PT-2026-40816

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw in the XFRM ESP-in-TCP subsystem of the Linux kernel allows a low-privileged local attacker to write arbitrary bytes into the page cache of read-only files, including sensitive...

ImageMagick ClonePixelCacheRepository Buffer Overflow DoS

The vulnerability of the ClonePixelCacheRepository function in the magick/cache.c component of the ImageMagick console graphics editor is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause a service failure through the use of a specially create...

freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId

A heap based buffer overflow flaw has been discovered in FreeRDP. This client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmapcacheput. A malicious server can send a CACHEBITMAPORDER Rev1 with cacheId equal to maxCells,...

freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId

A heap based buffer overflow flaw has been discovered in FreeRDP. This client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmapcacheput. A malicious server can send a CACHEBITMAPORDER Rev1 with cacheId equal to maxCells,...

CVE-2026-44241

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap whose key is derived from the...

CVE-2026-44241 Micronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language Header

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap whose key is derived from the...

CVE-2026-44241 Micronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language Header

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, 3.10.6, and 3.8.14, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap whose key is derived from the...

CVE-2026-44241

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. From 4.3.0 to before 4.10.22, TimeConverterRegistrar caches DateTimeFormatter instances in an unbounded ConcurrentHashMap whose key is derived from the @Format annotation...

CVE-2026-44241

Summary of CVE-2026-44241 (Micronaut Framework) Affected: Micronaut Core versions 4.3.0–4.10.21 (fixed in 4.10.22). A cache in TimeConverterRegistrar stores DateTimeFormatter instances in an unbounded ConcurrentHashMap keyed by pattern+Locale derived from the @Format annotation and the HTTP Accep...

CVE-2026-44242 Micronaut Framework: Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language Header

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by Locale, baseName where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a...

CVE-2026-44242

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Prior to 4.10.22, the bundleCache is keyed by Locale, baseName where the locale originates from the HTTP Accept-Language header. In applications that explicitly register a...

Embedded Malicious Code

@tanstack/ packages are vulnerable to Embedded Malicious Code. The vulnerability is due to misconfigured GitHub Actions workflows and cache poisoning weaknesses that allowed attackers to extract OIDC tokens and publish malicious package versions under a trusted identity...

CVE-2026-2291

A heap buffer overflow was discovered in dnsmasq's DNS cache. When processing DNS responses, dnsmasq expands certain characters into longer escape sequences, but the cache buffer is not sized to hold the expanded result. A specially crafted DNS response can overflow this buffer, potentially...

x86: CPU Opcode Cache corruption

ISSUE DESCRIPTION AMD have disclosed a potential vulnerability in certain CPUs which can cause instructions to execute at a higher privilege. For more information, see: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7052.html IMPACT Code of any privilege could escalate to a...

Next.js _rsc weak cache-busting hash collision (CVE-2026-44582)

Reimplements the legacy 32-bit FNV-style mix and runs a birthday search for a colliding state-tree, next-url tuple. Optional HTTP GET with RSC prefetch headers can probe CDN cache behaviour. CPU-heavy; patched Next.js uses a stronger mix = 16.2.5. !/usr/bin/env python3 -- coding: utf-8 -- import...

Next.js x-nextjs-data redirect cache poisoning (GHSA-3g8h) detection

Fingerprints Next.js and flags versions 16.2.5 affected by GHSA-3g8h-86w9-wvmq x-nextjs-data redirect cache poisoning. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionsc...

Next.js RSC / HTML cache poisoning (GHSA-wfc6-r584-vfw7)

Three GETs on the same URL: baseline, then with loose RSC + Next-Router-Prefetch, then clean again. Pre-16.2.5 stacks may mis-classify Flight as text/html so CDNs cache RSC bytes under an HTML content-type key. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Next.js Next-Resume DoS / cache-poisoning (GHSA-mg66-mrh9-m8jx)

POST a large text/plain JSON-shaped body with next-resume: 1 and x-next-resume-state-length: 1 to a PPR page. Pre-16.2.5 the renderer may accept the header and spend CPU/memory on resume. Builds a multi‑MiB body client-side — use only on systems you own. !/usr/bin/env python3 -- coding: utf-8 --...

Next.js x-nextjs-data redirect cache poisoning (GHSA-3g8h-86w9-wvmq)

Compares GET responses on a redirecting route with and without x-nextjs-data: 1. Pre-16.2.5 Next.js may return 2xx + x-nextjs-redirect without Location, breaking browsers and poisoning shared caches. Patched stacks keep a normal 3xx + Location. !/usr/bin/env python3 -- coding: utf-8 -- from...

Next.js _rsc weak hash collision (CVE-2026-44582) detection

Fingerprints Next.js and flags versions 16.2.5 affected by CVE-2026-44582 weak rsc cache-busting hash. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.nextjsprobe import runnextjsversionscan class...