CVE Vulnerability Catalog

FFmpeg versions 2.1 through 8.1.2 contain a heap buffer overflow vulnerability in the VobSub subtitle demuxer. Supplying a malicious .sub/.idx file with excessive stream IDs can cause out-of-bounds writes and potential code execution.

Vulnerability in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) in the IAM component generates incorrect security tokens. A low-privileged remote attacker can escalate privileges.

Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability. A high privileged attacker with remote access could exploit this to achieve privilege escalation.

In Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00, a vulnerability allows local privilege escalation to root for an already authenticated user on GNU/Linux or Oracle Solaris.

libheif versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.

Analog Way Picturall Quad Compact Mark II version 3.5.8 contains a local privilege escalation vulnerability in the core firmware due to improper privilege delegation and insufficient input validation in a maintenance script.

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. Affected versions include BIND 9.11.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23, and S1 versions.

BIND 9 in certain versions may exit unexpectedly with an assertion while validating proof if a domain is covered by both NSEC and NSEC3 records and an RRSIG exists for only one type.

BIND 9 contains a vulnerability that causes unexpected termination of the named process. The issue occurs with specific ordering of responses to queries for CNAME, DNAME, and A records when the authoritative server delays the response.

In BIND 9, an attacker can respond to a query with an RRSIG having fewer labels than the zone, causing a wildcard name for a shorter zone, leading to cache poisoning. This requires synth-from-dnssec yes (default).

A DNSSEC validating resolver under a random subdomain attack can suffer from runaway memory usage, exceeding the max-cache-size limit. The attacker needs to send queries faster than the resolver can validate.

Resource exhaustion vulnerability in BIND related to DNSSEC validation. The server always validates all RRSIG records in a response, even if unnecessary, leading to excessive CPU usage.

BIND 9 has a vulnerability in RPZ processing with wildcard CNAME policies. An attacker can send a query with a long name triggering a NAMETOOLONG error, which may lead to bypassing RPZ rules or an unexpected exit of BIND 9.

Vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.

Vulnerability in NLnet Labs Unbound (versions 1.23.0 to 1.25.1) with 'dns-error-reporting: yes' enabled allows an attacker to remotely crash the daemon by sending a crafted upstream response. The bug occurs when processing the EDNS Report-Channel option.

In Unbound 1.7.0 up to 1.25.1, insufficient validation of the RRSIG.Labels field combined with premature cache writes during aggressive NSEC processing (RFC 8198) leads to cache poisoning. This allows an attacker controlling one delegated zone to poison arbitrary sibling zones under NSEC-signed parent domains.

In Unbound versions 1.9.0 through 1.25.1, when handling DNSCrypt queries over TCP, the reply encryption routine does not bound the reply length to the destination buffer size. A reply larger than 65504 bytes can cause a heap buffer overflow, leading to resolver crash (DoS). Requires DNSCrypt support enabled.

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Unbound exceed the configured 'quic-size' limit with low-cost input. Using only one connection and two streams, each sending a declared 65535-byte length prefix and then holding the streams open, a client can already trivially make Unbound roughly allocate double that amount. This is a remote availability issue / memory-accounting bypass in the downstream DoQ implementation that leads to denial of service for new DoQ clients. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces.

A deserialization vulnerability in Progress Telerik UI for AJAX (prior to v2026.2.708) allows unsafe type instantiation from attacker-influenced persisted state.

In Progress Telerik UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.