CVE-2026-16243

UNKNOWN

Published 2026-07-21 · Updated 2026-07-22 · Source emo@eclipse.org

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.

CWE-125

Same severity, most recent

CVE-2026-64798
Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
2026-07-22 · score —
CVE-2026-64797
IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.
2026-07-22 · score —
CVE-2026-64796
Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.
2026-07-22 · score —
CVE-2026-64795
Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.
2026-07-22 · score —
CVE-2026-64794
User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details.
2026-07-22 · score —