CVE-2026-109240

FreeRDP versions 3.11.0 before 3.32.1 are vulnerable to a reachable assertion vulnerability within the urb_isoch_transfer function. A malicious RDP server can cause a client to crash by sending a TS_URB_ISOCH_TRANSFER IN-direction request over URBDRC containing an unvalidated OutputBufferSize val...

CVE-2026-109240 FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer

FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TSURBISOCHTRANSFER IN-direction request with OutputBufferSize above INT32MAX over...

CVE-2026-109240 FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer

FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TSURBISOCHTRANSFER IN-direction request with OutputBufferSize above INT32MAX over...

CVE-2026-109240 FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer

FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TSURBISOCHTRANSFER IN-direction request with OutputBufferSize above INT32MAX over...

lws-team Libwebsockets security vulnerabilities

The lws-team Libwebsockets component has a security vulnerability. This vulnerability stems from a buffer overflow in the LEJP JSON parser, which could allow remote attackers to cause a denial-of-service attack...

Marco Piovanello yt-dlp Web UI improper exception handling vulnerabilities

Marco Piovanello’s yt-dlp Web UI versions 4.0.0 and earlier have a vulnerability due to improper exception handling. This vulnerability stems from a null pointer dereferencing in the Service.Formats JSON-RPC method. Attackers can exploit this vulnerability by sending a single request with a url...

Okta Credential Provider for Windows Buffer Error Vulnerability

Okta Credential Provider for Windows versions prior to 1.4.6.0 have a security vulnerability. This vulnerability stems from the unauthorized parsing of serialized credentials into Kerberos login structures without verification. Additionally, no checks are performed on the buffer size and the offs...

Okta RADIUS Agent resource management error vulnerability

The Okta RADIUS Agent versions from 2.17.5 to 2.28.0 have a resource management error vulnerability. This vulnerability arises from the lack of verification of the length of sub-attributes when parsing the Vendor-Specific attribute. Sub-attributes with a length of zero can cause the parser to ent...

Siemens APOGEE MBC (PPC) (BACnet) buffer error vulnerability

Siemens APOGEE MBC PPC BACnet has a buffer overflow vulnerability. This vulnerability stems from the web services of the affected products not properly verifying the inputs provided by users during code uploads. This could allow unauthorized remote attackers to cause denial-of-service attacks...

RHLW-2026-A9AFA2D7B2973961 Lightwell Security Advisory: spring-web 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-web 5.3.18.rhlw-00010 with backported fixes for CVE-2016-1000027, CVE-2024-22259, CVE-2024-22262, CVE-2024-38809, and CVE-2024-38820. CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution...

CVE-2026-107378

A flaw was found in CairoSVG. A remote attacker can cause a Denial of Service DoS by providing a specially crafted Scalable Vector Graphics SVG file containing paths with numerous segments. Inefficient path processing leads to excessive CPU resource consumption during rendering, causing the...

CVE-2026-15340

A flaw was found in lwIP. The Simple Mail Transfer Protocol SMTP client does not properly validate the size of inputs, leading to a buffer overflow. A malicious SMTP server could use this flaw to crash or possibly execute arbitrary code with the privileges of the SMTP client by sending an...

CVE-2026-52132

A flaw was found in llama.cpp. A remote attacker can exploit this vulnerability when the application is started with the --reranking flag. By sending a POST request to the /rerank endpoint with a negative topn value, the attacker can cause a std::badalloc error and an HTTP 500 response, leading t...

Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.9 bsc1255111: CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT rejection bsc1284767. CVE-2026-78659:...

Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...

SUSE-SU-2026:4628-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...

Uncontrolled Resource Consumption

netty-incubator-codec-bhttp is vulnerable to Uncontrolled Resource Consumption . The vulnerability is due to improper termination and lack of forward-progress validation in the BinaryHttpParser field-section decoding loop, which allows an unauthenticated attacker to send a crafted Binary HTTP...

CVE-2026-109228

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, maxframes, maxtokensperframe and maximagetokens in the videourl object. Attackers can set these values arbitrarily high so glm4v.py decode...

CVE-2026-109205

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in...

CVE-2026-109225

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before...