CVE-2026-82669 klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

CVE-2026-82669

klaussilveira GitList 2.0.0 is affected by a denial of service vulnerability in the XML Parsing component, specifically the SimpleXMLElement function in src/SCM/System/Git/CommandLine.php. A remote attacker can trigger the flaw with low complexity and no authentication, causing partial availabili...

CVE-2026-82669 klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out...

CVE-2025-44203

CVE-2025-44203: HotelDruid 3.0.0 / 3.0.7 機密情報の開示および DoS 概要 HotelDruid 3.0.0 および 3.0.7 には、セットアップ完了前に到達可能な creadb.php セットアップエンドポイントに競合状態があります。影響は 2 つあり、どちらも同じ敗北した競合に起因します: 機密情報の開示冗長な SQL エラーメッセージによるとサービス拒否DoSです。 一度に多数の POST...

CVE-2026-80693

A flaw was found in the Linux kernel's idpf component. A privileged control plane such as a Physical Function or a hypervisor device model could exploit a vulnerability by providing a malformed reply to an interrupt-vector allocation request. This malformed reply, where the sum of per-chunk vecto...

CVE-2026-80648

A flaw was found in the pinctrl pin controller driver for SpacemiT systems in the Linux kernel. An incorrect NULL check in the spacemitpinsetconfig function can lead to a NULL pointer dereference. This occurs when the system attempts to configure a pin that is not present in the SoC's pin table,...

CVE-2026-80636

A flaw was found in the Netfilter conntrack component of the Linux kernel. This vulnerability arises from the improper handling of connection tracking conntrack extensions. Specifically, a codebase change that disables all conntrack extensions for unconfirmed conntracks, without proper null check...

CVE-2026-80628

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture sequencer OSS Open Sound System emulation. A local user could exploit a data race condition when the sndseqossreadqclear function resets the read queue state without proper locking. This can lead to stale records, dropp...

CVE-2026-42945

CVE-2026-42945: NGINX Rift 堆缓冲区溢出漏洞 概述 CVE-2026-42945 是 NGINX 服务器中的一个严重堆缓冲区溢出漏洞，被称为 "NGINX Rift"。该漏洞存在于 NGINX 的 rewrite 和 set 指令处理逻辑中，当特定配置条件满足时，攻击者可以通过构造恶意请求触发堆溢出，导致拒绝服务（DoS）甚至潜在的远程代码执行（RCE）。 漏洞类型 ：堆缓冲区溢出 风险等级 ：高危 CVE ID ：CVE-2026-42945 影响范围 受影响版本 ：NGINX 0.6.27 1.30.0 不受影响版本 ：NGINX 1.31.0 及更高版本...

CVE-2026-80682

A flaw was found in the Linux kernel's RISC-V memory management component. An incorrect calculation for memory alignment during system initialization could lead to a kernel warning. This issue arises when the physical memory base address is not properly aligned, potentially causing system...

CVE-2026-80678

A flaw was found in the Linux kernel's i2c: imx driver. A race condition during I2C slave registration and error handling could lead to a NULL pointer dereference. This occurs when the i2cimx-slave pointer is not properly cleared or assigned, especially if power management operations fail or if t...

EUVD-2026-68411

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a...

CVE-2026-81624

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a...

CVE-2026-80633

A flaw was found in the Linux kernel's iommufd component. A local user could trigger a kernel warning by releasing the last reference on a Direct Memory Access Buffer DMABUF-backed IOMMU page table without holding the necessary dmaresv lock. This missing lock operation can lead to system...

CVE-2026-80621

A flaw was found in the Linux kernel's PCI DesignWare Cores DWC driver. When the controller lacks RAS DES capability, the dwcpcierasdesdebugfsinit function can incorrectly report success, leaving a pointer uninitialized. During debugfs teardown, the dwcpcierasdesdebugfsdeinit function then attemp...

CVE-2026-80725

A flaw was found in the Linux kernel’s Generic Receive Offload GRO component, which handles network packet aggregation. Improper validation of BIG TCP aggregation criteria allows a remote attacker to send specially crafted network frames. This can lead to an out-of-bounds write when processing IP...

CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

CVE-2026-82864

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method. An attacker can supply a crafted PDF with a FlateDecode stream containing a decompression bomb, causing a small compressed file to decompress to hundreds of megabytes. ...

CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

EUVD-2026-68399

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...