Schwachstellen, die jetzt zählen.

tesseract: tesseract: Denial of service via crafted template files

tesseract: tesseract: Denial of Service via crafted traineddata file

ssl_verify_fun: ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

tesseract: Tesseract: Denial of service via crafted trained model file

tesseract: tesseract: Denial of Service via crafted right-to-left text rendering

pgadmin4: pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier

pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, where it treated the next double quote as closing the identifier. psql's \copy parser applies the connection's escape character to whichever quote opened a token, so with…

pgadmin4: pgadmin4: Account takeover via account lockout bypass

In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: - Flask-Security registers its own views next to pgAdmin's. A login submitted to its /login view was checked and logged in without pgAdmin's failed login count or lock. Its…

eu.copernik/copernik-xml-factory: Copernik XML Factory: Information disclosure via unrestricted XInclude resource resolution

crass: crass: Denial of Service via crafted non-ASCII CSS input

crass: crass: Denial of Service via excessive recursion when processing comments

crass: crass: Denial of Service via deeply nested CSS structures

crass: crass: Denial of Service via crafted scientific notation in CSS

hydra: Hydra: Theft of pending deposits via improper transaction validation

GNU libc: Schwachstelle ermöglicht Denial of Service und Codeausführung

It was discovered that the GNU C Library incorrectly handled the ccs= option in the fopen function. An attacker could possibly use this issue to cause GNU C Library to crash or execute arbitrary code. (CVE-2026-18374) It was discovered that the GNU C Library incorrectly handled long domain names in DNS search lists. An attacker on the local network could possibly use this issue to cause GNU C Library to crash, resulting in a denial of service. (CVE-2026-8674) It was…

github.com/gopacket/gopacket: gopacket: Denial of Service via crafted SCTP packets

## Summary gopacket decodes SCTP (IP protocol 132) by walking the chunk chain through per-chunk-type decoder functions (`decodeSCTPInit`, `decodeSCTPShutdown`, `decodeSCTPError`, `decodeSCTPSack`, in `layers/sctp.go`). Each of these reads fixed-size header fields and runs count-driven loops **without validating the chunk's declared length against the minimums those reads require**. A single crafted SCTP segment causes a runtime panic (out-of-bounds slice read, or inverted…

github.com/schollz/croc: croc: Unauthorized file overwrite via trusted filename prefix bypass

rt: rt: Cross-site scripting via unescaped URLs in HTML ticket content

blender: blender: Arbitrary code execution via crafted .blend file

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.

blender: blender: Arbitrary code execution via thumbnail extractor integer overflow

blender: blender: Arbitrary code execution via crafted point cache file

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.

scribus: scribus: Arbitrary code execution via crafted SVM file

scribus: scribus: Arbitrary code execution via crafted PICT file

scribus: Scribus: Arbitrary code execution via crafted Micrografx Draw file import

scribus: Scribus: Arbitrary code execution via crafted TIFF tile dimensions

scribus: scribus: Denial of Service via crafted PICT image

scribus: scribus: Arbitrary code execution via crafted PICT image file

scribus: scribus: Arbitrary code execution via crafted PSD file

libass: libass: Arbitrary code execution via crafted subtitle files

qt3d: qt: arbitrary code execution via out-of-bounds write in Qt3D assimp plugin

Red Hat Enterprise Linux: Mehrere Schwachstellen

A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.