CVE-2020-37280: Memory Allocation with Excessive Size Value

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

PT-2026-110929

🚨 CVE-2026-109380 modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks...

PT-2026-110802

🚨 CVE-2026-85965 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability. 🎖@cveNotify...

CVE-2026-41510: Protection Mechanism Failure

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGSPOST without enforcing the cap. The fl...

CVE-2026-21126: Undefined Security Weakness

Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-107437: Use of Hard-coded Credentials

GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime...

CVE-2026-108952: Access of Resource Using Incompatible Type

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rxringbuffer as a Serial V2 rtserialrxfifo in functionenable. A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members...

CVE-2026-96261: Stack-based Buffer Overflow

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash...

CVE-2026-109261: Missing Release of Memory after Effective Lifetime

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails during encoding. Attackers can supply images whose GIF conversion causes quantization to fail, leaking memory with each attempt and...

AlmaLinux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.6:CLSA-2026:1791791753)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791791753 advisory. - libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expatrealloc function on 32-bit platforms when computing...

CentOS Linux 7 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS7:CLSA-2026:1791324825)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1791324825 advisory. - Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with...

PT-2026-110598

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.22 Description A denial of service issue exists where the NanoNemotronVLImageProcessor disables Pillow decompression bomb protection process-wide by setting Image.MAX IMAGE PIXELS to None. This allows remote...

PT-2026-110675

Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.1.0-20 through 7.1.2-31 Description An invalid memory free occurs during the fx operation when the initialization of an FX runtime entry fails. This can be triggered by an attacker to cause memory corruption and...

PT-2026-110677

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description A memory leak exists in the PNG encoder that occurs when libpng initialization fails, preventing the release of allocated memory. An attacker can cause ...

PT-2026-110680

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description A memory leak exists in the YUV encoder, which occurs when the encoder fails to release allocated memory during a failed operation. An attacker can...

PT-2026-110687

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-32 Description A memory leak exists when using the -process option. By providing specific arguments, an attacker can cause memory allocations to remain unreleased. Repeatedly invoking this option with crafte...

PT-2026-110695

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description A memory leak exists in the wavelet-denoise operation, which occurs when the software fails to release allocated memory after failing to acquire a...

PT-2026-110697

Name of the Vulnerable Software and Affected Versions ImageMagick versions 7.1.0-20 through 7.1.2-31 Description A use after free issue exists in the -fx option. This occurs when a memory allocation fails during a specific operation. An attacker can provide crafted -fx expressions while the syste...

PT-2026-110768

Name of the Vulnerable Software and Affected Versions Gitoxide gix-pack versions prior to 0.75.0 Description An uncontrolled memory allocation issue exists where remote attackers can cause a process to abort. By providing a 12-byte pack header that claims 0xFFFFFFFF objects, a malicious remote ca...

CVE-2026-109225: Allocation of Resources Without Limits or Throttling

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before...