Reserved but Public CVEs

CVE-2026-39212 is a stack-based buffer overflow vulnerability in FFmpeg affecting ffmpeg_opt.c. The issue is described as a regression introduced in July 2025 and impacts FFmpeg command-line parsing or option-processing logic implemented in that source file. Successful exploitation occurs when attacker-controlled input reaches the vulnerable stack-resident buffer handling path, causing memory corruption through out-of-bounds writes on the stack. As a memory corruption flaw in a widely deployed media-processing framework, the vulnerability can lead to process instability and potentially more serious compromise depending on the surrounding execution context and exploitability of the overwritten stack data.

CVE-2026-39212First seen Jun 6, 2026

CVE-2026-39214 is a stack buffer overflow vulnerability in FFmpeg's Service Description Table (SDT) implementation. The flaw was reportedly introduced in 2003 and remained latent for many years. Based on the available information, the issue arises from unsafe handling of attacker-controlled input in SDT parsing logic, resulting in data being written past the bounds of a stack-allocated buffer. As a memory corruption flaw in media parsing code, successful exploitation could occur when FFmpeg processes a crafted media stream or container carrying malicious SDT data.

CVE-2026-39214First seen Jun 6, 2026

CVE-2026-39213 is a heap buffer overflow vulnerability in FFmpeg’s yuv4mpegenc component. The issue was reported as having been introduced in 2023. Available information identifies the flaw class and affected component, but does not provide the specific vulnerable function, code path, or triggering input structure. Successful exploitation would involve crafted media-processing input reaching the yuv4mpegenc encoding path and causing an out-of-bounds write on heap-allocated memory.

CVE-2026-39213First seen Jun 6, 2026

CVE-2026-39215 is a heap buffer overflow vulnerability in FFmpeg in the function update_mb_info(). The flaw was reportedly introduced in 2012. The available information identifies it as one of a set of FFmpeg memory-corruption issues affecting media-processing code paths. A crafted media input processed by the vulnerable code can cause out-of-bounds writes on the heap, leading to memory corruption and potentially destabilizing the process or enabling further exploitation, depending on allocator behavior and surrounding memory layout. Specific details about the exact source file, triggering format, and the precise bounds-checking failure are not currently available from the provided information.

CVE-2026-39215First seen Jun 6, 2026

CVE-2026-39211 is an integer overflow vulnerability in FFmpeg's swscale component. The issue was reportedly introduced in 2010. The available information identifies the flaw class and affected subsystem, but does not provide the specific vulnerable function, code path, trigger condition, or memory-safety consequences beyond the presence of an integer overflow. swscale is used for image scaling and pixel format conversion, so malformed or attacker-controlled media inputs that reach this processing path could potentially trigger incorrect size or arithmetic calculations during scaling operations.

CVE-2026-39211First seen Jun 6, 2026

CVE-2026-39217 is a heap buffer overflow vulnerability in FFmpeg's VP9 decoder. The issue is described as a regression introduced in March 2025. Successful exploitation occurs when the decoder processes attacker-controlled VP9 media data and performs an out-of-bounds write on heap-allocated memory. As a memory corruption flaw in a media parsing and decoding path, the vulnerability can be triggered during handling of crafted VP9 content by applications or services that rely on FFmpeg for decoding.

CVE-2026-39217First seen Jun 6, 2026

CVE-2026-39216 is a heap buffer overflow vulnerability in FFmpeg affecting code in img2enc.c. The flaw was reportedly introduced in 2012. The available information identifies the bug class and affected source file, but does not provide further technical detail about the specific vulnerable function, trigger condition, or parsing pathway. Successful exploitation would involve causing FFmpeg to perform an out-of-bounds write on heap-allocated memory while processing attacker-controlled input that reaches the vulnerable img2enc.c code path.

CVE-2026-39216First seen Jun 6, 2026

CVE-2026-47156 is a critical authentication bypass vulnerability in the MantisBT SOAP API. The flaw is in the mci_check_login() authentication logic, which allows an attacker to present any valid cookie_string and be authenticated as an arbitrary user, including an administrator. The issue affects the SOAP API authentication path and does not affect the REST API or the web UI. In exposed deployments, this can permit unauthenticated or low-privilege attackers to bypass intended identity verification and obtain administrative SOAP API access.

CVE-2026-47156First seen Jun 29, 2026

CVE-2026-53582 is a stored XPath injection vulnerability in OPNsense affecting certificate authority management functionality exposed through the trust and CA management API. The flaw arises because a user-controllable reference identifier field is incorporated into an XPath expression executed against the system configuration without sufficient validation or neutralization of XPath metacharacters. Specifically, the vulnerable logic performs an XPath lookup using attacker-influenced input when resolving references in the configuration data, allowing a low-privileged user with certificate-related management permissions to persist a crafted payload and later trigger XPath evaluation against config.xml. This enables extraction of sensitive configuration values through a boolean oracle exposed by API responses. Disclosed examples include private keys, password hashes, synchronization credentials, and API secrets stored in the configuration. The issue can result in privilege escalation and may create a path to remote code execution depending on the secrets exposed and the deployment context.

CVE-2026-53582First seen Jul 7, 2026

First seen Jul 1, 2026

CVE-2026-55247 is a denial-of-service vulnerability affecting plone.app.event. Based on the provided content, the issue is triggered via iCalendar import. No further technical detail about the specific vulnerable function, parser behavior, or code path is available in the provided material.

CVE-2026-55247First seen Jun 23, 2026

CVE-2026-55248 is a denial-of-service vulnerability affecting the RSS feed portlet functionality in plone.app.portlets. The provided source material identifies the issue as a DoS condition reachable via the RSS feed portlet and rates it as critical severity 9.1. No further technical detail about the specific vulnerable function, parsing logic, or resource-exhaustion mechanism is provided in the available content.

CVE-2026-55248First seen Jun 23, 2026

CVE-2026-55099 is a denial-of-service vulnerability in the Python icalendar library affecting versions 7.1.0, 7.1.1, and 7.1.2. The issue is caused by the Component.__eq__ implementation, which compares subcomponents with O(2^n) time complexity relative to nesting depth. Because the parser accepts arbitrarily nested calendar components, an attacker can supply a very small malicious .ics file containing deeply nested components that triggers pathological comparison behavior. A single equality-related operation on parsed attacker-controlled calendar data can then take minutes to complete or hang indefinitely. The vulnerable behavior can be reached through equality and membership operations including ==, !=, in, set or dict membership, deduplication logic, and test assertions that compare parsed components.

CVE-2026-55099First seen Jun 23, 2026

The available context only states that CVE-2026-46636 is one of multiple security vulnerabilities affecting Twig (php-twig), a PHP template engine. The advisory text indicates the affected vulnerability set could result in PHP code injection, sandbox bypass, or cross-site scripting, but it does not attribute a specific weakness, root cause, affected function, or impact category to CVE-2026-46636 individually. Specific technical details for this CVE are currently not available from the provided content.

CVE-2026-46636First seen May 27, 2026

CVE-2024-13745 is a flaw in EDK II’s GPT measurement and parsing logic that allows the GUID Partition Table layout or metadata actually used by firmware to differ from what is measured into TPM PCR[5]. According to the disclosure, affected versions include EDK II releases up to and including edk2-stable202411, and later versions may also be affected because no fix was known at disclosure time. The issue arises from inconsistencies between DxeTpm2MeasureBootLib, which measures GPT data for TPM event logging, and PartitionDxe, which parses, validates, and may recover GPT structures for actual use. DxeTpm2MeasureBootLib reads the GPT header from LBA 1, applies comparatively relaxed validation, does not validate CRC32 checksums, does not consult the backup GPT header, and omits unused GPT partition entries from the measured structure. PartitionDxe, by contrast, performs stricter validation, reads both primary and backup GPT headers, and includes recovery logic. The disclosure further describes error-handling flaws in PartitionRestoreGptTable() and PartitionValidGptTable() where failures can leave PrimaryHeader populated with untrusted invalid data while execution continues down a path treating both GPT tables as valid. An attacker can exploit these discrepancies by preserving the GPT data that DxeTpm2MeasureBootLib measures while causing PartitionDxe to recover or use a different GPT header and partition entry array, including via malformed backup GPT headers and attacker-controlled AlternateLBA values. The result is a data-only integrity failure in which PCR[5] and TPM event logs can indicate an expected GPT state while firmware and the operating system use attacker-influenced partition layout or metadata.

CVE-2024-13745First seen May 29, 2026

CVE-2026-33224 affects Bisheng and is described in the provided reporting as an authenticated remote command execution vulnerability in Bisheng's MCP tool/server configuration functionality. The issue is tied to unsafe handling of Model Context Protocol (MCP) STDIO-based server configuration, where attacker-controlled command and argument values can be introduced into local process execution without adequate sanitization or restriction. In the reported exploitation pattern, a user able to access Bisheng's MCP configuration workflow can register or modify an MCP tool/server definition so that Bisheng launches an attacker-specified operating system command on the host running the application. The reporting places this issue in a broader family of MCP STDIO command-injection flaws propagated through unsafe SDK and application design. It also notes that Bisheng's open user registration lowers the barrier to obtaining the authenticated access needed for exploitation.

CVE-2026-33224First seen Apr 20, 2026

CVE-2021-35406 is a command injection vulnerability in the Prolink PRC2402M router, tested on firmware version 20190909. Based on the provided supporting content, the flaw is in the /cgi-bin/qos.cgi CGI handler. When the page parameter is set to qos, the qos_settings routine processes attacker-controlled parameters including qos_dat and qos_bandwidth, uses sprintf to embed them into shell command strings, and executes the resulting command via do_system, a wrapper around system, without sufficient input validation or sanitization. This allows arbitrary shell metacharacters or command substitution to be injected through HTTP POST parameters. The provided proof of concept uses a crafted POST request to /cgi-bin/qos.cgi with page=qos and a malicious qos_dat value such as $(echo gg>/tmp/gg) to demonstrate code execution.

CVE-2021-35406First seen Apr 11, 2026

CVE-2026-34485 is a Nokia vulnerability described in the available advisory context as a CLI ACL bypass affecting Nokia GX G42, GX G31, GX G32, and GX G34 devices running versions prior to GX r9.0. Based on the provided information, the flaw allows command-line interface access-control restrictions to be bypassed. The available source material does not identify the specific vulnerable function, code path, or protocol handling logic responsible for the bypass.

CVE-2026-34485First seen Mar 31, 2026

CVE-2024-35347 is a vulnerability in AMD CPUs, specifically affecting the microcode signature verification process. The flaw allows systems to accept microcode updates that lack the critical microcode signing fix, leaving them exposed to potential exploitation. The vulnerability primarily impacts AMD Family 19h CPUs and is documented in AMD security bulletin AMD-SB-7033. The root cause is insufficient enforcement of microcode signature verification, which can only be fully remediated by applying a BIOS update that delivers the updated microcode with the signing fix. Without this update, systems remain vulnerable even if they receive microcode updates from the Linux firmware repository, as these do not address the underlying signature verification issue.

CVE-2024-35347First seen Mar 18, 2026

First seen Mar 18, 2026

First seen Mar 18, 2026

CVE-2025-29617 is a critical vulnerability in the Piciorgros TMO-100 data modem for TETRA radio networks. The device exposes an unauthenticated TFTP service on both LAN and TETRA data networks, allowing any network-adjacent attacker to read and modify the modem's configuration. The configuration file contains sensitive information such as PPP credentials and network settings. Attackers can leverage this to alter port forwarding, disrupt modem operation, or facilitate further attacks. The issue affects software versions below 4.20, where TFTP access is unrestricted and unauthenticated.

CVE-2025-29617First seen Mar 18, 2026

CVE-2020-14282 is a broken access control vulnerability in HCL Digital Experience affecting versions 8.5, 9.0, and 9.5. The flaw allows anonymous, unauthenticated users to access limited access-control data and may expose system files and folders that should not be available without authorization. The exposed access is described as read-only, and anonymous users cannot use it to grant permissions or modify access settings. The issue stems from improper enforcement of authorization restrictions on resources that should require authenticated access.

CVE-2020-14282First seen Aug 23, 2026

First seen Jul 5, 2026

First seen Jul 5, 2026