CVE-2026-93136

A flaw was found in the Linux kernel's Mobile Host Interface MHI endpoint driver. An issue in the error handling path during MHI device creation can lead to a resource leak. Specifically, if certain device setup operations fail, not all allocated device references are properly released. This can...

CVE-2026-93130

A flaw was found in the Linux kernel's dell-wmi-base module, which handles system management functions for Dell hardware. This vulnerability is a resource leak, meaning that system resources are not properly released after use. When the dell-wmi-base module fails to load, it does not correctly...

CVE-2026-93116

A flaw was found in the asus-wmi driver of the Linux kernel. During driver initialization, an error handling issue can lead to resource leaks. This occurs because cleanup calls for previously registered subsystems are bypassed when certain initialization functions fail. A local attacker could...

CVE-2026-93072

A flaw was found in the Linux kernel's irqchip/renesas-irqc driver. When the driver is removed, generic interrupt chips are not properly freed, leading to a resource leak. This can result in a use-after-free vulnerability, where a local attacker could potentially trigger a kernel crash...

CVE-2026-92524

A flaw was found in the Linux kernel's irqchip/gic-v3-its component. A resource leak occurs when the itsirqgicdomainalloc function fails to properly deallocate resources during error handling. This can lead to a denial of service DoS due to excessive memory consumption...

CVE-2026-90119

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture ice1712 component. This vulnerability occurs when the sndice1712probe function, responsible for initializing the sound card, encounters an error. During such failures, the system does not properly release allocated ALSA...

CVE-2026-89944

A flaw was found in the Linux kernel's Audio System on Chip ASoC High Definition Audio Codec hdachda component. During the device probing process, a reference to an HDA link is acquired but not properly released if the ASoC component registration fails. This oversight leads to a reference count...

CVE-2026-89900

A flaw was found in the Linux kernel's media CEC Consumer Electronics Control core. A memory leak kmemleak can occur because a device deallocation function rcfreedevice is not called when a CEC device is unbound. This oversight, introduced by a previous code change, prevents the proper release of...

CVE-2026-89886

A flaw was found in the Intel IPU6 media driver within the Linux kernel. This vulnerability occurs when the driver fails to properly clean up resources during an error in processing device connections. An attacker could potentially exploit this by triggering a specific error condition, leading to...

CVE-2026-89872

A flaw was found in the Linux kernel's v4l2-fwnode media subsystem. A local attacker or a malicious application could exploit this by failing to properly release a fwnode reference in the v4l2fwnodeparselink function. This resource leak could lead to system instability or a denial of service DoS,...

CVE-2026-89862

A flaw was found in the Linux kernel's qla2xxx SCSI driver. A local attacker could exploit this vulnerability by triggering an error in the qla28xxvalidateflashimage function. Due to incorrect error handling, Block SCSI Generic BSG jobs are not properly completed, causing them to remain active an...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

EUVD-2026-84182

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service...

Allocation of Resources Without Limits or Throttling

Overview zapros is a Modern and extensible HTTP client for Python. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via getcontentdecoder in src/zapros/models.py, where an attacker can send an HTTP response with an unbounded number of...

Allocation of Resources Without Limits or Throttling

Overview zapros is a Modern and extensible HTTP client for Python. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via decompression of streaming responses in decoders.py, where compressed content gzip, deflate, or brotli is decompressed...

EUVD-2026-85288

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated...

DEBIAN-CVE-2026-78383

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1...

CVE-2026-78383

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1...

DEBIAN-CVE-2026-77791

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...