CVE-2026-78148

A flaw was found in the ggml-RPC Server component of llama.cpp. A remote attacker can exploit this vulnerability by performing a specific manipulation, leading to a null pointer dereference. This can result in a Denial of Service DoS, making the affected system unavailable. Mitigation For systems...

RLSA-2026:76747 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command...

Apache OFBiz < 18.12.10 - Arbitrary Code Execution

Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. id: CVE-2023-49070 info: name: Apache OFBiz 18.12.10 - Arbitrary Code Execution author: your3cho severity: critical description: | Pre-auth RCE in Apach...

Apache Ratis 3.3.1 Java Deserialization

Summary Apache Ratis is a highly customizable Raft protocol implementation in Java. Raft is a easily understandable consensus algorithm to manage replicated state. Apache Ratis could be used in any Java application where state should be replicated between multiple instances. Description Apache...

Apple IOKit DriverKit Race Condition

Apple IOKit contains a race condition that may allow an app to cause unexpected system termination or write kernel memory. The supplied analysis includes a sanitizer-checked proof of concept model of the reported DriverKit RPC state-handling flaw...

RockyLinux 10 : opentelemetry-collector (RLSA-2026:76743)

The remote RockyLinux 10 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:76743 advisory. google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-84445 Tenable has extracted the preceding description block directly from...

disable-RegisterSpoolerRemoteRpcEndPoint

disable-RegisterSpoolerRemoteRpcEndPoint Workaround for Windows Print Spooler Remote Code Execution VulnerabilityCVE-2021-34527. See: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527 Update 2021-07-08: Microsoft released a patch Microsoft already released a patch for this...

DEBIAN-CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in JSONReader.string and JSONReader.skipWhiteSpace in com.rabbitmq.tools.json, neither of which treats CharacterIterator.DONE as a terminator, so the string scanner appends that sentinel without bound and the line comment...

CVE-2026-106122 RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by...

CVE-2026-106122 RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by...

CVE-2026-106122

The RabbitMQ Java client library (prior to version 5.36.0 ) is vulnerable to an encoding error in the ValueReader.readShortstr method. This method improperly decodes malformed UTF-8 bytes into replacement characters, which can bypass the AMQP shortstr length limits enforced by ValueWriter.writeSh...

CVE-2026-106122 RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by...

FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway

A flaw was found in FreeRDP. A remote attacker can exploit a buffer over-read vulnerability within the RPC Remote Procedure Call gateway transport parser by sending a malicious BINDACK Protocol Data Unit PDU with a truncated result entry. This can lead to a process abort, resulting in a Denial of...

google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...

Important: Red Hat Security Advisory: opentelemetry-collector security update

An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-106041

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...

CVE-2026-106041 Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...

CVE-2026-106041 Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...