VulDB Recent Entries

A vulnerability classified as problematic has been found in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. This vulnerability is tracked as CVE-2026-3392. The attack is restricted to local execution. Moreover, an exploit is present. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability described as problematic has been identified in FascinatedBox lily up to 2.3. Impacted is the function clear_storages of the file src/lily_emitter.c. The manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2026-3391. The attack is only possible with local access. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability marked as problematic has been reported in FascinatedBox lily up to 2.3. This issue affects the function patch_line_end of the file src/lily_build_error.c of the component Error Reporting. The manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-3390. The attack can only be performed from a local environment. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability labeled as problematic has been found in Squirrel up to 3.2. This vulnerability affects the function sqstd_rex_newnode in the library sqstdlib/sqstdrex.cpp. Executing a manipulation can lead to null pointer dereference. The identification of this vulnerability is CVE-2026-3389. The attack can only be executed locally. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability identified as problematic has been detected in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp. Performing a manipulation results in uncontrolled recursion. This vulnerability was named CVE-2026-3388. The attack needs to be approached locally. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability categorized as problematic has been discovered in wren-lang wren up to 0.4.0. Affected by this issue is the function getByteCountForArguments of the file src/vm/wren_compiler.c. Such manipulation leads to null pointer dereference. This vulnerability is uniquely identified as CVE-2026-3387. Local access is required to approach this attack. Moreover, an exploit is present. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in wren-lang wren up to 0.4.0. It has been rated as problematic. Affected by this vulnerability is the function emitOp of the file src/vm/wren_compiler.c. This manipulation causes out-of-bounds read. This vulnerability is handled as CVE-2026-3386. It is possible to launch the attack on the local host. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in wren-lang wren up to 0.4.0. It has been declared as problematic. Affected is the function resolveLocal of the file src/vm/wren_compiler.c. The manipulation results in uncontrolled recursion. This vulnerability is known as CVE-2026-3385. Attacking locally is a requirement. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in ChaiScript up to 6.1.0. It has been classified as problematic. This impacts the function chaiscript::eval::AST_Node_Impl::eval/chaiscript::eval::Function_Push_Pop of the file include/chaiscript/language/chaiscript_eval.hpp. The manipulation leads to uncontrolled recursion. This vulnerability is traded as CVE-2026-3384. An attack has to be approached locally. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in ChaiScript up to 6.1.0 and classified as problematic. This affects the function chaiscript::Boxed_Number::go of the file include/chaiscript/dispatchkit/boxed_number.hpp. Executing a manipulation can lead to divide by zero. This vulnerability appears as CVE-2026-3383. The attack requires local access. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in ChaiScript up to 6.1.0 and classified as problematic. The impacted element is the function chaiscript::Boxed_Number::get_as of the file include/chaiscript/dispatchkit/boxed_number.hpp. Performing a manipulation results in memory corruption. This vulnerability is reported as CVE-2026-3382. The attack requires a local approach. Moreover, an exploit is present. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability, which was classified as problematic, was found in Microchip TimePictra up to 11.3 SP2. The affected element is an unknown function. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-3010. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as critical, has been found in Microchip TimePictra up to 11.3 SP2. Impacted is an unknown function of the component Configuration Handler. This manipulation causes missing authentication. This vulnerability is registered as CVE-2026-2844. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability classified as critical was found in Tenda F453 1.0.0.3. This issue affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page results in buffer overflow. This vulnerability is cataloged as CVE-2026-3380. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability classified as critical has been found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page leads to buffer overflow. This vulnerability is listed as CVE-2026-3379. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability described as critical has been identified in Tenda F453 1.0.0.3. This affects the function fromqossetting of the file /goform/qossetting. Executing a manipulation of the argument qos can lead to buffer overflow. This vulnerability is tracked as CVE-2026-3378. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability marked as critical has been reported in Tenda F453 1.0.0.3. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Performing a manipulation of the argument page results in buffer overflow. This vulnerability is identified as CVE-2026-3377. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability labeled as critical has been found in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromSafeMacFilter of the file /goform/SafeMacFilter. Such manipulation of the argument page leads to buffer overflow. This vulnerability is referenced as CVE-2026-3376. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability identified as critical has been detected in Super Stage WP Plugin up to 1.0.1 on WordPress. Affected is an unknown function of the component Gadget Handler. This manipulation causes deserialization. The identification of this vulnerability is CVE-2026-1542. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability categorized as critical has been discovered in Statamic CMS up to 5.73.10/6.3.x. This impacts an unknown function. The manipulation results in server-side request forgery. This vulnerability was named CVE-2026-28423. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.