SUSE CVE-2026-110829

FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...

SUSE CVE-2026-110830

FreeRDP before 3.32.0 fails to close prior serial handles in serialprocessirpcreate, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRPMJCREATE requests to accumulate descriptors and terminate the client at the CommReadFile FDSETSIZE assertion...

CVE-2026-15176

A flaw was found in nginx. A remote, unauthenticated attacker can trigger a heap-based buffer overflow by sending crafted HTTP requests to a server configured with specific alias and rewrite directives that reference the request filename variable. Successful exploitation may allow an attacker to...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception via the DecompressHandler in lib/interceptor/decompress.js, where an uncaught exception thrown by a downstream handler during onResponseData or...

CVE-2026-111313 JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

CVE-2026-111313 JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

CVE-2026-111313

The JobOps software (versions through 0.13.1 ) is vulnerable to a Server-Side Request Forgery (SSRF) in the POST /api/manual-jobs/fetch handler. This flaw allows authenticated users or unauthenticated clients in demo mode to force the server to fetch internal destinations by supplying loopback, p...

wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector

A flaw was found in Wireshark. A remote attacker could exploit a vulnerability in the H.245 protocol dissector. By crafting and sending malformed H.245 protocol data, an attacker could cause the Wireshark application to crash when a user processes this untrusted network data, leading to a denial ...

wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write

A flaw was found in Wireshark. This vulnerability allows a remote attacker to cause a denial of service DoS by sending a specially crafted Universal Mobile Telecommunications System UMTS RRC protocol packet. The flaw resides in the UMTS RRC protocol dissector, which can lead to a crash of the...

Moderate: Red Hat Security Advisory: wireshark security update

An update for wireshark is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector

A flaw was found in Wireshark. A remote attacker could exploit a denial of service vulnerability in the ESS protocol dissector by processing a specially crafted network packet. This could lead to the application crashing, preventing network traffic analysis. The impact is limited to the...

CVE-2026-77622

Sliver is vulnerable to a Denial of Service DOS attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running server, leading...

CVE-2026-109468

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-105040

The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests mass assignment. A registered user can set another account's identifier and take over that account...

CVE-2026-105034

The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services...

CVE-2026-109468

A flaw was found in ASP.NET Core. The application framework fails to enforce limits or throttling on resource allocation when handling network requests. An unauthenticated remote attacker could exploit this vulnerability to exhaust system resources, leading to a Denial of Service DoS...

zeroheight-account-verification-bypass-CVE-2025-65925

CVE-2025-65925 — Zeroheight Incorrect Access Control in Account Creation Flow Disclosure Date: 2025-06-11 Vendor fix date per vendor: 2025-06-13 Researcher validation date: 2025-06-26 Discovered by: Sneden Rebello Summary A legacy user creation API pathway allowed accounts to be created without...

CVE-2026-104150

A flaw was found in AdonisJS HTTP Server. An unauthenticated remote attacker could cause a Denial of Service DoS by sending an HTTP request containing a specially crafted route parameter. Due to an inefficient regular expression in the slug route matcher, evaluating the input causes excessive CPU...

CVE-2026-109468

A vulnerability exists in ASP.NET Core where the application framework fails to enforce limits or throttling on resource allocation when processing network requests. An unauthenticated remote attacker can exploit this flaw to exhaust system resources, resulting in a Denial of Service (DoS) . No s...

CVE-2026-111157

A flaw was found in SoX. An attacker can exploit this vulnerability by tricking a user or automated system into opening a specially crafted WAV audio file. During audio decoding, an invalid block sample value causes a heap-based out-of-bounds write, leading to an application crash, resulting in a...