CVE-2026-105742

The docling library (versions 2.95.0 through 2.132.0 ) contains a vulnerability in the HTML image resource loader located at docling/backend/utils/image_resource_loader.py. When enable_remote_fetch=True and fetch_images=True are set, the loader forwards custom headers—such as API keys and cookies...

CVE-2026-105444

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. T...

CVE-2026-105444

A security flaw exists in dotnet eShop .NET 8 within the Ordering API component. Specifically, the GetOrderAsync function in the file src/Ordering.API/Apis/OrdersApi.cs is vulnerable to resource injection (CWE-99). By manipulating the OrderNumber argument, an attacker can achieve improper control...

CVE-2026-105444 dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. T...

CVE-2026-105444 dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. T...

EUVD-2026-92801

A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/Apis/OrdersApi.cs of the component Ordering API. Performing a manipulation of the argument OrderNumber results in improper control of resource identifiers. T...

CVE-2026-105699 Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. readresource forwarded the...

CVE-2026-105699

Langflow versions 1.6.8 through 1.9.1 are vulnerable to an authenticated cross-project file disclosure due to unscscoped MCP resource handlers. The application validates project identifiers but fails to authorize the resource URI provided to resources/read. Consequently, an attacker can bypass pr...

CVE-2026-105699 Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. readresource forwarded the...

CVE-2026-105699 Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. readresource forwarded the...

CVE-2026-90187

A flaw was found in the nullblk module of the Linux kernel. When a zoned nullblk device is powered off and then on again, the memory allocated for device zones is not properly freed. This oversight causes a memory leak with each power cycle, which could lead to resource exhaustion over time...

CVE-2026-89982

A flaw was found in the Linux kernel's I2C Inter-Integrated Circuit multiplexer mux subsystem. This vulnerability can lead to a resource leak if an adapter fails to register, as a system resource is not properly released. Over time, this could result in resource exhaustion, potentially causing...

CVE-2026-89877

A flaw was found in the saa7164 media driver in the Linux kernel. When the saa7164devsetup function fails to allocate PCI BAR memory regions, it incorrectly leaves a dangling entry on the global device list. This improper cleanup of resources can lead to a resource leak, potentially allowing a...

CVE-2026-93089

A flaw was found in the armscmi firmware component of the Linux kernel. This vulnerability occurs when a transport channel setup succeeds but the subsequent IDR ID allocator insertion fails. In such a scenario, the error handling path incorrectly destroys the transport device and frees channel...

CVE-2026-90434

A flaw was found in the Linux kernel's isofs filesystem driver. When processing compressed block pointer tables via the zisofsfillpages function, a memory resource is not properly released upon successful operation. A local attacker could potentially exploit this resource mismanagement, possibly ...

CVE-2026-90287

A flaw was found in the Linux kernel's Sunplus PHY Physical Layer driver. Improper error handling within the spuphyinit function could lead to the leakage of clock and reset resources. This resource exhaustion could potentially be exploited by a local attacker, resulting in a Denial of Service Do...

CVE-2026-90087

A flaw was found in the Linux kernel's Bluetooth Low Energy LE subsystem. When multiple LE connection attempts are made concurrently, and one connection fails, the system may not properly release the failed connection's resources. This resource leak can prevent all subsequent outgoing LE connecti...

CVE-2026-90007

A flaw was found in the Linux kernel's pm8001 SCSI driver. When pm8001requestmsix attempts to free Message Signaled Interrupts MSI-X vectors, it uses an incorrect index during the rollback process. This error prevents previously registered interrupt handlers from being properly deallocated, leadi...

CVE-2026-89909

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for LoongArch architecture. During initialization, if a specific setup function fails, critical resources are not properly released. This can lead to a resource leak, potentially allowing a local attacker to cause a denial of...

CVE-2026-89889

A flaw was found in the Linux kernel's i2c imx415 media driver. When programming VMAX fails, the VBLANK path returns immediately without releasing a previously acquired runtime power management PM reference. This oversight can lead to a resource leak, potentially allowing a local attacker to caus...