Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from an email header injection issue during Bounce operations. The function rcubemime::decodeaddresslist fails to remove control characte...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because rcmailsendmail only strips line breaks from the Subject and Organization headers, failing to sanitize other header values receiv...

Vercel Next.js resource management error vulnerability

Versions 13.0.0 through 15.5.28 and 16.0.0 through 16.4.1 of Vercel Next.js contain a resource management error vulnerability. This vulnerability arises from specially crafted requests directed at App Router applications that include at least one Server Action; it may lead to excessive CPU...

Silicon Labs EmberZNet resource management error vulnerability

Silicon Labs EmberZNet versions 9.1.1 and earlier contain a resource management error vulnerability. This vulnerability arises when processing a malformed Publish Billing Period command, leading to recursive function calls that fail to reach termination conditions. It affects only devices that...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because rcubewashtml fails to validate the by attribute in SVG SMIL animations; as a result, tags within HTML emails can load remote...

KNIME Business Hub resource management error vulnerability

Versions prior to KNIME Business Hub 1.19.0 contain a resource management error vulnerability. This vulnerability stems from an excessive resource allocation issue in the remote workflow editing functionality. Authenticated attackers can exploit this flaw to exhaust server-side resources, resulti...

Silicon Labs EmberZNet buffer error vulnerability

Silicon Labs EmberZNet versions 9.1.1 and earlier contain a buffer error vulnerability. This vulnerability arises from specially crafted Publish Price Matrix commands that lead to out-of-bounds writes, potentially enabling remote code execution...

GraphQL Python GraphQL-core 3 resource management error vulnerability

In GraphQL Core for Python versions 3.0.0 through 3.2.12 and 3.3.0a1 through 3.3.0rc1, there is a resource management error vulnerability. This vulnerability stems from the OverlappingFieldsCanBeMerged rule during validation; it repeatedly compares shared response fields and recursively recompare...

Vyper input validation error vulnerability

A input validation error vulnerability exists in VyperLang Vyper versions 0.4.0b1 through 0.5.0b1. This vulnerability arises because parseName parses the names of constants and default parameters from imported modules at the function call site rather than at their declaration site. When contract...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises from using the subject line of forwarded emails verbatim to generate attachment names. When the subject contains a CRLF sequence, it may...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 within the 1.7.x series. This vulnerability arises because the flag parameter in the mail/mark action fails to filter CRLF sequences, potentially allowing remote authenticated...

Marcos Penelas Cámara Next.js Ecommerce Template Input validation error vulnerability

The Marcos Penelas Cámara Next.js Ecommerce Template contains an input validation error vulnerability. This vulnerability arises because external control assumes that web parameters are immutable in the shopping cart and checkout processes. The POST /api/user/cart endpoint accepts two independent...

Drupal Webform resource management error vulnerability

Versions of Drupal Webform prior to 6.2.12 and from 6.3.0 up to but including 6.3.1 contain a resource management error vulnerability. This vulnerability stems from unrestricted or throttled resource allocation, potentially leading to excessive resource consumption...

LiteSpeed Tech “Resource Management Error” vulnerability

LiteSpeed Tech versions prior to 4.9.0 contain a resource management error vulnerability. This vulnerability arises because the HTTP/3 implementation fails to limit the number of buffer header sets, potentially leading to excessive memory consumption and susceptibility to QPACK amplification...

Lexi Wilson exposed a resource management error vulnerability

Versions 0.1.0 and later of esaml contain a resource management error vulnerability. This vulnerability arises because esamlbinding:decoderesponse/2 decodes a SAMLResponse provided by an attacker using base64 encoding, then decompresses it via zlib:unzip/1 without restricting the output size. Pri...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from incomplete recognition of CSS escape sequences when processing the FuncIRI attribute, allowing remote content to be bypassed. As a...

EUVD-2026-66564

In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in arcontextrelease During the error handling path of the driver's probe function, a NULL pointer dereference can occur in arcontextrelease. When pciprobe fails early e.g., if...

CVE-2026-114118

A flaw was found in Vyper. When deploying smart contracts from blueprints reusable contract templates, the createfromblueprint function calculates remaining code size without verifying that the offset is within the template boundaries, causing an integer calculation error. A remote attacker...

PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment

A family of runtime memory safety vulnerabilities, with impacts ranging from worker crashes and data disclosure to pre-authentication remote code execution. Introduction Researchers from Wiz, OpenAI, and Calif jointly disclosed PHP2Shell CVE-2026-109618 and CVE-2026-109619, a set of memory safety...

BIT-PARSE-2026-110854 Parse Server before 8.6.97 and 9.10.2 Denial of Service via Unhandled Email Error

Parse Server before 8.6.97 and 9.0.0 before 9.10.2 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while...