EUVD-2026-48430

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution RCE has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled...

EUVD-2026-40626

Ruby json: JSON generator heap buffer overflow when streaming to an IO...

NPM: find-my-way: DDoS with HTTP2

NPM: find-my-way: DDoS with HTTP2 vulnerability discovered by ? in WordPress Npm find-my-way versions = 9.6.0...

CVE-2026-16756

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed,...

CVE-2026-47254

A flaw was found in libheif, a library for decoding and encoding HEIF and AVIF image files. A local attacker could exploit an out-of-bounds write vulnerability during the initialization of the sample timing table. This occurs when the number of chunks defined in the stco box is less than the numb...

CVE-2026-12353

CVE-2026-12353 affects RHCS and describes a memory leak in the Java process caused by unauthenticated repeated requests to the TLS/HTTPS endpoint, potentially crashing the RHCS server via Out of Memory. The available documents specify the vulnerability as a network-accessible issue with a low att...

CVE-2026-12353 Rhcs: memory leak during https connection leads to denial of service

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary...

CVE-2026-48029

A flaw was found in libheif, a library used for decoding and encoding HEIF and AVIF image files. A remote attacker could exploit a heap out-of-bounds read vulnerability by tricking a user into processing a specially crafted image file. This flaw can lead to information disclosure and potentially ...

CVE-2026-16756

CVE-2026-16756 affects the aws-smithy-http-server in its default serve() path. Missing connection and header-read timeouts and no concurrent-connection cap can allow unauthenticated remote attackers to exhaust server sockets and tasks by opening many connections and sending partial requests, cons...

CVE-2026-16756

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed,...

CVE-2026-16756 Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed,...

CVE-2026-65918

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's readfromtensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fau...

CVE-2026-65918 PyTorch torchvision GIF Decoder Out-of-bounds Heap Read

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's readfromtensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fau...

CVE-2026-65918

CVE-2026-65918 affects PyTorch torchvision up to version 0.28.0. The GIF decoder’s read_from_tensor callback performs an out-of-bounds heap read by passing an unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to trigger a denial of service (segmentation fault) or d...

CVE-2026-65918

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's readfromtensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fau...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

CVE-2026-44909

CVE-2026-44909 – Normal mode Proxygen’s HTTP/2 flow-control handling in the core HTTP session layer lacks a generalized slow-consumer detection mechanism. A remote unauthenticated attacker can exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or by withholding WINDOW_UPDATE...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...