PT-2026-72723

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctp verify asconf and sctp verify param only validate ADD IP, DEL IP, and SET PRIMARY parameters against a fixed minimum size of sizeofstruct sctp addip param + sizeofstruct sctp...

MINI-JP43-9FFR-VJP2

Bulletin has no description...

MINI-JQHX-JHXR-GWXQ

Bulletin has no description...

GHSA-4X9G-VW65-VVF9 Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Summary An unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down. Details Grav::fallbackUrl...

Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Summary An unauthenticated visitor exhausts server memory and CPU by requesting an image with oversized resize dimensions. One request drives a worker to several gigabytes of RAM and tens of seconds of CPU. A few concurrent requests take the host down. Details Grav::fallbackUrl...

CVE-2026-73558

A flaw was found in vLLM, an inference and serving engine for large language models. An integer overflow vulnerability in the actandmulkernel kernel allows a remote attacker to cause cross-user data leakage. By crafting specific requests processed in the same inference batch, an attacker can obta...

CVE-2026-58224

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequa...

CVE-2026-72824

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent. The Twig-toggle check uses a bare isSuperAdmin gate that does not consult apikeyscopes, so a least-privilege API key scoped only to api.pages.write and minted on a...

Exploit for OS Command Injection in Devcode Openstamanager

OpenSTA-Exploit --- About CVE-2025-...

GO-2025-3638 vulnerabilities

Vulnerabilities for packages: nuclei...

CVE-2026-18671

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds checking in request processing. The attacker could exploit this vulnerability to cause a temporary denial of service...

EUVD-2026-58474

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities...

CVE-2026-18715

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities...

CVE-2026-72676

Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...

CVE-2026-19026

A flaw was found in HDF5. A remote attacker could craft a malicious HDF5 file that, when opened and read, would cause an application using the HDF5 library to crash. This issue stems from improper validation of input data within the N-Bit filter, leading to a denial of service DoS and impacting t...

CVE-2026-33328

A flaw was found in libvips, an image processing library. On 32-bit systems, a vulnerability in the gifload operation could lead to an integer overflow due to incorrectly determined image dimensions. This could allow a local attacker to cause the application to crash, resulting in a denial of...

CVE-2026-73559

CVE-2026-73559 affects vLLM (0.19.0–0.26.0) where the /v1/completions prompt field can be an unbounded list, and prompt_to_seq/remove expansion in preprocessing may spawn unbounded expansion and create one engine generator/response slot per prompt. This can exhaust CPU, memory, async scheduling c...

python-idna security update

An update is available for python-idna. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

PT-2026-71673

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.27.0 Description An integer overflow occurs in the calculation blockIdx.x 2 d within the activation kernels.cu file. This flaw can cause the act and mul kernel function to consume input from another user within the sam...

CVE-2026-72676: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...