CVE Database

CVE-2026-111312 High · 7.7 CWE-306 Oct 15, 2026

OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.

CVE-2026-111284 Medium · 5.4 CWE-79 Oct 15, 2026

Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal

Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.

CVE-2026-111283 Critical · 9.0 CWE-305 Oct 15, 2026

BMC Helix Network Management before 26.3.01 Authentication Bypass via SAML Configuration

BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.

CVE-2026-111282 High · 8.2 CWE-190 Oct 15, 2026

iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer

Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.

CVE-2026-111281 Critical · 9.8 CWE-798 Oct 15, 2026

Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials

Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.

CVE-2026-111280 High · 7.4 CWE-787 Oct 15, 2026

snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea

snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.

CVE-2026-111279 High · 7.5 CWE-789 Oct 15, 2026

Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.

CVE-2026-111278 Medium · 5.3 CWE-804 Oct 15, 2026

NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML

NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam, registrations, reviews, and account deletion requests.

CVE-2026-111277 High · 7.5 CWE-862 Oct 15, 2026

NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.

CVE-2026-111275 Medium · 6.1 CWE-787 Oct 15, 2026

nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim

nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.

CVE-2026-111274 Medium · 5.5 CWE-125 Oct 15, 2026

unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields

unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.

CVE-2026-111273 Medium · 6.1 CWE-193 Oct 15, 2026

unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name

unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.

CVE-2026-111272 Medium · 5.5 CWE-125 Oct 15, 2026

LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo

LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.

CVE-2026-111270 Medium · 6.1 CWE-787 Oct 15, 2026

libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.

CVE-2026-111271 Medium · 5.5 CWE-125 Oct 15, 2026

libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2

libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input buffer and crashing any libmodplug consumer.

CVE-2026-111269 Medium · 6.1 CWE-125 Oct 15, 2026

libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string

libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak adjacent heap memory.

CVE-2026-110922 High · 8.8 CWE-416 Oct 15, 2026

Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to...

Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-110921 High · 8.8 CWE-416 Oct 15, 2026

Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute...

Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-110920 High · 8.8 CWE-119 Oct 15, 2026

Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to...

Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-110919 High · 8.8 CWE-416 Oct 15, 2026

Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute...

Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-110918 Medium · 4.3 CWE-119 Oct 15, 2026

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to...

Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-110917 Medium · 4.3 CWE-119 Oct 15, 2026

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to...

Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-110916 Unknown CWE-20 Oct 15, 2026

Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote...

Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-110915 High · 8.8 CWE-416 Oct 15, 2026

Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker...

Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-110914 High · 8.8 CWE-119 Oct 15, 2026

Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to...

Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)