675840 matches found
Keras model loading is vulnerable to denial of service through HDF5 shape bombs
A vulnerability in keras-team/keras versions 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading t...
PYSEC-2026-3804 Accelerate path traversal and denial of service via sharded checkpoint weight_map entries
Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...
Uncontrolled recursion DoS in JustHTML() via deeply nested HTML
Summaryjusthtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML.init always reaches TreeBuilder.finish, which unconditionally calls populateselectedcontent. That function recursively traverses the DOM via findelements / findelement without a depth bound,...
PYSEC-2026-3854 Uncontrolled recursion DoS in JustHTML() via deeply nested HTML
Summary justhtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML.init always reaches TreeBuilder.finish, which unconditionally calls populateselectedcontent. That function recursively traverses the DOM via findelements / findelement without a depth bound,...
OPENSUSE-SU-2026:21827-1 Security update for python-jwcrypto
This update for python-jwcrypto fixes the following issues: - CVE-2026-80179: denial of service via malformed JWE tokens bsc1277639. - CVE-2026-84185: general JSON JWS kid binding bypass during JWKSet verification bsc1278707...
CVE-2026-87824
A flaw was found in zstd-jni. Attackers can exploit this by supplying oversized per-sample lengths to the Zstd.trainFromBufferDirect function, which fails to validate the samples buffer capacity. This allows for reading past buffer boundaries, leading to out-of-bounds memory access and ultimately...
vim: Vim: Denial of Service via out-of-bounds write in terminal handling
A flaw was found in Vim, an open-source command-line text editor. This vulnerability allows a program displaying output in a Vim terminal window to trigger an out-of-bounds write by sending a specific byte sequence. This can lead to a crash of the Vim application, resulting in a Denial of Service...
vim: Vim: Denial of Service via crafted spell file
A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by convincing a user to load a specially crafted spell file. This malicious file can trigger a stack out-of-bounds write, which corrupts the editor's memory and causes it to crash...
vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding
An out-of-bounds write vulnerability in Vim's spellsoundfoldsal function allows an attacker to corrupt memory and crash the editor Denial of Service by supplying a specially crafted word during spell sound-folding...
Important: Red Hat Security Advisory: vim security update
An update for vim is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator
A flaw was found in Vim. A remote attacker could exploit a heap-based buffer overflow and an out-of-bounds read vulnerability in Vim's terminal emulator. This occurs when processing specially crafted Unicode supplementary plane characters, potentially leading to information disclosure and denial ...
apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack
A flaw was found in Apache Portable Runtime Utility apr-util. A remote attacker could exploit a stack recursion vulnerability by providing specially crafted XML input to a library consumer that uses the aprxmlquoteelem function. This could lead to a denial of service DoS due to an application cra...
apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client
A flaw was found in the Redis client in the Apache Portable Runtime Utility apr-util. A heap buffer overflow can be triggered when the application processes a specially crafted response from a Redis server, resulting in a crash and denial of service...
apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
A flaw was found in the memcached client in the Apache Portable Runtime Utility apr-util. A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of...
FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway
A flaw was found in FreeRDP. FreeRDP clients using TS Gateway are vulnerable to a heap-buffer-overflow. A malicious gateway can send a specially crafted response fragment, causing the client to write beyond its allocated buffer. This can lead to a client crash, resulting in a Denial of Service Do...
CVE-2026-87877
A flaw was found in zstd-jni. An attacker could exploit a use-after-free vulnerability by calling specific methods on closed streams without proper validation. This could lead to memory corruption, potentially allowing the attacker to corrupt unrelated objects or cause the Java Virtual Machine JV...
CVE-2026-88290
GeoVision GV-LPC2211 V1.14 260903 allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources...
CVE-2026-88289
GeoVision GV-LPC2211 V1.14 260903 fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service...
CVE-2026-88288
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...