CVE-2026-72228

A flaw was found in the batman-adv component of the Linux kernel. This vulnerability occurs during the processing of network packets that have fragmented data. Specifically, if a packet's fragmented data fails a preparation step called linearization, a reference to a network interface primaryif i...

GO-2026-6199 Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone...

GO-2026-6238 Integer overflow in BTF parsing in github.com/cilium/ebpf

Integer overflow in BTF parsing in github.com/cilium/ebpf...

GO-2026-6138 Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td

Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td...

EUVD-2026-61048

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-50126 adaguc-server GeoJSON coordinate parser (CConvertGeoJSON.cpp) vulnerable to out-of-bounds read and NULL pointer dereference

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-50126 adaguc-server GeoJSON coordinate parser (CConvertGeoJSON.cpp) vulnerable to out-of-bounds read and NULL pointer dereference

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

RabbitMQ Java client malformed body frame triggers raw command assembler exception

Summary RabbitMQ Java Client's inbound AMQP command assembly accepts a content header declaring a small body and then processes a larger body frame by throwing a raw UnsupportedOperationException from CommandAssembler. A broker peer that the client has connected to can use this malformed frame...

CVE-2026-61634 RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

EUVD-2026-61046

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

CVE-2026-61634 RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

CVE-2026-61634 RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

GHSA-93J5-89VC-PPH4 RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

Summary ValueReader.readTable and readArray recursively call readFieldValue with no depth limit. A malicious AMQP peer can crash the client JVM by sending a deeply nested table structure. Vulnerable Code src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 139-155 and 237-249: java priva...

EUVD-2026-61042

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...

CVE-2026-72207

A flaw was found in the NTFS file system driver in the Linux kernel. When the ntfsresidentattrresize function attempts to free space by converting resident attributes to non-resident, it incorrectly selects zero-length $DATA attributes for this conversion. This can lead to fsck file system check...

CVE-2026-45119

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-62357

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeofint64t overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the...

CVE-2026-72230

A flaw was found in the batman-adv Better Approach To Mobile Ad-hoc Networking - Advanced fragmentation module of the Linux kernel. The batadvfragsendpacket function, responsible for sending fragmented packets, does not properly free allocated memory when a packet is deemed unfragmentable due to ...

EUVD-2026-60947

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-75032

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...