rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-24779 vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`
vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request Forgery (SSRF) vulnerability exists in the `MediaConnector` class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods obtain and process media from URLs provided by users, using different Python parsing libraries when restricting the target host. These two parsing libraries have different interpretations of backslashes, which allows the host name restriction to be bypassed. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources. This vulnerability is particularly critical in containerized environments like `llm-d`, where a compromised vLLM pod could be used to scan the internal network, interact with other pods, and potentially cause denial of service or access sensitive data. For example, an attacker could make the vLLM pod send malicious requests to an internal `llm-d` management endpoint, leading to system instability by falsely reporting metrics like the KV cache state. Version 0.14.1 contains a patch for the issue.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
Affected products: vendor: vllm-project
product: vllm
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
version: 3.1
Published: 2026-01-27T22:01:13.808Z
CVE-2026-24780 AutoGPT is Vulnerable to RCE via Disabled Block Execution
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.44, AutoGPT Platform's block execution endpoints (both main web API and external API) allow executing blocks by UUID without checking the `disabled` flag. Any authenticated user can execute the disabled `BlockInstallationBlock`, which writes arbitrary Python code to the server filesystem and executes it via `__import__()`, achieving Remote Code Execution. In default self-hosted deployments where Supabase signup is enabled, an attacker can self-register; if signup is disabled (e.g., hosted), the attacker needs an existing account. autogpt-platform-beta-v0.6.44 contains a fix.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: Significant-Gravitas
product: AutoGPT
Published: 2026-01-29T17:39:33.524Z
CVE-2026-24781 vm2: Sandbox Breakout Through Inspect
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
cwe_id: CWE-693
description: CWE-693: Protection Mechanism Failure
Affected products: vendor: patriksimek
product: vm2
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-05-04T16:33:32.869Z
CVE-2026-24782 Kiteworks Secure Data Forms has a SQL Injection vulnerability
Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: kiteworks
product: Secure Data Forms
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
version: 3.1
Published: 2026-06-01T22:00:24.657Z
CVE-2026-24783 soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives
soroban-fixed-point-math is a fixed-point math library for Soroban smart contacts. In versions 1.3.0 and 1.4.0, the `mulDiv(x, y, z)` function incorrectly handled cases where both the intermediate product $x * y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be negative, neglecting the sign of $z$. This resulted in rounding being applied in the wrong direction for cases where both $x * y$ and $z$ were negative. The functions most at risk are `fixed_div_floor` and `fixed_div_ceil`, as they often use non-constant numbers as the divisor $z$ in `mulDiv`.  This error is present in all signed `FixedPoint` and `SorobanFixedPoint` implementations, including `i64`, `i128`, and `I256`. Versions 1.3.1 and 1.4.1 contain a patch. No known workarounds for this issue are available.
Problem types: cwe_id: CWE-682
description: CWE-682: Incorrect Calculation
Affected products: vendor: script3
product: soroban-fixed-point-math
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2026-01-27T22:04:18.006Z
CVE-2026-24784 DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer
DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a content editor could inject scripts in module headers/footers that would run for other users. Versions 9.13.10 and 10.2.0 contain a fix for the issue.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: dnnsoftware
product: Dnn.Platform
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2026-01-27T23:47:41.846Z
CVE-2026-24785 Clatter has a PSK Validity Rule Violation issue
Clatter is a no_std compatible, pure Rust implementation of the Noise protocol framework with post-quantum support. Versiosn prior to2.2.0 have a protocol compliance vulnerability. The library allowed post-quantum handshake patterns that violated the PSK validity rule (Noise Protocol Framework Section 9.3). This could allow PSK-derived keys to be used for encryption without proper randomization by self-chosen ephemeral randomness, weakening security guarantees and potentially allowing catastrophic key reuse. Affected default patterns include `noise_pqkk_psk0`, `noise_pqkn_psk0`, `noise_pqnk_psk0`, `noise_pqnn_psk0``, and some hybrid variants. Users of these patterns may have been using handshakes that do not meet the intended security properties. The issue is fully patched and released in Clatter v2.2.0. The fixed version includes runtime checks to detect offending handshake patterns. As a workaround, avoid using offending `*_psk0` variants of post-quantum patterns. Review custom handshake patterns carefully.
Problem types: cwe_id: CWE-327
description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: jmlepisto
product: clatter
Published: 2026-01-27T23:38:53.409Z
CVE-2026-24788 
RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.
Problem types: cwe_id: CWE-78
description: Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected products: vendor: RaspAP
product: raspap-webgui
Published: 2026-02-02T04:37:03.392Z
CVE-2026-24789 ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function
An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: ZLAN Information Technology Co.
product: ZLAN5143D
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Shorabh Karir and Deepak Singh of KPMG reported these vulnerabilities to CISA
Published: 2026-02-11T16:17:19.702Z
CVE-2026-24790 Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller Missing Authentication for Critical Function
The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: Welker
product: OdorEyes EcoSystem Pulse Bypass System with XL4 Controller
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
version: 3.1
Credits: lang: en
value: A project sponsored by DHS S&T reported this vulnerability to CISA.
Published: 2026-02-20T16:15:21.374Z
CVE-2026-24792 web_webview has a Race Condition vulnerability
in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.
Problem types: cwe_id: CWE-364
description: CWE-364 Signal handler race condition
Affected products: vendor: OpenHarmony
product: OpenHarmony
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Published: 2026-05-19T02:58:50.812Z
CVE-2026-24793 A heap-based buffer over-read or buffer overflow vulnerability in azerothcore/azerothcore-wotlk
Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects azerothcore-wotlk: through v4.0.0.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: azerothcore
product: azerothcore-wotlk
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:19:41.350Z
CVE-2026-24794 Chunk Unloading Security Vulnerability in CardboardPowered/cardboard
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in CardboardPowered cardboard (src/main/java/org/cardboardpowered/impl/world modules). This vulnerability is associated with program files WorldImpl.Java.

This issue affects cardboard: before 1.21.4.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: CardboardPowered
product: cardboard
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:21:22.643Z
CVE-2026-24795 An Out-of-bounds Write in CloverHackyColor/CloverBootloader
Out-of-bounds Write vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules). This vulnerability is associated with program files regcomp.C.

This issue affects CloverBootloader: before 5162.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: CloverHackyColor
product: CloverBootloader
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:23:47.447Z
CVE-2026-24796 A Out-of-bounds Read vulnerability in CloverHackyColor/CloverBootloader
Out-of-bounds Read vulnerability in CloverHackyColor CloverBootloader (MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma modules). This vulnerability is associated with program files regparse.C.

This issue affects CloverBootloader: before 5162.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: CloverHackyColor
product: CloverBootloader
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:22:20.758Z
CVE-2026-24797 An out of bounds write due to a missing bounds check in neka-nat/cupoch
Out-of-bounds Write vulnerability in neka-nat cupoch (third_party/libjpeg-turbo/libjpeg-turbo modules). This vulnerability is associated with program files tjbench.C.

This issue affects cupoch.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: neka-nat
product: cupoch
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:25:17.496Z
CVE-2026-24798 An Uninitialized stack variable vulnerability in GaijinEntertainment/DagorEngine
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in GaijinEntertainment DagorEngine (prog/3rdPartyLibs/miniupnpc modules). This vulnerability is associated with program files upnpreplyparse.C.

This issue affects DagorEngine: through dagor_2025_01_15.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: GaijinEntertainment
product: DagorEngine
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:27:10.291Z
CVE-2026-24799 A heap-based buffer over-read or buffer overflow in davisking/dlib
Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: davisking
product: dlib
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:31:36.371Z
CVE-2026-24800 A heap-based buffer over-read or buffer overflow in tildearrow/furnace
Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in tildearrow furnace (extern/zlib modules). This vulnerability is associated with program files inflate.C.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: tildearrow
product: furnace
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:33:16.882Z
CVE-2026-24801 A Potential SPA-vulnerability in Ralim/IronOS
Vulnerability in Ralim IronOS (source/Core/BSP/Pinecilv2/bl_mcu_sdk/components/ble/ble_stack/common/tinycrypt/source modules). This vulnerability is associated with program files ecc_dsa.C.

This issue affects IronOS: before v2.23-rc3.
Affected products: vendor: Ralim
product: IronOS
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:36:25.407Z
CVE-2026-24802 Buffer Overflow Vulnerability in briandilley/jsonrpc4j
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in briandilley jsonrpc4j (src/main/java/com/googlecode/jsonrpc4j modules). This vulnerability is associated with program files NoCloseOutputStream.Java.

This issue affects jsonrpc4j: through 1.6.0.
Problem types: cwe_id: CWE-835
description: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: briandilley
product: jsonrpc4j
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:38:34.944Z
CVE-2026-24803 A possible infinite loop vulnerability in coolsnowwolf/lede
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7615d/src/mt_wifi/embedded/security modules). This vulnerability is associated with program files bn_lib.C.

This issue affects lede: through r25.10.1.
Problem types: cwe_id: CWE-835
description: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: coolsnowwolf
product: lede
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:39:39.043Z
CVE-2026-24804 A infinite loop vulnerability in coolsnowwolf/lede
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7603e/src/mt7603_wifi/common modules). This vulnerability is associated with program files bn_lib.C.

This issue affects lede: through r25.10.1.
Problem types: cwe_id: CWE-835
description: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: coolsnowwolf
product: lede
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:40:19.319Z
CVE-2026-24805 Mishandles certain out-of-memory conditions in visualfc/liteide via liteidex/src/3rdparty/libvterm/src module
NULL Pointer Dereference vulnerability in visualfc liteide (liteidex/src/3rdparty/libvterm/src modules). This vulnerability is associated with program files screen.C, state.C, vterm.C.

This issue affects liteide: before x38.4.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: visualfc
product: liteide
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:41:18.867Z
CVE-2026-24806 Buffer Write Security Vulnerability in liuyueyi/quick-media
Improper Control of Generation of Code ('Code Injection') vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/png modules). This vulnerability is associated with program files PNGImageEncoder.Java.

This issue affects quick-media: before v1.0.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: liuyueyi
product: quick-media
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:42:04.802Z
CVE-2026-24807 Buffer Overflow Vulnerability in liuyueyi/quick-media
Improper Verification of Cryptographic Signature vulnerability in liuyueyi quick-media (plugins/svg-plugin/batik-codec-fix/src/main/java/org/apache/batik/ext/awt/image/codec/util modules). This vulnerability is associated with program files SeekableOutputStream.Java.

This issue affects quick-media: before v1.0.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: liuyueyi
product: quick-media
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:43:51.077Z
CVE-2026-24808 A  possible integer overflow vulnerability in RawTherapee/RawTherapee
Integer Overflow or Wraparound vulnerability in RawTherapee (rtengine modules). This vulnerability is associated with program files dcraw.Cc.

This issue affects RawTherapee: through 5.11.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: RawTherapee
product: RawTherapee
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:44:58.065Z
CVE-2026-24809 Save stack space while handling errors in praydog/REFramework
An issue from the component luaG_runerror in dependencies/lua/src/ldebug.c in praydog/REFramework version before 1.5.5 leads to a heap-buffer overflow when a recursive error occurs.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: praydog
product: REFramework
default_status: unaffected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:46:04.413Z
CVE-2026-24810 A buffer overflow in rethinkdb/rethinkdb
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in rethinkdb (src/cjson modules). This vulnerability is associated with program files cJSON.Cc.

This issue affects rethinkdb: through v2.4.4.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: rethinkdb
product: rethinkdb
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:47:02.459Z
CVE-2026-24811 An improper pointer arithmetic in root-project/root at builtins/zlib/inffast.c
Vulnerability in root-project root (builtins/zlib modules). This vulnerability is associated with program files inffast.C.

This issue affects root.
Affected products: vendor: root-project
product: root
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:47:52.811Z
CVE-2026-24812 An improper pointer arithmetic in root-project/root at builtins/zlib/inftrees.c
Vulnerability in root-project root (builtins/zlib modules). This vulnerability is associated with program files inftrees.C.

This issue affects root: through 6.36.00-rc1.
Affected products: vendor: root-project
product: root
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:48:31.091Z
CVE-2026-24813 A null pointer dereference in abcz316/SKRoot-linuxKernelRoot
NULL Pointer Dereference vulnerability in abcz316 SKRoot-linuxKernelRoot (testRoot/jni/utils modules). This vulnerability is associated with program files cJSON.Cpp.

This issue affects SKRoot-linuxKernelRoot.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: abcz316
product: SKRoot-linuxKernelRoot
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:49:23.869Z
CVE-2026-24814 A integer overflow in swoole/swoole-src
Integer Overflow or Wraparound vulnerability in swoole swoole-src (thirdparty/hiredis modules). This vulnerability is associated with program files sds.C.

This issue affects swoole-src: before 6.0.2.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: swoole
product: swoole-src
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-01-27T08:50:48.964Z