public. Upgrading to version 0.9.12-beta resolves the issue.

A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/DescriptionInput.tsx of the Submission Description Editor component. The manipulation results in cross site scripting, and the attack may be performed remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in D-Link DIR-505 1.10B02 in the save_upload_file/mp_upload_file function of /usr/bin/tftpd, which handles TFTP upload filenames. Manipulation of input leads to a stack-based buffer overflow. The attack can be carried out remotely, and a public exploit is available and might be used.

XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. The bundled copy (1.0.7 or 1.1.0) carries the vulnerability described in CVE-2026-111497, and the decoder is reachable through dependent modules that decompress untrusted data.

A security flaw was discovered in YznCMS up to version 2.2.0 in the Backend function of app/admin/controller/auth/Group.php (Auth Group Handler component). Manipulation results in improper privilege management. The attack can be initiated remotely, and upgrading to version 2.2.1 fixes the issue.

An uncontrolled recursion vulnerability exists in the Apache Thrift Java bindings. The issue affects Apache Thrift versions before 0.24.0. It is fixed in version 0.24.0.

The JavaNativeMessageDecoder class in the Apache MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes without any class filter. An application that places it in front of an untrusted peer is exposed to gadget-chain remote code execution. The 3.0.0 branch is inactive and no fix will be released for it.

CVE-2026-118147 is an improper certificate validation vulnerability in Visual Studio. An unauthorized attacker can exploit this flaw to perform spoofing over a network.

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests.

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-bit Cr to trigger file-controlled heap writes past the Cr plane, potentially achieving code execution in image-processing pipelines.

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that executes when administrators view related coupons, stealing CSRF tokens to create administrator accounts.

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the output_dir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files to exhaust disk or inodes and use error messages as a filesystem oracle.