CVE Watch8 de out. de 2026

CVE-2019-8720

WebKitGTK Memory Corruption Vulnerability

CVSS

8.8

Alta

EPSS

1.6%

p75

KEV

SIM

23 de mai. de 2022

Exploit Today

0-100

Publicado: 6 de mar. de 2023 · Última mod.: 8 de out. de 2026 · CWE-119

EPSS · 30d

1.6%EPSS · 30 dias1.6%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

WebKitGTK / WebKitGTK

Vulnerabilidade

WebKitGTK Memory Corruption Vulnerability

Adicionado ao KEV

23 de mai. de 2022

Corrigir até

13 de jun. de 2022

Uso conhecido em ransomware

Não

Descrição resumida

WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.

Ação necessária

Apply updates per vendor instructions.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2019-8720

Descrição técnica

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1232693.3 BAI

—

———A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_header of the file libvmdk/libvmdk_descriptor_file.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. The patch is identified as 175d3fc0a0b961f362f16e7560a6169d7213e16b. It is best practice to apply a patch to resolve this issue.2h CVE-2026-1232683.5 BAI

—

———A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdk_extent_table_get_extent_data_file_path of the file libvmdk/libvmdk_extent_table.c of the component Extent Data File Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 175d3fc0a0b961f362f16e7560a6169d7213e16b. Applying a patch is the recommended action to fix this issue.2h CVE-2026-1221896.3 MÉD

15.4%

——5A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.6h CVE-2026-1221467.3 ALT

22.1%

——7A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes memory corruption. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.6h CVE-2026-1216177.5 ALT

40.8%

——12A security flaw has been discovered in Linksys E5600 1.1.0.26. Affected by this issue is the function init_multipart of the file /cgi-bin/upload_fw.cgi of the component Header Parser. The manipulation results in out-of-bounds write. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.2d CVE-2026-1216165.3 MÉD

23.0%

——7A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/mesh_login.cgi of the component JSON Request Parser. The manipulation of the argument username/password/token/source/cn/action leads to out-of-bounds write. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.2d