Medium: containerd

Issue Overview: containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or...

Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2026-3161)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3161 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-3162)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3162 advisory. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a...

CVE-2026-78673: Improper Input Validation

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation...

CVE-2026-109205: Allocation of Resources Without Limits or Throttling

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in...

PT-2026-121733

Heap buffer overflow in ntfs acl owner Heap buffer overflow in ntfs same sid Denial-of-service in ntfs inode attach all extents Heap buffer overflow in ntfs check restart area Heap buffer overflow in ntfs ea check wsldev Heap buffer overflow in ntfs external attr find Heap data corruption in ntfs...

PT-2026-110986

Name of the Vulnerable Software and Affected Versions odhcpd versions prior to commit cfddd56 Description An unauthenticated host on the same link can disrupt the DHCPv6 service by sending a crafted RENEW request containing multiple IA NA options after obtaining two bindings. This process trigger...

CVE-2026-109365: Insufficient Verification of Data Authenticity

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling,...

PT-2026-110674

FreeRDP before 3.32.0 contains a double-free vulnerability in nsc context initialize encode that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing t...

ALSA-2026:80798 Moderate: glibc security update

The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name service cache daemon nscd used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fixes: glibc: Fi...

PT-2026-110989

Name of the Vulnerable Software and Affected Versions IBM Maximo AI Service version 9.1.0 IBM Maximo AI Service version 9.2.0 SaaS Description A remote attacker could cause a denial of service due to uncontrolled recursion, which occurs when a function calls itself repeatedly without a proper...

Amazon Linux 2 : perl-HTTP-Date (ALAS-2026-3996)

The version of perl-HTTP-Date installed on the remote host is prior to 6.02-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3996 advisory. parsedate -- and str2time, which delegates to it -- used regexes withambiguous adjacent greedy runs year/clock/timezone digit...

EulerOS 2.0 SP13 : busybox (EulerOS-SA-2026-4033)

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A stack overflow in the evaluate function editors/awk.c of BusyBox commit 371fe9 allows attackers to cause a Denial of Service DoS via supplying a...

EulerOS 2.0 SP11 : glibc (EulerOS-SA-2026-4230)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When expanding paths that begin with a tilde followed by a username, the internal parsetilde function extracts the username to determine the user's...

EulerOS 2.0 SP13 : haproxy (EulerOS-SA-2026-4053)

According to the versions of the haproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buff...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-4236)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server:...

WebFig RouterOS Code Execution

The vulnerability of the WebFig interface in the RouterOS operating system of MikroTik routers is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure...

Medium: perl-Storable

Issue Overview: Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SXHOOK record. retrievehookcommon reads a signed 32-bit item count from an SXHOOK record and calls avextend with that count plus one. A count of I32MAX wraps the addition to a negati...

EulerOS 2.0 SP13 : rsyslog (EulerOS-SA-2026-4195)

According to the versions of the rsyslog packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during...

EulerOS 2.0 SP13 : libusbx (EulerOS-SA-2026-4158)

According to the versions of the libusbx packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malform...