Reserved but Public CVEs

CVE-2026-39210 is a heap buffer overflow in FFmpeg’s TS demuxer. The flaw was reported as having been introduced in 2010. The vulnerability affects FFmpeg’s parsing of MPEG transport stream data within the demuxing path, where malformed attacker-controlled media input can trigger an out-of-bounds write on heap-allocated memory. As a memory corruption issue in a media parser, successful exploitation can lead to process instability and may create conditions for further exploitation depending on allocator behavior, surrounding memory layout, and runtime protections.

CVE-2026-39210First seen Jun 6, 2026

CVE-2026-54523 is a critical cross-namespace privilege escalation vulnerability in Kyverno, the Kubernetes policy engine. The flaw affects Kyverno versions up to and including 1.18.1 and arises from missing authorization and namespace-boundary validation in the CEL-driven resource generation path used by NamespacedGeneratingPolicy. A tenant who is permitted to create a NamespacedGeneratingPolicy in their own namespace can supply an arbitrary namespace value to the generator.apply(namespace, resources) function, causing Kyverno’s background controller to generate resources in namespaces other than the policy’s namespace. The vulnerable behavior stems from the resource-generation path accepting the namespace argument without verifying that it matches the namespace of the policy. Because Kyverno’s background controller commonly operates with broad cluster-wide RBAC permissions, the issue creates a confused-deputy condition in which a low-privileged namespace-scoped user can induce the controller to perform privileged actions across namespace boundaries.

CVE-2026-54523First seen Jul 17, 2026

CVE-2026-48019 is a high-severity CRLF injection flaw in the Laravel framework affecting versions up to 13.9.0 and versions before 12.60.0. The issue is caused by improper neutralization of carriage return and line feed sequences in email validation or handling logic when user-controlled email address input is passed into Laravel’s mail workflow and ultimately to Symfony Mailer and Symfony Mime. In applications that use untrusted email input in features such as registration, password reset, contact forms, or other transactional messaging, specially crafted input containing CRLF sequences can alter the structure of outbound messages and interfere with normal email processing.

CVE-2026-48019First seen Jun 1, 2026

CVE-2026-52682 is a high-severity denial-of-service vulnerability affecting multiple PowerDNS components, including PowerDNS Authoritative Server, PowerDNS Recursor, and dnsdist. The flaw can be triggered when an affected service processes a specially crafted DNS packet, leading to abnormal increases in memory and CPU consumption. The available information indicates a resource-exhaustion condition in DNS packet handling, but does not identify the specific vulnerable function or code path. Successful exploitation can degrade or disrupt DNS service availability by forcing the target process to consume excessive system resources.

CVE-2026-52682First seen Aug 6, 2026

CVE-2026-62379 is a pre-authentication remote code execution vulnerability in OpenAM. The flaw is in AuthXMLUtils.createCustomCallback, where requests to the /authservice endpoint can supply an arbitrary Java class name that is loaded through Class.forName without sufficient validation or restriction. This unsafe use of externally controlled class selection allows an unauthenticated attacker to trigger loading of attacker-chosen classes in the authentication service code path, resulting in remote code execution under vulnerable configurations, including default deployments.

CVE-2026-62379First seen Jul 24, 2026

CVE-2026-1403 is a denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition caused by improper validation of CSV file structure during CSV import processing. A malformed CSV file submitted by an authenticated user can trigger failures in background job handling and disrupt Sidekiq workers responsible for processing the import. The issue affects GitLab CE/EE versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3.

CVE-2026-1403First seen Apr 9, 2026

CVE-2025-2774 is a high-severity vulnerability in Webmin, the web-based system administration panel, affecting versions prior to 2.302. The flaw is caused by improper neutralization of CRLF sequences in CGI requests, allowing a remote authenticated attacker to submit specially crafted requests that alter request handling in a security-relevant way. Successful exploitation can lead to privilege escalation and arbitrary code execution, with execution occurring in the context of the root user on affected systems.

CVE-2025-2774First seen Jan 17, 2026

The available context indicates that CVE-2026-46626 affects the Symfony Runtime component and is described in upstream security notes as: "[Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER['QUERY_STRING']". This indicates a bypass of a prior security fix in the Runtime component, where insufficient gating or validation around argv handling allowed the original protection for CVE-2024-50340 to be circumvented. The precise vulnerable function, code path, and exploit mechanics are not provided in the supplied content.

CVE-2026-46626First seen May 20, 2026

CVE-2026-4047 is an authentication bypass vulnerability in Qinglong affecting version 2.20.1 and earlier. The flaw is caused by a mismatch between Qinglong’s authentication middleware and Express.js routing behavior: the authentication check treats protected paths such as /api/ as case-sensitive, while the router matches paths case-insensitively. As a result, an unauthenticated attacker can send requests to altered path variants such as /aPi/... to bypass authentication and reach endpoints intended to be protected. According to the provided reporting, this issue was documented in GitHub Issue #2934 and was observed to enable direct remote code execution by reaching protected functionality without first resetting credentials.

CVE-2026-4047First seen Apr 28, 2026

CVE-2025-48932 is a critical SQL Injection vulnerability in Invision Community versions up to 4.7.20, specifically within the calendar application's view.php script. The vulnerability arises from improper sanitization of the 'location' parameter in the search() method, allowing remote, unauthenticated attackers to inject arbitrary SQL queries. Exploitation requires the calendar application and a configured GeoLocation feature (such as Google Maps). The vulnerability can be leveraged to read sensitive database data, and in versions prior to 4.7.18, may enable admin account takeover or remote code execution via password reset mechanisms.

CVE-2025-48932First seen Mar 18, 2026

CVE-2026-58221 is an authenticated access control vulnerability in Samba Active Directory. The issue affects Samba AD deployments and is associated with authenticated LDAP access that can permit an attacker to progress to domain takeover. Publicly available context identifies the flaw at a high level but does not provide sufficient technical detail about the specific vulnerable code path, function, or protocol handling logic involved.

CVE-2026-58221First seen Jul 28, 2026

CVE-2026-14957 is a denial-of-service vulnerability in libreswan in which a badly formatted X.509 certificate can trigger an assertion failure and crash the daemon process. The issue is associated with certificate parsing or validation logic that does not safely handle malformed X.509 input and instead reaches an assertion condition, terminating the affected process. In deployments where libreswan processes certificate-based authentication material, a malformed certificate presented during relevant protocol handling can cause service interruption.

CVE-2026-14957First seen Jul 27, 2026

CVE-2026-59679 is an out-of-bounds memory access vulnerability in the libXfont2 font-server client, affecting versions prior to 2.0.9. The flaw is in fs_read_glyphs() in src/fc/fserve.c, where the per-character encoding[] array is indexed using num_chars from an FS_QueryXBitmaps16 reply even though the array was allocated based on num_extents from a separate FS_QueryXExtents16 reply. Because these two values are not cross-checked, a malicious font server can induce a size mismatch by supplying a small num_extents value followed by a larger num_chars value. This can trigger out-of-bounds heap reads during metric handling and out-of-bounds writes when storing glyph bitmap pointers in the encoding[] entries. The issue was attributed to an incomplete fix for CVE-2014-0210.

CVE-2026-59679First seen Aug 5, 2026

CVE-2026-44950 is a heap-based buffer overflow in the libXfont2 font-server client, affecting versions prior to 2.0.9. The flaw is in fs_read_glyphs() in src/fc/fserve.c, which copies glyph bitmap data into a single heap buffer allocated to rep->nbytes bytes. The implementation validates each individual source slice against the source bitmap buffer, but does not verify that the cumulative destination writes remain within the bounds of the allbits allocation. A malicious font server can exploit this by supplying overlapping or otherwise crafted source offsets such that each per-glyph copy appears individually valid while the aggregate writes overflow the destination heap buffer. The overflow is attacker-controlled in both content and size and stems from an incomplete fix for CVE-2014-0210.

CVE-2026-44950First seen Aug 5, 2026

CVE-2026-16633 is a client-side remote code execution vulnerability manifesting as cross-site scripting in applications that use vulnerable builds of ngx-extended-pdf-viewer, which bundles a vulnerable version of Mozilla pdf.js. The flaw is triggered when the viewer opens a crafted PDF containing malicious XML Forms Architecture (XFA) content. During parsing and rendering of attacker-controlled XFA parameters, insufficient sanitization allows arbitrary JavaScript to execute in the origin of the hosting web application. The reported root causes are improper zero-padding of low control characters in the pdf.js escapePDFName function and incorrect surrogate-pair handling in encodeToXmlString, enabling sanitizer bypass and injection of active markup or script content. Affected ngx-extended-pdf-viewer versions are 27.0.0-rc.0 through before 29.0.0-rc.3.

CVE-2026-16633First seen Aug 6, 2026

CVE-2026-71385 is an incorrect authorization vulnerability in Adobe ColdFusion. It is one of several authorization-related flaws addressed in Adobe ColdFusion 2025 and 2023 security updates. The issue stems from improper enforcement of authorization controls, which can allow an attacker to bypass intended access restrictions within the application. Specific vulnerable functions or code paths are not available from the provided information.

CVE-2026-71385First seen Aug 11, 2026

CVE-2026-9672 is a vulnerability in libgd2, the graphics library used for programmatic image creation and manipulation and bundled or consumed by PHP through its GD component. The flaw is triggered when the library processes a malformed GIF file. Available reporting indicates that PHP addressed the issue by upgrading libgd in security releases 8.2.33, 8.3.33, 8.4.24, and 8.5.9. The specific vulnerable function and root cause have not been disclosed in the available information, but the issue is associated with unsafe handling of crafted GIF input during image parsing or decoding.

CVE-2026-9672First seen Jul 31, 2026

CVE-2026-42491 is a transport security flaw in the Xen Project XAPI SDKs affecting the C# and PowerShell language bindings. While the primary RPC connection to the XAPI host performs certificate verification correctly or delegates verification appropriately, certain SDK HTTP handlers establish separate connections for secondary operations and fail to implement TLS certificate verification correctly on those connections. This creates a man-in-the-middle exposure for traffic exchanged during those secondary HTTP operations. An attacker positioned between software built on the affected SDKs and an XAPI host can intercept and modify data transmitted over those connections, including material associated with administrative sessions and data transfer workflows.

CVE-2026-42491First seen Jul 14, 2026

CVE-2026-53918 is a high-severity use-after-free vulnerability in OpenWrt's odhcpd, affecting the DHCPv6 Identity Association (IA) handler. Available details indicate the flaw arises from a dangling first-lease pointer during DHCPv6 IA processing, causing the handler to retain and later dereference freed memory. Because odhcpd is a default-enabled network service in OpenWrt and the issue is described as remotely triggerable, a network-adjacent attacker can reach the vulnerable code path by sending crafted DHCPv6 traffic that exercises IA handling.

CVE-2026-53918First seen Jun 30, 2026

CVE-2026-50055 is a vulnerability in Zimbra Collaboration Suite that allows bypass of configured mail forwarding restrictions. An authenticated user can circumvent enforced forwarding controls and cause email to be forwarded or otherwise exfiltrated despite administrative restrictions intended to prevent such behavior. Publicly available information does not provide additional technical detail about the affected code path or vulnerable function.

CVE-2026-50055First seen Jul 21, 2026

CVE-2026-56136 is an out-of-bounds access vulnerability in NTFS-3G, the userspace NTFS driver and utilities suite used with FUSE. The flaw occurs when clearing an index root while processing maliciously crafted or corrupt NTFS index data. Improper bounds handling during index-root cleanup can cause the software to access memory outside the intended buffer while parsing malformed filesystem metadata. The issue is triggered by specially crafted NTFS filesystem structures and was fixed in NTFS-3G 2026.7.7, with vendor patch bundles also made available for older supported branches.

CVE-2026-56136First seen Jul 15, 2026

CVE-2026-46569 is a heap buffer overflow vulnerability in NTFS-3G affecting the ntfs_ib_copy_tail() function. The flaw occurs when tail data from an NTFS index block is copied into a newly allocated block without proper bounds enforcement, allowing memory corruption during processing of malformed or maliciously crafted NTFS filesystem structures. The issue is triggered while parsing specially crafted NTFS images or filesystems and affects the userspace NTFS driver and related tooling that handle such data.

CVE-2026-46569First seen Jul 15, 2026

CVE-2026-46570 is a heap memory corruption vulnerability in ntfs-3g affecting the ntfs_index_walk_down() function. The flaw is triggered when the software processes maliciously crafted or corrupt NTFS index data that causes descent to an out-of-bounds tree depth. Unsafe handling of this malformed index structure can corrupt heap memory during NTFS metadata traversal. Because ntfs-3g is used to parse and mount NTFS filesystems, the issue is reachable through specially crafted NTFS filesystem images or metadata presented to a vulnerable system.

CVE-2026-46570First seen Jul 15, 2026

CVE-2026-42616 is a heap memory corruption vulnerability in the ntfscat utility, part of the NTFS-3G/ntfsprogs suite. The flaw is triggered when ntfscat processes a corrupt or maliciously crafted NTFS filesystem structure or image. The vulnerable condition arises during parsing and handling of attacker-controlled filesystem metadata, leading to corruption of heap memory. Because the affected component operates on untrusted NTFS data, successful exploitation may be possible through a specially crafted filesystem image presented to the utility.

CVE-2026-42616First seen Jul 15, 2026

CVE-2026-56135 is a heap buffer overflow vulnerability in ntfs-3g affecting the build_inherited_id() function during construction of inherited ACL data. The flaw is triggered when ntfs-3g processes a specially crafted or corrupted NTFS filesystem image containing manipulated ACL metadata and related attributes. Improper bounds handling during inherited ACL processing can cause a write beyond the bounds of a heap-allocated buffer, resulting in memory corruption. Because ntfs-3g is commonly used to parse and mount NTFS filesystems through FUSE and may handle attacker-controlled filesystem content, successful exploitation can occur during processing of malicious NTFS structures.

CVE-2026-56135First seen Jul 15, 2026