PT-2026-104244

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z listunifiedreceivers RPC handler, which calls expect on Sapling receiver parsing that fails for Unified Addresses carrying invalid Jubjub points. Authenticated RPC clients can submit such a...

Linux Distros Unpatched Vulnerability : CVE-2026-103678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format RTF data...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2026-52946)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid506016; scriptversion"1.2"; scriptsetattributeattribute:"pluginmodificationdate",...

Linux Distros Unpatched Vulnerability : CVE-2026-93546

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and...

Linux Distros Unpatched Vulnerability : CVE-2026-77387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.fromstring can spend excessive CPU time due to inefficient regular-expression...

RabbitMQ 4.0.x < 4.0.22 / 4.1.x < 4.1.14 / 4.2.x < 4.2.7 / 4.3.x < 4.3.1 Atom Exhaustion via Global Parameter Name

The version of RabbitMQ installed on the remote host is 4.0.x prior to 4.0.22, or 4.1.x prior to 4.1.14, or 4.2.x prior to 4.2.7, or 4.3.x prior to 4.3.1. It is, therefore, affected by a denial of service vulnerability: - resourceexists/2, and the PUT and DELETE handlers, call...

openSUSE 16: cross-aarch64-glibc-devel / cross-ppc64le-glibc-devel / etc (openSUSE-SU-2026:21968-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21968-1 advisory. - CVE-2026-6368: invalid free via wordexp WRDEAPPEND rollback bsc1274726. - CVE-2026-6791: stack overflow in wordexp tilde expansion bsc1274723....

Linux Distros Unpatched Vulnerability : CVE-2026-103679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format TNEF file...

pbkdf2 library DoS

The vulnerability in the lib/sync.js script of the pbkdf2 library on the Node.js software platform involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

openSUSE 16: gio-branding-upstream / glib2-devel / glib2-devel-static / etc (openSUSE-SU-2026:21977-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21977-1 advisory. This update for glib2 fixes the following issue: - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206...

CVE-2026-63572: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits in PKCS12 keystore loading Pkcs12Store.Load in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS12 PFX file to cause a denial of service through CPU exhaustion via an iteration count close to 2^31 in the file's...

CVE-2026-104430: Function Call with Incorrectly Specified Arguments

Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP1 through OP16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using...

PT-2026-104455

Name of the Vulnerable Software and Affected Versions Mooncake transfer engine versions prior to 0.3.12 Description An out-of-bounds read occurs in the readString function within include/common.h. This allows unauthenticated attackers to crash the service, such as an SGLang inference server, by...

CVE-2026-91137: Improper Validation of Specified Quantity in Input

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

ROS-20261002-73-0137

The vulnerability in Xen is related to errors in processing the length of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20261002-73-0133

The vulnerability in Xen is related to errors in processing the length of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

CVE-2026-104861: Uncontrolled Resource Consumption

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

PT-2026-105513

Overview probe-image-size scans the SVG header with a searching regular expression, //. On input that contains many , the engine restarts the ^ scan at every position and runs to end of input each time, giving quadratic time complexity. Both the synchronous and the streaming parser are affected...

PT-2026-104412

Name of the Vulnerable Software and Affected Versions probe-image-size versions prior to 7.4.0 Description A Regular Expression Denial of Service ReDoS exists when processing SVG files. The library uses the regular expression // in lib/parse sync/svg.js and lib/parse stream/svg.js, which can...

PT-2026-104393

Name of the Vulnerable Software and Affected Versions Seroval versions prior to 1.6.3 Description Seroval allows for the stringification of JavaScript values, including complex structures. The deserializeTypedArray function within fromJSON and fromCrossJSON trusts a deserialized source value as a...