CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

@ahmedwalid05/instagram-private-api (>=1.43.6-0, <=1.43.9), @alwaysmeticulous/cli (>=2.306.0, <=2.308.0) +160 more potentially affected by CVE-2026-71498 via re2 (>=1.8.4, <=1.26.0)

re2 NPM version =1.8.4, =1.43.6-0, =2.306.0, =2.306.0, =1.43.3, =8.0.0, =8.1.31, =8.0.0, =8.0.0, =1.0.9, =0.0.0-semantic-release, =0.1.1, =1.1.0, =0.0.0-semantic-release, =0.0.1 and more Source cves: CVE-2026-71498 Source advisory: OSV:GHSA-J4R3-HG7J-8CHG...

@ahmedwalid05/instagram-private-api (>=1.43.6-0, <=1.43.9), @alwaysmeticulous/cli (>=2.306.0, <=2.308.0) +160 more potentially affected by CVE-2026-71430 via re2 (>=1.8.4, <=1.25.0)

re2 NPM version =1.8.4, =1.43.6-0, =2.306.0, =2.306.0, =1.43.3, =8.0.0, =8.1.31, =8.0.0, =8.0.0, =1.0.9, =0.0.0-semantic-release, =0.1.1, =1.1.0, =0.0.0-semantic-release, =0.0.1 and more Source cves: CVE-2026-71430 Source advisory: OSV:GHSA-8HCV-X26H-MCGP...

Use of Blocking Code in Single-threaded, Non-blocking Context

Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Use of Blocking Code in Single-threaded, Non-blocking Context via the ticks parameter in radar diagrams. An attacker can cause...

Use of Blocking Code in Single-threaded, Non-blocking Context

Overview org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Use of Blocking Code in Single-threaded, Non-blocking Context via the ticks parameter in radar diagrams. An attack...

Improperly Controlled Sequential Memory Allocation

Overview org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the setXAxisRangeData function when configuring an X-Axis wi...

GHSA-2V8P-3F2J-5MP7 Mermaid XY Charts are vulnerable to an infinite loop DoS

Impact Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData, when configuring an X-Axis with invalid parameters. As each loop appends an element to an array, this would generally only cause an RangeError: Invalid array length to appear after a few seconds, but...

Improperly Controlled Sequential Memory Allocation

Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the setXAxisRangeData function when configuring an X-Axis with invalid...

DoS (Denial of Service) undici Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 11.3.8 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to cause a...

DoS (Denial of Service) io.netty:netty-codec-http Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.12.1, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS...

httpd: Fix of CVE-2026-44186

CVE-2026-44186: modproxyftp: infinite loop in proxyftphandler when scanning an FTP 120 greeting for a Retry-After delta-seconds value; the scan loop never advanced secsstr, so it spun forever on any greeting that did not begin with a digit, letting a backend FTP server hang worker processes...

CVE-2026-67296

A flaw was found in FreeRDP. A remote attacker can exploit a vulnerability in the Remote Desktop Protocol RDP Enhanced Input RDPEI server channel handler. By sending a malicious RDPEI message with an oversized declared body length, the attacker can force the server to allocate excessive memory,...

CVE-2026-71310

A flaw was found in rclone. A remote attacker, by controlling a malicious or compromised proxy server or acting as an on-path attacker for a plaintext HTTP proxy connection, could send oversized HTTP CONNECT response headers. The rclone application's HTTP CONNECT helper processes these responses...

osbuild-composer security, bug fix, and enhancement update

An update is available for osbuild-composer. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A service for building customized OS artifacts, such as VM images an...

CVE-2026-64592

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Unconditionally sfence.vma for spurious fault Svvptc does not guarantee that it's safe to just return here. Since we have already cleared our bit, if, theoretically, the bounded timeframe for the accessed page to becom...

AlmaLinux 9 : nodejs:22 (ALSA-2026:47058)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:47058 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...

CVE-2026-71310

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway

Summary Security Vulnerabilities affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-48779. CWE:CWE-770:...

CVE-2026-20263

A vulnerability in the Blocks Extensible Exchange Protocol BEEP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling when parsing a specific BEEP SOAP...

CVE-2026-20311

Cisco IOS XE Software web-based management interface is affected. A vulnerability allows an authenticated, low-privilege remote attacker to trigger a reload (DoS) by exploiting insufficient error handling when authenticating with a malformed certificate. Impact is DoS with availability impact; at...