CVE-2020-37286

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can...

[slackware-security] c-ares

New c-ares packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/c-ares-1.34.9-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Memory corruption when an application cancels its...

CLEANSTART-2026-WZ49718 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Security vulnerability affects the helm-operator-fips package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

CVE-2026-114115

Vyper versions 0.3.8 through 0.5.0b1 are affected by a compiler miscompilation vulnerability in parse_IfExp. The issue occurs when a ternary operator selects a nested array with narrower inner bounds, but the compiler uses the memory layout of the wider result type. This results in inner arrays a...

CVE-2026-114115 Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parseIfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing...

CVE-2026-114115 Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parseIfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing...

CVE-2026-114115 Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parseIfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing...

EUVD-2026-106914

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability CVE-2026-96889 that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may...

CVE-2026-114111

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability CVE-2026-96889 that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may...

CVE-2026-114111 Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability CVE-2026-96889 that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may...

CLEANSTART-2026-DW84477 napi_get_value_string_*() allows various kinds of memory corruption in node < 10

Security vulnerability affects the nodejs-24 package. napigetvaluestring allows various kinds of memory corruption in node 10...

CLEANSTART-2026-SD27906 Memory-safety vulnerability in github

Security vulnerability affects the cloudnative-pg-fips package. Memory-safety vulnerability in github...

CVE-2026-114103

The adm-zip library version 0.6.0 is vulnerable to a decompression bomb protection bypass within the methods/inflater.js file. Specifically, the getDataAsync() path fails to properly enforce the maxOutputLength guard. Attackers can exploit this by crafting malicious ZIP entries with falsified sma...

CVE-2026-114103 adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...

CVE-2026-114103

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...

EUVD-2026-106906

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...

CVE-2026-114103 adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync path in methods/inflater.js. Attackers can craft ZIP entries with falsified small declared sizes and high-ratio DEFLATE payloads to...

CVE-2026-114055

Versions vLLM from 0.7.3 before 0.31.0 are vulnerable to an uncontrolled resource consumption flaw (CWE-400 ). The issue stems from unvalidated mm_processor_kwargs parameters supplied by remote clients. Attackers can manipulate values such as image size, patch count, crop count, or frame count in...

CVE-2026-114055 vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...

CVE-2026-114055 vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mmprocessorkwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac,...