CVE-2026-66079: Allocation of Resources Without Limits or Throttling

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parsearrayprimitive/2 for constructor 0x45 list0 returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consumin...

CVE-2026-66072: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw client-supplied property from post-auth subscribe and resolveoffsetspec frames, with no whitelist and no existing guard. An authenticated...

PT-2026-97566

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.2.7 RabbitMQ versions prior to 4.3.1 Description An authenticated AMQP 0-9-1 client can crash the Erlang VM, affecting all vhosts and connections, by sending approximately 1 million requests. The issue occurs when...

CVE-2026-67228: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbitdatacoercion:toatom/1 in lookupcomponent/1 deps/rabbit/src/rabbitruntimeparameters.erl, creating a new atom for any previous...

PT-2026-105058

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbit data coercion:to atom/1 in lookup component/1 deps/rabbit/src/rabbit runtime parameters.erl, creating a new atom for any...

Malicious Package

Overview @httttt/mcp-npx-fetch-1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

CLSA-2026-1790089638 TuxCare security update for org.springframework (33 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 33 CVEs. Fixed in 5.3.9-tuxcare.1...

org.bouncycastle/bc-java: org.bouncycastle/bc-lts-java: Bouncy Castle for Java: Cryptographic signature bypass in RSA PKCS#1 verification

A flaw was found in Bouncy Castle for Java. During the RSA PKCS1 verification process, the last two hash bytes are incorrectly skipped when a NULL-omitted path is utilized. This vulnerability could allow an attacker to bypass cryptographic signature verification, potentially leading to the...

OPENSUSE-SU-2026:21909-1 Security update for libXrender

This update for libXrender fixes the following issue: - CVE-2026-88807: RenderQueryPictFormats Reply Heap-based Buffer Overflow bsc1280911...

EUVD-2026-84356

LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they...

CVE-2026-63276

LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they...

CLSA-2026-1790070671 TuxCare security update for org.springframework (32 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 32 CVEs. Fixed in 5.3.33-tuxcare.1...

CLSA-2026-1790068772 TuxCare security update for org.springframework (36 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 36 CVEs. Fixed in 6.1.18-tuxcare.1...

CVE-2026-65634 Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

PT-2026-96705

Name of the Vulnerable Software and Affected Versions LibreOffice affected versions not specified Description A stack buffer overflow occurs during the conversion of CFF fonts to Type 1 fonts, a process that takes place when a document is exported to PDF and CFF fonts are embedded. The issue aris...

Linux Distros Unpatched Vulnerability : CVE-2026-67549

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: shim (UTSA-2023-001491)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001491 advisory. ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field holding the buffer...

CVE-2026-63276: Out-of-bounds Write

LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixed size buffer with no check that they...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gnupg2 (UTSA-2026-090063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090063 advisory. A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forge...

Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8800-1)

"The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8800-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws i...