CVE-2026-107937

A flaw was found in Apache CXF. A remote, unauthenticated attacker can cause a Denial of Service DoS by sending a crafted multipart request containing excessively large or repeated attachment headers. Because the parser fails to properly enforce size and count limits on multi-line and repeated...

CVE-2026-78384

A flaw was found in Apache CXF. A remote attacker can trigger a Denial of Service DoS by submitting specially crafted compressed data during token processing. Because the system decompresses incoming data without enforcing a maximum output size limit, a small payload can consume excessive heap...

CVE-2026-75346

A flaw was found in OpENer. An out-of-bounds read vulnerability in the server-side Common Industrial Protocol CIP SetAttributeList service allows a remote attacker to cause a Denial of Service DoS. By sending specially crafted network requests, an attacker can trigger an invalid memory read,...

CVE-2026-75349

A flaw was found in OpENer. An out-of-bounds read vulnerability exists within the Connection Manager component during request parsing. A remote attacker could exploit this flaw by sending specially crafted network requests, causing the application to crash and leading to a denial of service DoS...

CVE-2026-75348

A flaw was found in opener. An out-of-bounds read vulnerability exists in the Common Packet Format CPF parser when processing network packets. By sending a specially crafted request containing incomplete socket address information, a remote attacker can cause the application to crash, resulting i...

SUSE CVE-2026-107378

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...

SUSE CVE-2026-107386

amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...

SUSE CVE-2026-107678

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...

SUSE CVE-2026-107708

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...

SUSE CVE-2026-107888

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler...

SUSE CVE-2026-107890

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPPTAGZERO, but addjob converts these separators to IPPTAGJOB. During job startup, getoptions/ipplength subsequentl...

CLSA-2026-1791563836 ipa: Fix of 4 CVEs

CVE-2026-73197: limit the request body size of the unauthenticated migration endpoint - CVE-2026-73198: limit the request body size of the unauthenticated i18nmessages endpoint - CVE-2026-76578: harden default ACIs and permissions against unauthenticated and delegated privilege escalation -...

Allocation of Resources Without Limits or Throttling

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the web UI's request handling in src/pyload/webui/app/config.py, which lacks a maximum content leng...

CVE-2026-48484 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

CVE-2026-48484

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API "rpc" function in "apiblueprint.py" handles "multipart/form-data" uploads by reading the whole content of the uploaded file into memory with "file.read". This occurs before the data is sent to th...

EUVD-2026-95910

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

CVE-2026-48484 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

AZL-106919 CVE-2026-102554 affecting package guava 33.0.0-1

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

AZL-107988 CVE-2026-102554 affecting package javapackages-bootstrap 1.14.0-4

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...

CVE-2026-102554

Allocation of resources without limits or throttling CWE-770 during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances,...