CLEANSTART-2026-AY31255 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame

Security vulnerability affects the apache-nifi-registry package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...

CLEANSTART-2026-OK35462 Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...

Security vulnerability affects the spark-sc213-jdk17-py312 package. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings...

CLEANSTART-2026-EA90663 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

Security vulnerability affects the external-dns package. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption...

CLEANSTART-2026-CX44155 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details...

CLEANSTART-2026-RD95849 TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption

CVE-2026-46602 affects multiple packages. The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption. See references for individual vulnerability details...

MappedImagesDetector

MappedImagesDetector Native Windows memory scanner for detecting malicious DLL injections and in-memory malware MappedImagesDetector is a low-level C++20 Windows tool designed to detect malicious DLL injection techniques used by modern malware, including manual-mapped DLLs, erased PE headers, and...

PT-2026-108032

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local web fetch tool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML...

PT-2026-108161

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection versions 12.0 through 12.2 Description The WfpMonitor kernel driver contains an improper validation of user-supplied pointers. Specifically, certain METHOD NEITHER IOCTL handlers dereference user-controlled pointer...

PT-2026-107983

ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a use-after-free vulnerability in the RSVG decoder when built without cairo support, triggered when a limit is hit during decoding. Attackers can supply crafted SVG files that cause a limit to be reached, leading to access of freed...

PT-2026-107774

An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remot...

PT-2026-108010

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive...

PT-2026-107779

NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom implementation. Improper enforcement of the application-supplied receive buffer length may allow a crafted UDP packet to overflow the destination buffer, resulting in memory corruption, or denial of...

PT-2026-108006

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation...

PT-2026-108149

Name of the Vulnerable Software and Affected Versions amqp091-go versions 1.13.0 through 1.13.x Description A frame-size mitigation can be bypassed before the connection.tune process completes. A malicious or compromised AMQP peer can send a short body-frame header containing a large...

RockyLinux 9 : perl-DBI (RLSA-2026:76760)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:76760 advisory. perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting CVE-2026-88815 Tenable has extracted the preceding description block...

PT-2026-108321

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A memory amplification issue exists where a client can send a specially crafted packet specifying multiple ECH outer extension references, which is prohibited by...

PT-2026-108151

Name of the Vulnerable Software and Affected Versions music-metadata versions prior to 11.16.0 Description The ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before verifying if the input contains the declared bytes. A specially crafted file such as MP3, FLAC,...

PT-2026-108140

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. This allows subsequent append or comparison operations to underfl...

PT-2026-107981

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains an invalid memory free vulnerability in the MVG decoder. Attackers can supply a crafted MVG image for processing to trigger the invalid free and crash the application, causing a denial of service...

EulerOS 2.0 SP15 : mod_http2 (EulerOS-SA-2026-3926)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...