CVE-2026-65796 Windows iSCSI Target Service Remote Code Execution Vulnerability

...

CVE-2026-73089 Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct queries, context result in cache and every parseQueries AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who...

CVE-2026-62702 Windows Graphics Kernel Denial of Service Vulnerability

...

CVE-2026-61345

CVE-2026-61345: A null pointer dereference in the Microsoft Remote Registry Service can allow an authenticated network attacker to cause Denial of Service. CVSSv3.1 base score 6.5 (NETWORK, LOW complexity, LOW privileges, NO user interaction, Availability Impact HIGH). Affected component: Microso...

CVE-2026-73088 Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats in node.js, reached unconditionally through getStat and loadStat on every browserslist call, processes untrusted browserslist-stats.json, opts.stats, and...

CVE-2026-73088

CVE-2026-73088 affects Browserslist prior to version 4.28.7. The issue arises in normalizeStats() where, on every browserslist() call, untrusted data from browserslist-stats.json, opts.stats, and CLI --stats is processed via an unguarded for...in loop and plain-object bracket access, allowing inh...

EUVD-2026-56274

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not requir...

CVE-2026-70639

A flaw was found in llama.cpp. A null pointer dereference vulnerability exists in the LLaMA-Android JNI wrapper. This flaw allows an attacker to provide a malicious or corrupt model file, which causes the bench1model function to attempt to use an invalid memory address. This leads to a crash of t...

CVE-2026-68291

A flaw was found in the Linux kernel's idpf driver. During initialization, if memory allocation for virtual port vport related buffers fails, the driver may attempt to access a null pointer when the module is removed or the system is reset. This can lead to a kernel null pointer dereference,...

netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the DelegatingDecompressorFrameListener class. This resource leak could lead to an Out Of Memory Error OOME, potentially causing a Denial of Service DoS by taking down th...

CVE-2026-48375

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user...

CVE-2026-18638

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-73074

Vim is an open source, command line text editor. Prior to 9.2.0841, propaddone in src/textprop.c uses the proplen value from gettextprops to increment a uint16t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for non...

CVE-2026-68336

A flaw was found in the Linux kernel's bonding module. When a system is booted with IPv6 disabled, the bonding module incorrectly attempts to send IPv6 Network Service NS packets. This leads to a null pointer dereference, which is an attempt to access uninitialized memory. The consequence of this...

CVE-2026-68261

A flaw was found in the Linux kernel's drm/imagination component. A local user could exploit this vulnerability by passing an invalid virtual machine VM context handle to the DRMIOCTLPVRCREATECONTEXT ioctl. This improper error checking can lead to a kernel crash, resulting in a Denial of Service...

CVE-2026-34502

A flaw was found in the memcached client in the Apache Portable Runtime Utility apr-util. A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of...

UBUNTU-CVE-2026-73067

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::readsquisheddawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls numforwardedges0 and lastedge in...

EUVD-2026-56185

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-18638 Velociraptor server crash via the SetPassword API

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-18638 Velociraptor server crash via the SetPassword API

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...