kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

A flaw was found in the vmxnet3 virtual network device driver within the Linux kernel. When processing Geneve-encapsulated packets, the vmxnet3gethdrlen function can incorrectly interpret header information, leading to a mismatch between expected and actual packet protocols or IP versions. This c...

kernel: net/liquidio: drop cached VF pci_dev LUT

A flaw was found in the net/liquidio component of the Linux kernel. The Single Root I/O Virtualization SR-IOV enable path incorrectly cached Virtual Function VF pcidev pointers. This improper handling of references could lead to a use-after-free vulnerability when the cached pointer is later...

CVE-2026-101276

iperf3 3.21 esnet/iperf contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog servertimerproc frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperfstream; fixed in 3.22...

CVE-2026-101276

The iperf3 network testing tool (version 3.21 ) is vulnerable to a remote, unauthenticated heap use-after-free flaw. The issue occurs because the server's per-test watchdog function, server_timer_proc(), frees streams without properly cancelling or joining their associated worker threads. Consequ...

CVE-2026-101276

iperf3 3.21 esnet/iperf contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog servertimerproc frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed iperfstream; fixed in 3.22...

CLEANSTART-2026-MR47153 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

CVE-2026-42504 affects multiple packages. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

CLEANSTART-2026-PI24714 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Security vulnerability affects the crane package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CVE-2026-102110 Missing authentication on a Kiteworks appliance setup function

An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disru...

CLEANSTART-2026-TQ18292 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

Security vulnerability affects the crane package. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

DEBIAN-CVE-2026-102994

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/reader.py and pypdf/generic/base.py to scan excessive input through...

CVE-2026-102994

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/reader.py and pypdf/generic/base.py to scan excessive input through...

CVE-2026-102993

pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/pagelabels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of...

DEBIAN-CVE-2026-102993

pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/pagelabels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of...

DEBIAN-CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-101881

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...

CVE-2026-102994

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/reader.py and pypdf/generic/base.py to scan excessive input through...

CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

UBUNTU-CVE-2026-102993

pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/pagelabels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of...

UBUNTU-CVE-2026-102994

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/reader.py and pypdf/generic/base.py to scan excessive input through...