CVE-2026-104020

The Amazon Ion Python library (versions prior to 0.15.0 ) is vulnerable to a denial of service due to uncontrolled recursion in the Ion reader . A remote, unauthenticated actor can crash the application by providing a crafted, deeply nested Ion value. To remediate this issue, users should upgrade...

qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization

A flaw was found in qtbase. Uncontrolled recursion in Qt's QDomDocument serialization QtXml allows a remote attacker to provide deeply nested untrusted XML, leading to stack exhaustion. This can cause the application to crash, resulting in a Denial of Service DoS...

GO-2026-6512 Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy

Rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass in github.com/caddyserver/caddy...

GO-2026-6549 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel

Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS in github.com/tomwright/dasel...

GO-2026-6569 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub in github.com/kubeedge/kubeedge

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub in github.com/kubeedge/kubeedge...

GO-2026-6581 Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin - remote node memory/goroutine exhaustion DoS in github.com/klever-io/klever-go...

GO-2026-6586 Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go...

GO-2026-6559 SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo

SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo...

GO-2026-6550 SIPGO: DoS via unvalidated Content-Length in the stream parser in github.com/emiago/sipgo

SIPGO: DoS via unvalidated Content-Length in the stream parser in github.com/emiago/sipgo...

GO-2026-6597 Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd

Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd...

CVE-2026-96780

The figlet.js library (a JavaScript FIG driver) is vulnerable to a Denial of Service via an unbounded loop in its text() and textSync() functions. The root cause is that when the whitespaceBreak option is enabled and the width is set smaller than a single FIGlet character, the breakWord() functio...

CVE-2026-96780 figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width

figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text and textSync can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions,...

CVE-2026-82357

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromise...

CVE-2026-104182 stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

CVE-2026-104182

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

CVE-2026-14983

Teledyne FLIR Aware2 software versions through 6.9.0.2 are vulnerable to a denial of service (DoS) attack due to missing authentication in the web interface. An unauthenticated remote attacker can exploit this by misusing the reboot endpoint on Teledyne FLIR PackBot robots running the affected so...

CVE-2026-14983 Missing Authentication in Teledyne FLIR Robots running Aware2

Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint...

CVE-2026-82357 RT-Labs AB C-Open CANopen NULL pointer dereference

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromise...

CVE-2026-82357

The RT-Labs AB C-Open CANopen software contains a NULL pointer dereference vulnerability occurring when the LSS protocol is utilized to configure the device. The root cause is triggered if a user-defined application object lacks all required subindexes for object 0x1018 . An unauthenticated, remo...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...