CVE-2026-9190 HTTP request smuggling in Progress MarkLogic Server

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

CVE-2026-48834

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

EUVD-2026-53396

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

CVE-2026-48834 Apache Answer: Denial of service via crafted Accept-Language header parsing

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests

A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an...

axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream

A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to...

CVE-2026-71267

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy...

CVE-2026-71267 microtar Stack Buffer Overflow in mtar_write_file_header() and mtar_write_dir_header()

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy...

CVE-2026-71267 microtar Stack Buffer Overflow in mtar_write_file_header() and mtar_write_dir_header()

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy...

CVE-2026-71266

The CVE-2026-71266 entry concerns tinyobjloader-c. In tinyobj_parse_and_index_mtl_file() (tinyobj_loader_c.h), a line from a .mtl file is copied into a fixed 4096-byte stack buffer linebuf using memcpy(linebuf, p, p_len) with only an assert(p_len

CVE-2026-71267

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy...

CVE-2026-71267

CVE-2026-71267 affects microtar. The mtar_write_file_header() and mtar_write_dir_header() functions copy a caller-supplied entry name into a 100-byte name field of a stack-allocated mtar_header_t using strcpy without validating length, allowing a stack buffer overflow if the filename is longer th...

EUVD-2026-53352

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte name field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy. Any application that calls these...

CVE-2026-71263 FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool()

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit...

CVE-2026-71263

The FreeModbus LINUXTCP port has a concrete defect in xMBPortTCPPool(): the code uses a strict greater-than check (usTCPFrameBytesLeft > MB_TCP_BUF_SIZE) against a 263-byte MB_TCP_BUF_SIZE limit. When an MBAP frame with Length 264 is processed, usTCPFrameBytesLeft becomes 263, the check passes...

CVE-2026-71255

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

EUVD-2026-53332

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

CVE-2026-71255

NanoMODBUS up to v1.23.0 contains a client-side out-of-bounds write in nanomodbus.c: recv_read_device_identification_res() uses server-provided object_length (0–246) to copy data, but only validates against remaining PDU, not against caller buffers_length. After strncpy(buffers_out[buf_index], st...

CVE-2026-71255 nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res()

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recvreaddeviceidentificationres function FC 0x2B/MEI 0x0E, Read Device Identification in nanomodbus.c. The server-supplied objectlength field 0-246 is validated only against the remaining PDU size ressizeleft and...

UBUNTU-CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...