71825 matches found
BIT-MONGODB-2026-13075 $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation
An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries...
CVE-2026-45135
A flaw was found in Caddy. This vulnerability stems from unsafe handling of Unicode characters within the FastCGI component, specifically when processing request paths containing non-ASCII bytes. An attacker capable of placing content into files served via FastCGI can exploit this by crafting a...
USN-8113-2 tiff vulnerabilities
USN 8113-1 fixed vulnerabilities in tiff. This update provides the corresponding fixes for Ubuntu 26.04 LTS. Original advisory details: It was discovered that LibTIFF did not properly handle memory when processing certain images. An attacker could possibly use this issue to cause LibTIFF to crash...
USN-8113-2: LibTIFF vulnerabilities
USN 8113-1 fixed vulnerabilities in tiff. This update provides the corresponding fixes for Ubuntu 26.04 LTS. Original advisory details: It was discovered that LibTIFF did not properly handle memory when processing certain images. An attacker could possibly use this issue to cause LibTIFF to crash...
Malicious code in price-scripping-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...
CVE-2026-72374
A flaw was found in the Linux kernel's AFS filesystem client. The AFS client uses an rxrpc server for callback notifications. Its message parsers incorrectly convert the -EAGAIN return value to 0 when the last packet has not been fully received but all currently queued data is consumed. This...
CVE-2026-72459
A flaw was found in the AppArmor security module of the Linux kernel. The aalabelalloc function, responsible for allocating security labels, did not properly free all allocated resources in its error handling path. This oversight could lead to a memory leak, potentially impacting system stability...
CVE-2026-49422
The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...
CVE-2026-72224
A flaw was found in the Linux kernel's nvdimm/btt module. During the initialization of the Block Translation Table BTT via bttinit, memory allocated for arenas is not properly released if an error occurs. This oversight can lead to a memory leak, potentially impacting system stability or...
CVE-2026-72386
A flaw was found in the drm/panthor component of the Linux kernel. This vulnerability occurs when a group is evicted before the tiler Out-Of-Memory OOM service can process it, leading to a resource leak. An attacker could potentially exploit this to cause resource exhaustion, resulting in a Denia...
CVE-2026-72245
A flaw was found in the Linux kernel's gpu: host1x subsystem. An error handling path in the host1xdeviceparsedt function, when called from host1xdeviceadd, fails to properly release a device reference. This oversight leads to a device reference leak, which could potentially result in resource...
CVE-2026-71694
An issue in Berkeley Out-of-Order Machine BOOM / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arbitrary code via the CSR trap-return state restoration logic, MRET handling logic, mstatus.MPRV update path, CSRFile logic in ProcessorFuzz...
PT-2026-78599
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description A remote attacker can cause a denial of service due to the improper handling of a missing SSL client certificate. SSL Secure Sockets Layer is a protocol used to establish...
ROS-20260819-73-0054
The vulnerability in Tomcat10 is related to deficiencies in handling error situations. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
EUVD-2026-62483
An issue in Berkeley Out-of-Order Machine BOOM / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arbitrary code via the CSR trap-return state restoration logic, MRET handling logic, mstatus.MPRV update path, CSRFile logic in ProcessorFuzz...
CVE-2026-71694
An issue in Berkeley Out-of-Order Machine BOOM / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arbitrary code via the CSR trap-return state restoration logic, MRET handling logic, mstatus.MPRV update path, CSRFile logic in ProcessorFuzz...
Linux Distros Unpatched Vulnerability : CVE-2026-74955
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
AlmaLinux 9 : bind9.18 (ALSA-2026:55442)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55442 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field CVE-2026-133...
MiracleLinux 8 : nghttp2-1.33.0-6.el8_10.3 (AXSA:2026-1576:03)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1576:03 advisory. nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted t...