CVE-2026-110854

Parse Server versions prior to 8.6.97 and 9.0.0 before 9.10.2-alpha.6 are vulnerable to a Denial of Service (DoS) attack. The root cause is an unhandled exception (CWE-248) occurring when the server attempts to send verification or password reset emails. If a mail provider rejects the request, ap...

CVE-2026-77375

The open-source file transfer solution SFTPGo is vulnerable to a Denial of Service (DoS) condition in versions prior to 2.7.5 . An authenticated SSH user can trigger an unhandled error by sending a malformed protocol message while opening a channel. This flaw causes the server process to terminat...

CLEANSTART-2026-NZ57247 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual...

CLEANSTART-2026-ZC63840 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details...

CVE-2026-97031

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

CVE-2026-97031

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

CVE-2026-97031

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

DEBIAN-CVE-2026-106446

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile and Handlebars.precompile accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST...

CLEANSTART-2026-ZJ64953 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the prometheus-redis-exporter-fips package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

AZL-101070 CVE-2026-84445 affecting package multus 4.0.2-11

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

AZL-101043 CVE-2026-84445 affecting package kata-containers for versions less than 3.32.0.kata0-6

gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...

CVE-2026-84445

CVE-2026-84445 affects gRPC-Go prior to versions 1.82.2 and 1.83.2 . Servers created via xds.NewGRPCServer() accept RPCs containing neither the :authority nor Host header. The RouteAndProcess function in internal/xds/server/routing.go then assumes an authority value exists and indexes an empty sl...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who could connect to the magick-distribute-cache service could cause a heap buffer overflow in the server process. This issue has been fixed in...

CVE-2026-90782: NULL Pointer Dereference

S2OPC through 1.7.3 contains a null pointer dereference in msgsubscriptionpublishbsallocnotificationmessageitems where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions wit...

CVE-2026-78625: Improper Control of Generation of Code

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...

CVE-2026-82061: Use After Free

A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. N...

CVE-2026-82447

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block...

EUVD-2026-43000

Snipe-IT has a path traversal vulnerability via CSV import image field...

CVE-2026-82260

SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 with the experimental remoteFunctions and form features enabled are vulnerable to memory exhaustion in remote form deserialization. Malformed form data triggers excessive memory allocation, crashing the server process and causing a denial o...

CVE-2026-55565: Improper Control of Generation of Code

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCodegetValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through...