Rocky Linux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1787333229)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787333229 advisory. - A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs whe...

Rocky Linux 9 [CIQ] Security Update: perl-XML-Parser / perl-XML-Parser-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_7679)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20267679 advisory. perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files CVE-2006-10003 perl-xml-parser: XML::Parser for Perl: Heap corruption and denia...

[SECURITY] [DLA-4803-1] ruby-oj security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4803-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley September 30, 2026 https://wiki.debian.org/LTS -...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

Important: Red Hat Security Advisory: python3.9 security update

An update for python3.9 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

OPENSUSE-SU-2026:21985-1 Security update for valkey

This update for valkey fixes the following issue: - CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to an out-of-bounds read bsc1281417...

CVE-2026-102990

The basic-ftp FTP client for Node.js (prior to version 6.2.1 ) is vulnerable to a quadratic-time CPU denial of service . A malicious or compromised FTP server can trigger this by providing a crafted directory listing where the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent ...

CVE-2026-102990 basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

CVE-2026-103241

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has bee...

EUVD-2026-90191

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has bee...

CVE-2026-103241 vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has bee...

thunderbird: One byte overflow read in mail parser

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by sending a maliciously constructed mail header. This could lead to a one-byte read past the end of a buffer, potentially resulting in information disclosure or other unpredictable behavior...

thunderbird: Out-of-bounds read in IMAP response parser

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged ' ID' response, crashing Thunderbird. The affected parsing path is...

firefox: thunderbird: Use-after-free in the DOM: HTML Parser component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: HTML Parser component...

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop DoS vulnerability discovered by ? in WordPress Npm axios versions = 1.16.1, 1.20.0...

SUSE CVE-2026-96420

Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service...

gimp: gimp: Integer overflow in read_RLE_channel()

A flaw was found in GIMP's PSD parser. An integer overflow in readRLEchannel can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitra...

OESA-2026-4229 wireshark security update

Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless WiFi or Bluetooth networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. Security Fixes: SPDY...

OESA-2026-4178 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16...