Vercel Next.js resource management error vulnerability

Versions 13.0.0 through 15.5.28 and 16.0.0 through 16.4.1 of Vercel Next.js contain a resource management error vulnerability. This vulnerability arises from specially crafted requests directed at App Router applications that include at least one Server Action; it may lead to excessive CPU...

Lexi Wilson exposed a resource management error vulnerability

Versions 0.1.0 and later of esaml contain a resource management error vulnerability. This vulnerability arises because esamlbinding:decoderesponse/2 decodes a SAMLResponse provided by an attacker using base64 encoding, then decompresses it via zlib:unzip/1 without restricting the output size. Pri...

EUVD-2026-66564

In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in arcontextrelease During the error handling path of the driver's probe function, a NULL pointer dereference can occur in arcontextrelease. When pciprobe fails early e.g., if...

CVE-2026-114118

A flaw was found in Vyper. When deploying smart contracts from blueprints reusable contract templates, the createfromblueprint function calculates remaining code size without verifying that the offset is within the template boundaries, causing an integer calculation error. A remote attacker...

PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment

A family of runtime memory safety vulnerabilities, with impacts ranging from worker crashes and data disclosure to pre-authentication remote code execution. Introduction Researchers from Wiz, OpenAI, and Calif jointly disclosed PHP2Shell CVE-2026-109618 and CVE-2026-109619, a set of memory safety...

BIT-PARSE-2026-110854 Parse Server before 8.6.97 and 9.10.2 Denial of Service via Unhandled Email Error

Parse Server before 8.6.97 and 9.0.0 before 9.10.2 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while...

Security update for libheif

This update for libheif fixes the following issues: CVE-2026-84449: hOpRGB2432toYCbCr Memory Access Error / SEGV bsc1281829. Out-of-bounds read and write in derived-item and pixel-plane handling bsc1279444. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

CLSA-2025-1747430081 Fix of 47 CVEs

CVE-url: https://ubuntu.com/security/CVE-2021-47352 - virtio-net: Add validation for used length CVE-url: https://ubuntu.com/security/CVE-2024-46745 - Input: uinput - reject requests with unreasonable number of slots CVE-url: https://ubuntu.com/security/CVE-2024-44952 - driver core: Fix ueventsho...

BIT-MYSQL-CLIENT-2026-97380 MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor...

BIT-MARIADB-MIN-2026-97380 MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor...

BIT-MARIADB-2026-97380 MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor...

Exploit for CVE-2026-85315

CVE-2026-85315 — camel-grpc: consumer exception disclosure Ru...

dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because Redis’s inline command parsing allocates memory and copies the entire input buffer based on its current size before determining the command boundary; there is no proper lim...

PT-2026-122479

Уязвимость микропрограммного обеспечения шлюза Cisco Expressway связана с ошибкой обработки исключительных состояний. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

oretnom23 file-management-system-php input validation error vulnerability

The oretnom23 file-management-system-php contains an input validation error vulnerability. This vulnerability arises because the include function in the index.php file processes the ‘page’ parameter, resulting in file inclusion and potential remote exploitation...

Pillow resource management error vulnerability

Versions of Pillow prior to 13.0.0 contain a resource management error vulnerability. This vulnerability arises because the TarIO initializer in src/PIL/TarIO.py accepts negative octal member sizes and performs backward addressing, resulting in the return of the same 512-byte header. When the...

Linux Distros Unpatched Vulnerability : CVE-2026-113239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Range error in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a...

Vaadin Framework resource management error vulnerability

A security vulnerability exists in Vaadin Framework versions 8.16.0 through 8.32.1. It arises because requestEnd reads the v-uiId request parameter outside of the code block responsible for releasing the session lock. Since the value is not a numeric v-uiId, Integer.parseInt throws an exception,...

Vyper input validation error vulnerability

Vyper versions prior to 0.3.1 contain an input validation error vulnerability. This stems from the absence of a uint8 type, allowing interface returns declared as uint8—such as ERC20.decimals—to be stored in uint256 variables without boundary checks. Malicious contracts can then return values...