CVE-2026-95769

Unauthenticated Audit Log Spoofing in API of HPE Networking Fabric Composer

An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to falsify the client address recorded in audit records.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Fabric Composer Fabric Composer

CVE-2026-76077

ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Esa

Products

Asn1scc

CVE-2026-70659

stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor name

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entries with the same tensor name but resizes them only when they are empty. An untrusted .imatrix file can provide a small nval for the first entry and a larger nval for a second entry with the same name, causing the accumulation loop to write attacker-controlled floating-point and integer values beyond both heap buffers. Loading the file through the --imat-in conversion path can corrupt the heap or crash the process before a model is required. This issue is fixed in master-763-4fcc6fe.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Leejet

Products

Stable-diffusion.cpp

CVE-2026-122329

SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing crashes or potential code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Libsdl-org

Products

Sdl Mixer

CVE-2026-122328

SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder

SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes or potentially code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Libsdl-org

Products

Sdl Mixer

CVE-2026-122306

Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts that block resource operations.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Kyverno

Products

Kyverno

CVE-2026-122299

Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for git dependency installation. Attackers can craft a commit object with two tree headers so that reviewers and CI using git see a benign tree while Poetry's dulwich-based checkout resolves to a different attacker-controlled tree containing malicious build scripts such as setup.py, resulting in unreviewed code execution on the install or build host.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Jelmer

Products

Dulwich

CVE-2026-121617

Linksys E5600 Header upload_fw.cgi init_multipart out-of-bounds write

A security flaw has been discovered in Linksys E5600 1.1.0.26. Affected by this issue is the function init_multipart of the file /cgi-bin/upload_fw.cgi of the component Header Parser. The manipulation results in out-of-bounds write. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Linksys

Products

E5600 E5600 Firmware

CVE-2026-121616

Linksys E5600 JSON Request mesh_login.cgi strcpy out-of-bounds write

A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/mesh_login.cgi of the component JSON Request Parser. The manipulation of the argument username/password/token/source/cn/action leads to out-of-bounds write. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linksys

Products

E5600 E5600 Firmware

CVE-2026-121601

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta_id and slice index

A flaw was found in GStreamer's MXF demuxer plugin (gst-plugins-bad). When processing a specially crafted MXF media file, the demuxer indexes its internal delta-entry and slice-offset tables using values from the file without validating that they are within the bounds of the allocated arrays. A local attacker who tricks a user into opening a malicious MXF file can cause the application to crash (denial of service) and may be able to read limited amounts of heap memory adjacent to the affected arrays.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Rhel Els

CVE-2026-121597

TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow

A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-bin/cstecgi.cgi of the component Easy Setup Wizard Handler. Executing a manipulation of the argument functionType can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A950rg A950rg Firmware

CVE-2026-115946

XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder

XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bundled copy, 1.0.7 or 1.1.0 across the range, carries the decoder out-of-bounds write described in CVE-2026-111497. Version 1.2.1.0 updates it to brotli 1.2.1. XS::libbrotli has no Perl interface, so the decoder is reached through any dependent module that decompresses untrusted data with it. An attacker supplying a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Upgrading the system brotli does not remediate this.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Perl

Products

Xs::libbrotli

CVE-2026-115762

draw.io: Prototype pollution in GraphML (mxGraphMlCodec)

draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype objects, and the decoder can then assign attacker-controlled attributes to those objects. Importing a malicious GraphML file can trigger client-side prototype pollution. In the advisory-supported cross-site scripting chain, the editor is opened in Trello mode and the user invokes the Trello integration after the import, allowing the polluted state to execute script in the draw.io origin; an existing Trello connection is not required. This vulnerability is fixed in 31.1.5.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Jgraph

Products

Drawio

CVE-2026-113783

ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses

ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolver's cached-lookup path in dns_lookup() in dns.c copies every cached address into a caller-provided single ip_addr_t output buffer without a length parameter or bounds check. When CONFIG_LWIP_DNS_MAX_HOST_IP is greater than 1 and a cached hostname has multiple A or AAAA records, a subsequent lookup through dns_gethostbyname() or dns_gethostbyname_addrtype() writes beyond the single-element buffer into adjacent stack memory. A network-positioned attacker who influences DNS responses can cause a reboot through stack-canary corruption or, without stack protection, overwrite stack variables with attacker-controlled address bytes and potentially redirect control flow. This issue is fixed in versions 5.5.6 and 6.0.3 and is scheduled to be fixed in versions 5.3.7 and 5.4.5. No fixed release is available for the end-of-life 5.2 line.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Espressif

Products

Esp-idf

CVE-2026-113782

ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsing

ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThread Border Router Neighbor Discovery packet handler trusts an attacker-controlled ICMPv6 option length while copying into a fixed stack buffer. A host on the same infrastructure link as the Border Router can send a crafted ICMPv6 Router Advertisement to its infrastructure interface whose oversized length causes an out-of-bounds write into adjacent stack memory. Firmware is affected only when CONFIG_OPENTHREAD_BORDER_ROUTER=y; Thread end devices, routers, and RCP firmware without the Border Router feature are unaffected. Exploitation requires no authentication or user interaction and can crash or reboot the device or corrupt adjacent stack state. This issue is fixed in versions 5.2.8, 5.3.6, 5.5.5, and 6.0.3 and is scheduled to be fixed in version 5.4.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Espressif

Products

Esp-idf

CVE-2026-110716

unshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table

unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range file_table_offset or large file counts to crash the unshield tool or library consumers.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Unshield Project

Products

Unshield

CVE-2026-110661

CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header

CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past disk_node_data, crashing tools like cgnslist.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cgns

Products

Cgns

CVE-2026-110656

miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Miniupnp Project

Products

Miniupnpc

CVE-2026-103442

MergeAccount PHP object injection via session-key substitution

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wikimedia

Products

Mediawiki - Centralauth Extension

CVE-2026-102345

Zammad: Stored XSS in ticket article rendering in the new Vue-based interface

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, the new Vue-based ticket interface can render ticket article content without the expected output encoding. An authenticated user can store markup in an article that is interpreted when another user views the ticket, enabling stored cross-site scripting. The default Content Security Policy limits practical impact, and the classic REST/CoffeeScript interface is not affected. This issue is fixed in version 7.1.2.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Zammad

Products

Zammad