CVE-2024-58379 nodemailer before 6.9.9 ReDoS via attachDataUrls parameter

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...

CVE-2024-58379

nodemailer before 6.9.9 contains a regular expression denial of service (ReDoS) vulnerability in email parsing, triggered when the attachDataUrls parameter is set or when processing embedded file attachments. Attackers can send specially crafted emails containing malicious data URLs or embedded a...

CVE-2024-58379

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop...

CVE-2026-80667

A flaw was found in the Linux kernel's Mellanox mlx5 network driver, specifically within the Multi-Port Ethernet Switch MPESW work handling for Link Aggregation Groups LAG. When the mlx5laggetdevcomcomp function returns a null value, the mlx5mpeswwork function fails to call complete. This oversig...

CVE-2026-80655

A flaw was found in the Linux kernel's zynqmppower driver. A race condition during event registration could allow a local attacker to trigger a system crash. This occurs because certain work structures are registered before they are properly allocated and initialized. If firmware triggers an even...

CVE-2026-72818

A flaw was found in NLTK. The TweetTokenizer component, used for processing social media text, contains a regular expression vulnerability. A remote unauthenticated attacker can provide specially crafted input containing many alternating label separators, causing the regular expression to backtra...

CVE-2026-80629

A flaw was found in the Linux kernel's octeontx2-af: npc component. This vulnerability arises from incorrect memory allocation when processing reserved MCAM entries for the CPT 2nd pass, leading to a small out-of-bounds write. An attacker could potentially exploit this memory corruption to cause ...

CVE-2026-80618

A flaw was found in the kernel's AMD GPU driver drm/amdkfd. This vulnerability occurs when the driver attempts to unpin a memory buffer object BO twice during memory deallocation. A local attacker could exploit this double-unpin operation, leading to a memory management error. This issue can caus...

Important: Red Hat Security Advisory: rhc security update

An update for rhc is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

CVE-2026-80689

A flaw was found in the Linux kernel's mmiotrace component. When the mmiotracearray is not initialized or is disabled, invoking mmiotracerw or mmiotracemapping can lead to a NULL pointer dereference. This can cause a system crash, resulting in a Denial of Service DoS...

CVE-2026-80694

A flaw was found in the Linux kernel's mtkethsoc Ethernet driver. The mtkpollcontroller function incorrectly passed a netdevice pointer instead of an mtketh structure to mtkhandleirqrx. This incorrect parameter passing can lead to a system crash when ndopollcontroller is called with...

CVE-2026-66393

A flaw was found in NLTK. A remote attacker can exploit an unbounded recursion vulnerability in the JSONTaggedDecoder.decodeobj function by supplying deeply nested JSON structures. This can cause the Python process to crash, leading to a denial of service. Mitigation To mitigate this vulnerabilit...

CVE-2026-80664

A flaw was found in the Linux kernel's netfilter component, specifically within the xtnat SNAT and DNAT target handlers. These handlers incorrectly assume the presence of an IP-family connection tracking state. A local attacker, by instantiating these handlers from an unsupported family, such as ...

CVE-2026-80718

A flaw was found in the Linux kernel. Specifically, within the mm/percpu-km module, the pcpucreatechunk function incorrectly calculates the size of a bitmap used for tracking memory pages. This miscalculation can lead to a bitmap overflow, where data is written beyond the intended memory boundary...

Low: Red Hat Security Advisory: php security, bug fix, and enhancement update

An update for php is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD

A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...

php: PHP: Denial of Service via circular symbolic links in phar archives

A flaw was found in PHP. When processing a specially crafted PHP Archive phar file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow...

CVE-2026-70654

A flaw was found in libvips, an image processing library. When applications process untrusted uncompressed PPM Portable Pixmap images through unusual custom libvips sources, a heap buffer overflow can occur. This vulnerability, located in the vipssourcereadtomemory function, allows a local attack...

CVE-2026-80677

A flaw was found in the Linux kernel driver core. The devhassyncstate function reads the dev-driver pointer multiple times without proper synchronization. This allows a concurrent unbind operation to clear the dev-driver pointer between reads. Such a race condition could lead to a null pointer...