CVE-2026-123523

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account...

CVE-2026-123523

Vikunja versions prior to 2.7.1 are vulnerable to a memory exhaustion flaw (CWE-770) caused by an unbounded avatar size cache . An authenticated attacker can trigger this by uploading a

CVE-2026-108949

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region'...

php2shell-619-poc

CVE-2026-109619 — PHP Session Upload Progress OOM → RCE Explo...

DEBIAN-CVE-2026-77299

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. ?:50000000 — the match engine executes the empty loop body m-1 times, pushing two integers ont...

CVE-2026-77299

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. ?:50000000 — the match engine executes the empty loop body m-1 times, pushing two integers ont...

CVE-2026-77299 Regexp2: Unbounded memory amplification via large `{m}` quantifier on a zero-width subexpression

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. ?:50000000 — the match engine executes the empty loop body m-1 times, pushing two integers ont...

CVE-2026-77299

The Regexp2 library for Go (prior to version 2.3.0 ) is vulnerable to unbounded memory amplification via a large {m} quantifier on a zero-width subexpression. When the engine matches a pattern like (?:){50000000}, it executes an empty loop body, pushing two integers onto the backtracking stack fo...

CVE-2026-77299 Regexp2: Unbounded memory amplification via large `{m}` quantifier on a zero-width subexpression

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. ?:50000000 — the match engine executes the empty loop body m-1 times, pushing two integers ont...

EUVD-2026-117884

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. ?:50000000 — the match engine executes the empty loop body m-1 times, pushing two integers ont...

UBUNTU-CVE-2026-77299

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. ?:50000000 — the match engine executes the empty loop body m-1 times, pushing two integers ont...

CVE-2026-112336: wazuh: Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows…

Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields su...

Linux Distros Unpatched Vulnerability : CVE-2026-77299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier...

CVE-2026-77299

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. ?:50000000 — the match engine executes the empty loop body m-1 times, pushing two integers ont...

CVE-2026-77299: dlclark regexp2: Regexp2 is a feature-rich RegExp engine for Go

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression — e.g. ?:50000000 — the match engine executes the empty loop body m-1 times, pushing two integers ont...

Linux Distros Unpatched Vulnerability : CVE-2026-108949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary...

CVE-2026-108949

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region'...

UBUNTU-CVE-2026-108949

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region'...

CVE-2026-108949

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region'...

CVE-2026-108949

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region'...