CVE-2026-15551

MediumCVSS 5.5/10Last modified Oct 24, 2026

Description

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Overflow Buffers.

This issue affects .

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-190

Affected software

VendorProductVersions
Samsung Open Sourcerlottie—

References

Timeline

Published
Jul 13, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-155526.1Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to iCVE-2026-155535.3Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload CVE-2026-155547.4the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enablesCVE-2026-155558.8A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss MarshallinCVE-2026-155568.1A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check caCVE-2026-155577.3A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthCVE-2026-155586.3A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown fuCVE-2026-155596.3A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLCVE-2026-15566.5Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allowsCVE-2026-155608.1when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, alCVE-2026-155617.5A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unaCVE-2026-155627.5A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade
CVE-2026-15551: Medium severity, CVSS 5.5 | Vulnix