EulerOS 2.0 SP11 : libsoup (EulerOS-SA-2026-4339)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving unmasked...

EulerOS 2.0 SP13 : diffutils (EulerOS-SA-2026-4040)

According to the versions of the diffutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : diff3 tool from GNU diffutils is vulnerable to a heapbased buffer overflow due to multiple signed integer overflows in linemapping calculations...

EulerOS 2.0 SP11 : jbig2dec (EulerOS-SA-2026-4329)

According to the versions of the jbig2dec packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafte...

TencentOS Server 3: git-lfs (TSSA-2026:1134)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1134 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-4105)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A security vulnerability exists in Samba affecting versions before 4.22.10. The specific vulnerability details have not been publicly...

EulerOS 2.0 SP11 : python-sphinx (EulerOS-SA-2026-4282)

According to the versions of the python-sphinx packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the .flatten and .isEqual functions use recursion without a depth...

EulerOS 2.0 SP11 : glib-networking (EulerOS-SA-2026-4319)

According to the versions of the glib-networking package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain ...

TencentOS Server 3: container-tools:rhel8 (TSSA-2026:1154)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1154 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

EulerOS 2.0 SP13 : jbig2dec (EulerOS-SA-2026-4054)

According to the versions of the jbig2dec packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An integer overflow in the jbig2arithiaidctxnew function of Artifex commit cc37d0 allows attackers to cause a Denial of Service DoS via a crafte...

EulerOS 2.0 SP11 : busybox (EulerOS-SA-2026-4306)

According to the versions of the busybox packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap overflow in the ifsbreakup function shell/ash.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a craft...

PT-2026-110756

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing...

CVE-2026-109301: Uncaught Exception

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delet...

CVE-2026-109311: Improper Input Validation

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the A...

CVE-2026-109363: Reachable Assertion

ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad...

CVE-2026-109398: Improper Handling of Highly Compressed Data (Data Amplification)

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...

CVE-2026-41510: Protection Mechanism Failure

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGSPOST without enforcing the cap. The fl...

CVE-2026-83536: Uncontrolled Resource Consumption

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

CVE-2026-109298: Uncontrolled Resource Consumption

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grepknowledgefiles with short...

CVE-2026-109339: Allocation of Resources Without Limits or Throttling

SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed malicious module that writes output without newlines, crashing...

CVE-2026-109365: Insufficient Verification of Data Authenticity

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling,...