PT-2026-121580

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of...

CVE-2026-107079

An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcodeauth.html component...

CVE-2026-107079

The software Systrome Validation & Certification 1.0 contains a vulnerability that allows an attacker to trigger a denial of service (DoS). The issue is located within the qrcode_auth.html component and is specifically triggered via the t URL parameter . No specific remediation steps, exploit lin...

EUVD-2026-108206

An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcodeauth.html component...

ROS-20261022-73-0009

The vulnerability of the serialprocessirpdevicecontrol function in the channels/serial/client/serialmain.c file of the RDP client FreeRDP is related to an uncontrolled and exploitable flaw. Exploiting this vulnerability could allow a remote attacker to cause service failure...

Bytecode Alliance wasmtime input validation error vulnerability

The Bytecode Alliance WasmTime versions prior to 46.0.0 through 48.0.4 and 49.0.0 through 49.0.2 contain an input validation error vulnerability. This vulnerability arises because the Wasi: HTTP implementation allows a guest to set the “between-bytes-timeout” request option to 0 and then directly...

PT-2026-121655

Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single...

PT-2026-121565

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic the host via overflowing filesystem timestamps. Attackers can pass atim or mtim values whose sub-second field overflows the...

PHP 8.5.12 Fiber Callable Use-After-Free

PHP version 8.5.12 and earlier affected versions contain a Fiber callable use-after-free vulnerability that can lead to type confusion, information disclosure, and remote code execution. Proof of concept code is included. https://packetstorm.news/download/237053...

PT-2026-121559

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge...

PT-2026-121515

The MongoDB C Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no...

PT-2026-121527

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse link text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html, triggering...

PT-2026-121516

A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side...

Weaponizing the Exit: Input Privacy Leakage Via Exit Routing Manipulation in Multi-Exit Networks

Multi-exit networks improve inference efficiency by allowing inputs to terminate early at intermediate exits. We identify a privacy vulnerability in cloud deployments of these networks: a malicious Cloud Service Provider CSP can infer sensitive properties of individual user inputs solely from...

ROS-20261022-73-0029

The vulnerability in freerdp3 is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

ROS-20261022-73-0025

The vulnerability in freerdp3 is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261022-73-0079

Vulnerability in the httpresponserecvbody function of the RDP client FreeRDP, related to insufficient validation of input data, allows attackers to trigger a service failure on the client side...

PT-2026-121568

Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call ref and try table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of servic...

PT-2026-121560

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is forwarded directly to a Tokio API that panics, crashing...

PT-2026-121685

Name of the Vulnerable Software and Affected Versions Kiloview E3 NDI encoder affected versions not specified Description The ONVIF device service allows hostname, DNS, and NTP configuration write operations without authentication, ignoring the device's configured authentication settings. A remot...