CVE-2026-109298: Uncontrolled Resource Consumption

Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can have the model call grepknowledgefiles with short...

CVE-2026-109249: Out-of-bounds Read

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdpassistanceparseallelementsof because it advances its parsing cursor without reducing the remaining length, letting the scan window exceed the decrypted ConnectionString2 buffer. Attackers can supply a crafted .msrcIncident...

ALSA-2026:80825 Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

ALSA-2026:80817 Important: rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fixes: rsyslog: A configuration-dependent issue in rsyslog's optional imptc...

CVE-2026-109228: Allocation of Resources Without Limits or Throttling

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, maxframes, maxtokensperframe and maximagetokens in the videourl object. Attackers can set these values arbitrarily high so glm4v.py decode...

CVE-2026-109299: Uncontrolled Resource Consumption

Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall the instance by submitting unsatisfiable recurrence rules. Attackers can repeatedly send rules like February 30th to the automations create or update...

PT-2026-110669

FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB RPC INTERNAL NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the...

CVE-2026-109351: Allocation of Resources Without Limits or Throttling

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

PT-2026-110768

Name of the Vulnerable Software and Affected Versions Gitoxide gix-pack versions prior to 0.75.0 Description An uncontrolled memory allocation issue exists where remote attackers can cause a process to abort. By providing a 12-byte pack header that claims 0xFFFFFFFF objects, a malicious remote ca...

CVE-2026-109349: Reachable Assertion

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort t...

WebFig RouterOS Code Execution

The vulnerability of the WebFig interface in the RouterOS operating system of MikroTik routers is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure...

Medium: containerd

Issue Overview: containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or...

CVE-2026-78673: Improper Input Validation

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation...

Important: tomcat-native

Issue Overview: Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be...

CVE-2026-109205: Allocation of Resources Without Limits or Throttling

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in...

PT-2026-121733

Heap buffer overflow in ntfs acl owner Heap buffer overflow in ntfs same sid Denial-of-service in ntfs inode attach all extents Heap buffer overflow in ntfs check restart area Heap buffer overflow in ntfs ea check wsldev Heap buffer overflow in ntfs external attr find Heap data corruption in ntfs...

PT-2026-110986

Name of the Vulnerable Software and Affected Versions odhcpd versions prior to commit cfddd56 Description An unauthenticated host on the same link can disrupt the DHCPv6 service by sending a crafted RENEW request containing multiple IA NA options after obtaining two bindings. This process trigger...

CVE-2026-109365: Insufficient Verification of Data Authenticity

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling,...

CVE-2026-75095: Uncontrolled Resource Consumption

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption...

PT-2026-110674

FreeRDP before 3.32.0 contains a double-free vulnerability in nsc context initialize encode that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing t...