93678 matches found
CVE-2026-97918
A flaw was found in the Linux kernel's tracing subsystem. When enabling a histogram event trigger fails, improper registration cleanup can leave an already freed trigger referenced on an internal tracking list. A local attacker with permission to configure event tracing could exploit this flaw to...
CVE-2026-97917
A flaw was found in the Linux kernel's Intel Versatile Processing Unit ivpu accelerator driver. A local user could trigger an out-of-bounds memory access by supplying an address range that extends beyond the allocated buffer object boundaries. This issue can lead to memory corruption or a system...
CVE-2026-97473
A flaw was found in the Linux kernel's Intel Running Average Power Limit RAPL power capping driver. When CPU package or die identification fails during processor initialization, the driver fails to release allocated memory on the error return path. Over time, repeated addition failures can cause...
NPM: Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
NPM: Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS vulnerability discovered by ? in WordPress Npm nodemailer versions 10.0.2...
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | nodemailer | | Repository | https://github.com/nodemailer/nodemailer | | Tested commit | 40d52215aac65b811d7e131bc916f68605efd9d2 | | Current tested version | 10.0.1 | | Confirmed vulnerable versions | 2.7.2, 3.0.0,...
GHSA-8VVX-RFF5-P5RQ Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | nodemailer | | Repository | https://github.com/nodemailer/nodemailer | | Tested commit | 40d52215aac65b811d7e131bc916f68605efd9d2 | | Current tested version | 10.0.1 | | Confirmed vulnerable versions | 2.7.2, 3.0.0,...
CVE-2026-102822 russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needsmac only when MAC selection fails. A remote peer can then send a packet with a...
CVE-2026-102822
The russh Rust SSH client and server library is vulnerable to a slice-index-out-of-range panic in versions prior to 0.63.1 . The root cause is a flaw in the selection logic where a connection configured to permit mac=none can incorrectly negotiate a MAC-requiring CTR or CBC block cipher. An attac...
CVE-2026-102822 russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needsmac only when MAC selection fails. A remote peer can then send a packet with a...
CVE-2026-97912
A flaw was found in the Linux kernel's Arm Ethos-U accelerator driver. When the mapping of Static Random-Access Memory SRAM fails during device initialization, the driver fails to reset the memory size to zero. Consequently, a local user can submit processing jobs that access physical address zer...
CVE-2026-97910
A flaw was found in the Linux kernel. The Spreadtrum audio driver fails to validate buffer size parameters against fixed physical memory allocations during compressed audio stream operations. A local attacker with access to the audio device can supply oversized buffer configurations to trigger an...
Uncontrolled Resource Consumption
Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unrestricted reading of Content Security Policy violation reports into memory, which allows an unauthenticated attacker to submit an oversized report and exhaust the application's heap, causing a...
EUVD-2026-71636
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol...
CVE-2026-102821
The Russh Rust SSH library (prior to version 0.63.2 ) is vulnerable to unbounded memory exhaustion during a client-stalled rekey. An authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and flood SSH_MSG_CHANNEL_OPEN messages. Because SessionKexState::InPr...
EUVD-2026-71634
undici vulnerable to Denial of Service via unbounded decompression of compressed responses...
CVE-2026-102809
PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight...
CVE-2026-102714
nxicmpv6validateoptions scans the option area with while length 2 common/src/nxicmpv6validateoptions.c:79. An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns NXSUCCESS. Its zero-length rejection never...
CVE-2026-102716
An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests that carry a Session header the parser cannot convert. The Session branch returns the raw NetX error code instead of an RTSP status code: c / addons/rtsp/nxrtspserver.c:2754 / status =...
CVE-2026-102710
Attacker model / Preconditions: a loaded TXMMODULEUSERMODE | TXMMODULEMEMORYPROTECTION module issuing kernel dispatch calls, on a build with TXENABLEEVENTTRACE. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it...