PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Summary CVE-2026-48524 GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values DoS" was fixed in 2.13.0 by stopping fetchdata from clearing the cache on a fetch error. That closed one amplification path but did not add the mitigation the advisory's...

GHSA-2GX3-RCP4-G85Q PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

Summary CVE-2026-48524 GHSA-fhv5-28vv-h8m8, "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values DoS" was fixed in 2.13.0 by stopping fetchdata from clearing the cache on a fetch error. That closed one amplification path but did not add the mitigation the advisory's...

NPM: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

NPM: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process DoS vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

Summary Denial of Service in adm-zip's async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file. Details Affected package: adm-zip Affected versions: at least 0.6.0 current latest; likely all versions containing t...

CVE-2026-86104

A vulnerability in the Fireware OS login process (wgagent ) allows a remote, unauthenticated attacker to cause a denial of service . The root cause is an uncontrolled resource consumption issue triggered by sending a specially crafted request. No specific affected versions, remediation details, o...

CVE-2026-18105 Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-90441

The Fireware OS is affected by a missing authorization vulnerability in the wgagent management daemon's session initialization function. An authenticated, low-privileged user—such as a guest or read-only administrator—can submit a specially crafted management API request to crash the wgagent proc...

CVE-2026-18105 Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-86128 Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service

A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet...

CVE-2026-81433 Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution

A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon fingerd allows an unauthenticated attacker with adjacent network access to execute arbitrary code or crash the process by sending a specially crafted DHCP packet...

CVE-2026-86132

A pre-authentication integer underflow vulnerability exists in the WatchGuard Fireware OS IKEv2 daemon (iked ). This flaw allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by crashing the process. The attack is triggered by sending a specially crafted encrypted IKEv2 me...

CVE-2026-18145

The WatchGuard Fireware OS contains a stack-based buffer overflow vulnerability within the spamBlocker (spamd) service. An authenticated attacker possessing administrator privileges can exploit this flaw by sending a specially crafted management request. Successful exploitation could result in a ...

CVE-2026-86132 Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service

An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon iked allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite...

CVE-2026-97950

A flaw was found in the Linux kernel's configfs filesystem. A local user could exploit a race condition between creating a symbolic link and deleting its target directory to cause a Denial of Service DoS. When this race condition occurs, the kernel attempts to access a freed directory entry, whic...

CVE-2026-97949

A flaw was found in the Linux kernel's configfs filesystem. A race condition between directory removal and symbolic link creation can result in a use-after-free vulnerability, where the system attempts to access memory after it has been released. A local user can exploit this flaw by concurrently...

CVE-2026-102621

A flaw was found in poppler. An integer overflow vulnerability exists in the SplashClip rendering component when handling path clipping operations. A local attacker could exploit this flaw by providing specially crafted input, causing the application to crash and resulting in a Denial of Service...

CVE-2026-97947

A flaw was found in the Linux kernel's x86 AMD node component, which may lead to a Denial of Service DoS. If initialization of the AMD System Management Network SMN interface fails, exported read and write functions remain accessible without validating that internal device structures were...

CVE-2026-97946

A flaw was found in the Linux kernel. Improper reference counting during AMD PCI root device initialization and caching in the amdsmninit function fails to properly track device lifecycles. Under certain conditions, this flaw may allow a local attacker to cause a Denial of Service DoS or system...

CVE-2026-74220

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

CVE-2026-74225

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6parseoptions that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the...