Vulnerabilities
Vulnerabilities
Only issues with an assigned CVE are listed. Dates, CVSS, and CWE come from NVD where a record has been published. 30 entries.
Major vendors involved, all confirmed and fixed: Apple · Meta · NVIDIA · Mozilla · Apache · OISF.
Nothing matches those filters.
VulnAgent / CodeBuddy Security, 2026(16)
Suricata · 2026-09-20
Type confusion in DNS-over-HTTP/2, an invalid free that can lead to remote code execution.
Open WebUI · 2026-09-09
Unvalidated calendar alert offsets disable reminders for every user.
FreeRDP · 2026-08-01
Heap buffer overflow in the clipboard virtual channel. A malicious RDP server can gain code execution.
Langflow · 2026-05-12
Path traversal in bulk delete.
LiteLLM · 2026-05-08
SQL injection.
NVIDIA Model Optimizer · 2026-03-24
Unsafe deserialization of an ONNX model.
NVIDIA Megatron-LM · 2026-03-24
Remote code execution by loading a malicious file.
NVIDIA Megatron-LM · 2026-03-24
Deserialization of untrusted data.
Apache IoTDB · 2026-03-09
Expression injection through the JEXL evaluator.
ImageMagick · 2026-02-24
Heap out-of-bounds read in the DCM decoder.
manga-image-translator · 2026-02-11
Remote code execution through unsafe deserialization.
Suricata · 2026-01-27
Uncontrolled resource consumption in the DNP3 parser.
Suricata · 2026-01-27
Unbounded buffer expansion in the DCERPC UDP parser.
React · 2026-01-26
Denial of service in React Server Components.
Gitea
Argument injection in an external renderer, leading to remote code execution.
Gitea
Memory-amplification denial of service while parsing Alpine .PKGINFO files.
Browser research, 2024–2025(2)
Firefox · 2025-03-04
JIT corruption of WebAssembly i32 return values on 64-bit CPUs, found by fuzzing. Leftover bits can make a value be treated as a different type.
WebKit · 2024-12-12
Out-of-bounds read. Crafted web content can crash the process. Fixed in Safari 18.2 and the corresponding Apple system updates.
Fuzzing at university, 2020–2023(12)
JerryScript · 2023-04-24
Assertion failure while handling a lexical environment.
JerryScript · 2022-04-05
Array.prototype.slice did not refresh its end index when a fast array was resized.
Flamingo · 2020-12-26
SQL injection in UserManager::addUser.
Flamingo · 2020-12-26
SQL injection in UserManager::addGroup.
Flamingo · 2020-12-26
SQL injection in UserManager::updateUserInfoInDb.
Flamingo · 2020-12-26
SQL injection in UserManager::updateUserTeamInfoInDbAndMemory.
struct2json · 2020-12-26
Unbounded strcpy.
Tengine · 2020-12-26
Buffer overflow from insufficient format checks on crafted input.
WebKit · 2020-10-16
Incorrect integer-range analysis for negative masks in the B3 compiler.
TinyWebServer
Heap overflow from an unbounded SQL statement.
TinyWebServer
Stack overflow from unbounded input.
TinyWebServer
SQL injection.