Fantasy_2026

**Name of the Vulnerable Software and Affected Versions** TrailDB version 0.6 **Description** An out-of-bounds read can be triggered remotely within the TOC Validation component. The issue resides in the `tdb open()` function located in the `/src/tdb.c` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** boazsegev facil.io versions prior to 0.7.59 **Description** A path traversal flaw exists in the Public Folder Handler component within the `http sendfile2()` function of the `lib/facil/http/http.c` file. This issue allows remote attackers to perform manipulations that lead to unauthorized access to files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `http sendfile2()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** boazsegev facil.io versions prior to 0.7.5 **Description** Improper input validation occurs in the WebSocket Frame Parser component within the library `lib/facil/http/parsers/websocket parser.h`. The issue resides in the `websocket on protocol error()` function, where manipulation of the `on message` argument allows for a remote attack. **Recommendations** As a temporary workaround, restrict access to the `websocket on protocol error()` function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 26.03-DEV-rev342-g80071f700-master **Description** A local issue exists in the TeXML File Handler component within the `txtin probe duration()` function of the `src/filters/load text.c` file. Manipulation of the `txml timescale` argument can lead to a divide by zero condition. **Recommendations** Apply patch 86a5191f2e750c767253e27ed6cfd6d547afebc2 to version 26.03-DEV-rev342-g80071f700-master.

**Name of the Vulnerable Software and Affected Versions** GPAC version 26.03-DEV **Description** An issue exists in the MP4Box component within the `vobsub read idx()` function of the `/src/media tools/vobsub.c` file. A local attacker can trigger an out-of-bounds read by manipulating the `num langs` argument. An out-of-bounds read occurs when a program reads data past the end of the intended buffer, potentially exposing sensitive information from memory. **Recommendations** Apply the patch 532097084729a936bcdf6a27c41003f3bd7dc3ff to version 26.03-DEV.