PT-2026-102716

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse auth header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passe...

CVE-2026-61670: Invocation of Process Using Visible Sensitive Information

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandboxcmd.rs...

CVE-2026-75894: Reachable Assertion

In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranaphandlecodt function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service...

CVE-2026-64847: Allocation of Resources Without Limits or Throttling

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

CVE-2026-77339: Missing Authentication for Critical Function

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or...

CVE-2026-55556: Heap-based Buffer Overflow

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...

CVE-2026-46655: Heap-based Buffer Overflow

virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTLSELECT request with attacker-controlled VIRTIOVSOCKSELECT.Fdss.fdcount values that overflow the 32-bit sum used by VIOSockSelect...

CVE-2026-63420: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channelbuffers than the spec.nchannels value advertised ...

PT-2026-95475

Name of the Vulnerable Software and Affected Versions Mojolicious versions prior to 9.47 Description The pure-Perl implementation of Mojo::JSON fails to limit nesting depth when the MOJO NO JSON XS variable is enabled or when Cpanel::JSON::XS is unavailable. An attacker can provide untrusted JSON...

PT-2026-95706

Name of the Vulnerable Software and Affected Versions microsandbox versions prior to 0.5.10 Description The software serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments within sdk/rust/lib/runtime/spawn.rs and...

PT-2026-95365

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 ImageMagick versions prior to 6.9.13-56 Description A use-after-free issue exists in the ImagesToBlob function, where a pointer is not updated correctly. This can lead to a crash of the affected process,...

PT-2026-95396

Name of the Vulnerable Software and Affected Versions Imager for Perl versions prior to 1.036 Description Processing a TGA file with a colour map length of 32768 or more triggers an uncatchable process exit when using the Imager-read function. This occurs because the reader unpacks the two-byte...

PT-2026-95548

Name of the Vulnerable Software and Affected Versions AnyIO versions prior to 4.14.2 Description AnyIO starts process-pool workers with the standard error stream connected to a pipe that the parent process never drains. Although documentation states all three standard streams are redirected, the...

CVE-2026-93435

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

DEBIAN-CVE-2026-50291

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in...

CVE-2026-50291

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in...

CVE-2026-93435 redis-parser through 3.0.0 Denial of Service via Unbounded Recursion

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust t...

CVE-2026-93435

redis-parser through 3.0.0 contains a denial of service vulnerability in its RESP protocol parser . A malicious Redis endpoint can send crafted RESP byte streams with repeated array headers that trigger unbounded recursion on nested arrays, exhausting the V8 call stack . This produces an uncaught...

CVE-2026-93378

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: Medium...

CVE-2026-93380

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...