libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations,...

pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID

A flaw was found in pyasn1, a generic ASN.1 library for Python. A remote attacker could exploit this vulnerability by sending a specially crafted RELATIVE-OID with excessive continuation octets. This input validation vulnerability leads to memory exhaustion, resulting in a Denial of Service DoS f...

keycloak: Keycloak: Denial of Service via specially crafted SAML input

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language SAML endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service DoS where the server becomes...

keycloak: Keycloak: Denial of Service via specially crafted SAML input

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language SAML endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service DoS where the server becomes...

glib: GLib: Buffer underflow in GVariant parser leads to heap corruption

A flaw was found in GLib Gnome Lib. This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings...

CVE-2026-9064 389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

A flaw was found in 389-ds-base. The getldapmessagecontrolsext function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls...

Astra Linux – Vulnerability in Chromium

In the Blink Serial API in Google Chrome, a memory access out of bounds was allowed before version 97.0.4692.71. This allowed a remote attacker to perform a memory read through a crafted HTML page and a virtual serial port driver...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Service Worker API in Google Chrome prior to version 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

The incorrect security UI in the Browser UI of Google Chrome prior to version 97.0.4692.71 allowed a remote attacker to display a missing URL or an incorrect URL through a crafted URL...

Astra Linux – Vulnerability in HAPProxy

A vulnerability related to uncontrolled resource consumption was discovered in HAProxy, which could cause the service to crash. This issue could allow an authenticated remote attacker to run a specially crafted malicious server within an OpenShift cluster. The most significant impact is related t...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass the same-origin policy and proxy settings through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Dev Tools of Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

In Google Chrome on the Chrome OS, the use of “after free” in Tablet Mode before version 102.0.5005.61 allowed a remote attacker who convinced a user to engage in certain user interactions to potentially exploit heap corruption through those interactions...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the content security policy of Google Chrome prior to version 91.0.4472.77 allowed a remote attacker to bypass the content security policy through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation of the Pointer Lock feature in Google Chrome on Mac before version 105.0.5195.52 allowed a remote attacker to restrict user navigation through a crafted HTML page...

Astra Linux – Vulnerability in WebKit2GTK

The issue was addressed through improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8, and iPadOS 15.7.8, Safari 16.5, iOS 16.5, and iPadOS 16.5. A remote attacker may be able to break out of the Web Content sandbox. Apple is aware of a report...

Astra Linux – Vulnerability in Chromium

Before version 87.0.4280.88, using extensions in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS protections through a crafted HTML page. Chrome security severity: Medium...

Astra Linux – Vulnerability in Chromium

The incorrect security interface in the Loader component in Google Chrome prior to version 89.0.4389.72 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox URL bar through a crafted HTML page...