IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.8 DoS (7280126)

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a DoS vulnerability as referenced in the 7280126 advisory. - IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:3165-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3165-1 advisory. This update for php7 fixes the following issue - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HAProxyMessageDecoder. An attacker can cause unbounded memory allocation by sending a specially crafted PROXY protocol v2 binary prefix with a version byte of 0xFF, which...

CVE-2026-63991

A flaw was found in the Linux kernel's Bluetooth 6lowpan module. This vulnerability occurs because the sendmcastpkt function does not properly check the return value of skbclone, which can be null if memory allocation fails. An attacker could exploit this by triggering a scenario where skbclone...

CVE-2026-63260 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this...

CVE-2026-65315

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a Resource Allocation Vulnerability in Netty (CVE-2026-45416)

Summary Netty is used by IBM UrbanCode Deploy UCD for network communication. CVE-2026-45416. Vulnerability Details CVEID:CVE-2026-45416 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,...

EUVD-2026-46387

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive...

CVE-2026-10678

The CVE-2026-10678 issue affects Zephyr’s MCTP over I2C+GPIO target binding (mctp_i2c_gpio_target.c). It processes I2C bus master writes byte-by-byte without validating the receive buffer, dereferencing b-&gt;rx_pkt to write data for data registers (MCTP_I2C_GPIO_RX_MSG_ADDR) before the receive b...

EUVD-2026-46447

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctpi2cgpiotarget.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctpi2cgpiotargetwritereceived without validating the order or the receive buffer. In the affected versions the MCTPI2CGPIORXMSGADDR data...

CVE-2026-65315 Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

CVE-2026-65315 Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

CVE-2026-65315

Technical details about CVE-2026-65315 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-47714 libheif has integer overflow in inline mask size calculation that causes undersized buffer allocation

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in libheif/region.cc contains an integer overflow. Both width and height are unsigned int 32-bit values parsed from the HEIF file. Their product can exceed UINT32MAX, wrapping to...

DEBIAN-CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

EUVD-2026-46402

The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...

CVE-2026-47667 CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

CVE-2026-47667

CVE-2026-47667 affects the CImg Library prior to 4.0.0. In _load_analyze(), header_size is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI header and passed directly to new unsigned char[header_size] without bounding to the actual file size. Values up to ~4 GB are accepted; if ...

CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

CVE-2026-63878

A flaw was found in the drm/amdgpu component of the Linux kernel. A local attacker can exploit an integer overflow vulnerability by providing an excessively large value for the numentries parameter in the GEMOP GETMAPPINGINFO ioctl. This can lead to an attempt to allocate an extremely large amoun...