Regular Expression Denial of Service (ReDoS)

Overview apache-superset is a modern, enterprise-ready business intelligence web application. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements. An attacker...

vim security update

An update is available for vim. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

fence-agents security update

An update is available for fence-agents. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fence-agents packages provide a collection of scripts for handling...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

Apache Traffic Server improper exception handling vulnerability

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. It addresses an issue related to improper exception handling, which stems from empty pointer dereferencing and dangling references memory errors that occur during TLS and SNI...

@0x0.bug/pi-coding-agent (1.0.0), @0xwork/connect (>=0.1.0, <=0.1.9) +1195 more potentially affected by CVE-2026-14643 via undici (>=8.0.0, <=8.8.0)

undici NPM version =8.0.0, =0.1.0, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.1.0, =2026.6.2, =2026.6.5 and more Source cves: CVE-2026-14643 Source...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2146 more potentially affected by CVE-2026-16729 via undici (>=6.0.0, <=6.27.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =2.7.0, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =1.10.0-release and more Source cves: CVE-2026-16729 Source advisory: SNYK:JS-UNDICI-18426061...

CVE-2026-15975 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing...

CVE-2026-54890

A flaw was found in Erlang/OTP. A remote attacker can exploit an integer underflow vulnerability in the External Term Format ETF decoder, specifically within the binarytoterm function. By sending a specially crafted ETF payload with a zero-length BITBINARYEXT tag, the attacker can trigger an...

SUSE-SU-2026:23038-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issue: - CVE-2025-24912: hostapd RADIUS authentication of wi-fi devices allows a user in between the hostapd and the RADIUS server to inject crafted RADIUS packets and force RADIUS authentications to fail bsc1239461...

MiracleLinux 9 : python3.12-urllib3-1.26.19-3.el9_8 (AXSA:2026-1380:04)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1380:04 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via...

CVE-2026-47219

CVE-2026-47219 : The vulnerability affects the find-my-way HTTP router. Versions before 9.7.0 are susceptible to remotely triggerable DoS when used with Node's HTTP/2 server. The issue arises because lookup() passes req.method to find(), and find() indexes this.trees[method]. Since this.trees is ...

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet and STUN attribute bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception in...

CVE-2026-67184

Summary: TinyWeb 0.0.8 and earlier are affected by a null pointer dereference due to a failure in HttpParser::execute() when parsing an HTTP request line with an invalid version. The code path leaves Url as NULL and then buildResponse() dereferences it without validating valid_requ, causing a SIG...

CVE-2026-67184 TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTTP Request

TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...

SUSE-SU-2026:23100-1 Security update for the Linux Kernel RT (Live Patch 25 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-48.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46173: exit: prevent preemption of oopsing TASKDEAD task bsc1267723. - CVE-2026-52909: ip6vti: set netnsimmutable on the fallback device bsc1268662. -...

SUSE-SU-2026:23080-1 Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role bsc1270060. - CVE-2026-53366: ipv4: account for fraggap on the paged allocation...

SUSE-SU-2026:23011-1 Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role bsc1270060. - CVE-2026-53366: ipv4: account for fraggap on the paged allocation...

SUSE-SU-2026:23081-1 Security update for the Linux Kernel (Live Patch 23 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-46.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role bsc1270060. - CVE-2026-53366: ipv4: account for fraggap on the paged allocation...

CVE-2026-66754 Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...