EUVD-2026-85363

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all...

CVE-2026-96609

Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fil...

gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders

A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP...

cve-2019-0708

CVE-2019-0708 Este módulo comprueba un rango de hosts en busca de la vulnerabilidad CVE-2019-0708 vinculando el canal MST120 fuera de su ranura normal y enviando paquetes de denegación de servicio DoS. Simplemente modifiqué el módulo original de Metasploit para esta vulnerabilidad para producir u...

CVE-2026-93136

A flaw was found in the Linux kernel's Mobile Host Interface MHI endpoint driver. An issue in the error handling path during MHI device creation can lead to a resource leak. Specifically, if certain device setup operations fail, not all allocated device references are properly released. This can...

CVE-2026-93130

A flaw was found in the Linux kernel's dell-wmi-base module, which handles system management functions for Dell hardware. This vulnerability is a resource leak, meaning that system resources are not properly released after use. When the dell-wmi-base module fails to load, it does not correctly...

CVE-2026-93116

A flaw was found in the asus-wmi driver of the Linux kernel. During driver initialization, an error handling issue can lead to resource leaks. This occurs because cleanup calls for previously registered subsystems are bypassed when certain initialization functions fail. A local attacker could...

CVE-2026-92494

A flaw was found in the Linux kernel's ext4 filesystem. When handling orphan file blocks, the system may fail to properly release memory resources if block validation checks fail. This memory leak could lead to resource exhaustion over time, potentially resulting in a Denial of Service DoS for th...

CVE-2026-89944

A flaw was found in the Linux kernel's Audio System on Chip ASoC High Definition Audio Codec hdachda component. During the device probing process, a reference to an HDA link is acquired but not properly released if the ASoC component registration fails. This oversight leads to a reference count...

CVE-2026-89925

A flaw was found in KVM's guest debug handling within the Linux kernel. A local user, by repeatedly calling KVMSETGUESTDEBUG, can trigger a memory leak. This occurs because the bpdata is not freed after a successful debug operation. Over time, this can lead to resource exhaustion and a Denial of...

CVE-2026-89872

A flaw was found in the Linux kernel's v4l2-fwnode media subsystem. A local attacker or a malicious application could exploit this by failing to properly release a fwnode reference in the v4l2fwnodeparselink function. This resource leak could lead to system instability or a denial of service DoS,...

CVE-2026-89862

A flaw was found in the Linux kernel's qla2xxx SCSI driver. A local attacker could exploit this vulnerability by triggering an error in the qla28xxvalidateflashimage function. Due to incorrect error handling, Block SCSI Generic BSG jobs are not properly completed, causing them to remain active an...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

EUVD-2026-85307

Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fil...

CVE-2026-96609

Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fil...

EUVD-2026-84182

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service...

Security Bulletin: Multiple Vulnerabilities affect VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service

Summary Multiple vulnerabilities have been addressed in components of VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network...

CVE-2026-86243

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are...

CVE-2026-86243 Apache Tomcat Native: DoS via TLS handshake

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are...

Fixed in Apache Tomcat Native Connector 2.0.16 / 1.3.9

Important: Client certificate requirements can be down-graded CVE-2026-86247 A race condition allowed client certificate verification requirements to be down-graded for some configurations. This was fixed with commit fb688de4 2.0.x and 3dc73c11 1.3.x. This issue was reported to the Tomcat securit...