rootpwn

high · CVSS v3 6.3 · CVSS v4 5.3

CVE-2026-94090

JusticeRage Manalyze 1.0.0 contains a remote integer underflow in the PE::_parse_debug function that can corrupt memory or crash the parser.

Overview

JusticeRage Manalyze 1.0.0 contains a remote integer underflow in the PE::_parse_debug function that can corrupt memory or crash the parser. The flaw allows attackers to manipulate the misc.Length argument, potentially leading to denial of service or unintended data exposure. Prompt patching is essential to mitigate these risks.

Description

A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attack may be performed from remote. The patch is identified as 3e299685759f4f767088871de58c5d07f98ee382. A patch should be applied to remediate this issue.

Impact

Confidentiality: memory corruption could expose sensitive data. Integrity: altered PE parsing may lead to incorrect execution or data tampering. Availability: the flaw can cause crashes, denying service. Defenders: system administrators and security teams managing JusticeRage installations are directly impacted.

Remediation

Apply the vendor patch identified by commit 3e299685759f4f767088871de58c5d07f98ee382. If the patch is not yet available, restrict network access to the PE Parser component or disable remote PE parsing until the update is applied.

Risk context

High severity with CVSS 6.3 indicates a significant threat; immediate remediation is recommended.

Affected products

  • JusticeRage Manalyze 1.0.0

Scores

Severity
high
CVSS v2
7.5
CVSS v3
6.3
CVSS v4
5.3
EPSS
—

integer-underflow remote PE-parser high-severity patch justice-rage

← All CVEs

Related CVEs

high

CVE-2026-94110

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Router uses raw REQUEST_URI without URL decoding, so payloads must contain literal spaces - %20 never decodes before route parsing. The support team of the vendor was contacted early about this disclosure. Unfortunately, they responded just with profanity.

View analysis

high

CVE-2026-93974

CVE-2026-93974 details a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The vulnerability exists within the `/reviewer_0/admins/assessments/databank/btn_functions.php` file, specifically affecting the `ID` argument. Publicly available exploit code increases the risk of remote compromise.

View analysis

high

CVE-2026-88855

The OrdaSoft Joomla Gallery extension (v<6.2.7) contains an authenticated, privileged SQL injection that allows a core.manage user to read and write the database, including extracting user password hashes. This flaw arises from unsanitized form data being concatenated into SQL queries. It enables attackers with gallery‑management rights to compromise the entire site’s data integrity and confidentiality.

View analysis

high

CVE-2026-94093

A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util.py. Such manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. In v2.9.0 the PyTorch tensor load path is hardened (weights_only=True), but that hardening was later reverted on master via PR #1913 "Hotfix: revert loading with weights_only=True" [blocked] to fix PyTorch 1.13 compat - so even the one "safe" path is inconsistent across versions. #2281 was closed as a duplicate of #1831 since both are unsafe pickle deserialization - but #1831's fix (PR #41) only gated the Hugging Face Hub loader in the separate huggingface_sb3 package. This finding covers the core stable_baselines3 load APIs (PPO.load, load_replay_buffer, VecNormalize.load), which have no safe mode or gate and remained exploitable in v2.9.0 until the outstanding hardening (PR #2264) ships.

View analysis