PT-2026-116113

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a...

Red Hat: CVE-2026-110752: perl-Text-CSV_XS: perl-Text-CSV_XS: Denial of Service via excessive memory allocation in fragment selector

Text::CSVXS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end colum...

Red Hat: CVE-2026-110753: perl-text-csv_xs: perl-text-csv_xs: Denial of Service via use-after-free when parsing empty rows

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline. With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty las...

Red Hat: CVE-2026-110755: perl-text-csv_xs: Text::CSV_XS: Denial of Service via crafted carriage return line endings

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

PT-2026-115891

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

Red Hat: CVE-2026-62439: gimp: gimp: file-pvr Plug-in PVR File Parsing Integer Overflow Heap-based Buffer Overflow Vulnerability

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR .pvr file, an attacker can trigger a heap-based buffer overflow, potentially leading to...

PT-2026-115903

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash...

CVE-2026-87029

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while...

Red Hat: CVE-2026-111374: freerdp: freerdp: Denial of Service via unadvertised camera stream requests

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigur...

PT-2026-116079

🚨 CVE-2026-111680 APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by...

Red Hat: CVE-2026-111378: freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parsenlamodepdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffe...

Red Hat: CVE-2026-111373: freerdp: FreeRDP: Denial of Service via zero-length WebSocket ping

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocketreplypong passes a nullptr stream to websocketreplyclose, triggering an...

PT-2026-115915

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash...

PT-2026-115626

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The storage status-change REST service allows location records associated with DICOM instances to be transitioned to deletion-related states. Specifically,...

PT-2026-116128

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A denial of service issue exists in the Digital Certificate Manager DCM for System TLS. This occurs when applications attempt to create secure network connections, which could allow an attacker to...

PT-2026-115662

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's atwinc15x0 sta set current ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE ATWINC15X0...

MiracleLinux 8 : rsyslog-8.2102.0-15.el8_10.3 (AXSA:2026-2073:04)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2073:04 advisory. rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd...

Linux Distros Unpatched Vulnerability : CVE-2026-110875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update in src/ksm.cpp that writes past the fixed databuf2048 array without bounds...

Linux Distros Unpatched Vulnerability : CVE-2026-88753

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to...