Medium: mariadb114

Issue Overview: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability...

Medium: mariadb118

Issue Overview: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability...

Medium: mariadb123

Issue Overview: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability...

EulerOS 2.0 SP11 : rsyslog (EulerOS-SA-2026-4287)

According to the versions of the rsyslog packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during...

PT-2026-110594

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before...

CVE-2026-109248: Out-of-bounds Read

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convertfiledescriptorstofilelist, which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded wcschr and countspecialchars calls without a NUL-termination guarantee. A malicious RDP server...

PT-2026-110674

FreeRDP before 3.32.0 contains a double-free vulnerability in nsc context initialize encode that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing t...

Medium: perl-HTTP-Date

Issue Overview: parsedate -- and str2time, which delegates to it -- used regexes with ambiguous adjacent greedy runs year/clock/timezone digits and timezone/ASCII-timezone letters before a trailing anchor. A valid-looking date prefix followed by a long interior run of digits, letters, or whitespa...

PT-2026-110665

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description A heap out-of-bounds read exists in the WinPR clipboard function convert filedescriptors to file list. The issue occurs when the function scans a server-controlled FILEDESCRIPTORW cFileName usi...

CVE-2026-53922: Stack-based Buffer Overflow

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IANA options. ...

EulerOS 2.0 SP13 : open-isns (EulerOS-SA-2026-4167)

According to the versions of the open-isns packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through...

PT-2026-110992

Name of the Vulnerable Software and Affected Versions IBM Maximo Application Suite - IoT Component version 9.0.0 IBM Maximo Application Suite - IoT Component version 9.1.0 IBM Maximo Application Suite - IoT Component version 9.2.0 Description A remote attacker can cause a denial of service throug...

gd security update

2.3.3-20.1 - Fix LZW decompression in GIF handling CVE-2026-9672 Resolves: RHEL-259570...

CVE-2026-109246: Integer Underflow (Wrap or Wraparound)

FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadowencoderinflightframes can underflow. An authenticated client can acknowled...

CVE-2026-90911: Uncontrolled Resource Consumption

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption...

CVE-2026-109351: Allocation of Resources Without Limits or Throttling

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-90921: Improper Handling of Length Parameter Inconsistency

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process...

ALSA-2026:80825 Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

PT-2026-110988

Name of the Vulnerable Software and Affected Versions IBM Maximo AI Service version 9.1.0 IBM Maximo AI Service version 9.2.0 Description A remote attacker can cause a denial of service by triggering uncontrolled resource consumption. Recommendations At the moment, there is no information about a...

PT-2026-110991

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames, resulting in termination of the host process...