PT-2026-121580

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of...

CVE-2026-107079

An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcodeauth.html component...

CVE-2026-107079

The software Systrome Validation & Certification 1.0 contains a vulnerability that allows an attacker to trigger a denial of service (DoS). The issue is located within the qrcode_auth.html component and is specifically triggered via the t URL parameter . No specific remediation steps, exploit lin...

EUVD-2026-108206

An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcodeauth.html component...

ROS-20261022-73-0009

The vulnerability of the serialprocessirpdevicecontrol function in the channels/serial/client/serialmain.c file of the RDP client FreeRDP is related to an uncontrolled and exploitable flaw. Exploiting this vulnerability could allow a remote attacker to cause service failure...

Bytecode Alliance wasmtime input validation error vulnerability

The Bytecode Alliance WasmTime versions prior to 46.0.0 through 48.0.4 and 49.0.0 through 49.0.2 contain an input validation error vulnerability. This vulnerability arises because the Wasi: HTTP implementation allows a guest to set the “between-bytes-timeout” request option to 0 and then directly...

PT-2026-121655

Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion, a single...

PT-2026-121565

Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest WASI programs to panic the host via overflowing filesystem timestamps. Attackers can pass atim or mtim values whose sub-second field overflows the...

PHP 8.5.12 Fiber Callable Use-After-Free

PHP version 8.5.12 and earlier affected versions contain a Fiber callable use-after-free vulnerability that can lead to type confusion, information disclosure, and remote code execution. Proof of concept code is included. https://packetstorm.news/download/237053...

KiloView E3 Firmware authorization issue vulnerability

Versions of the KiloView E3 firmware prior to 1.30 contain an authorization issue vulnerability. This vulnerability arises because the ONVIF device service accepts write operations for hostname, DNS, and NTP configurations without authentication. Remote attackers who lack authentication can modif...

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of...

PT-2026-121559

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge...

PT-2026-121515

The MongoDB C Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no...

PT-2026-121527

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse link text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html, triggering...

PT-2026-121516

A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side...

Weaponizing the Exit: Input Privacy Leakage Via Exit Routing Manipulation in Multi-Exit Networks

Multi-exit networks improve inference efficiency by allowing inputs to terminate early at intermediate exits. We identify a privacy vulnerability in cloud deployments of these networks: a malicious Cloud Service Provider CSP can infer sensitive properties of individual user inputs solely from...

ROS-20261022-73-0029

The vulnerability in freerdp3 is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

ROS-20261022-73-0025

The vulnerability in freerdp3 is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

ALSA-2026:88211 Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw CVE-2026-599...

ROS-20261022-73-0071

The vulnerability in the cache decoder functions of SCARDIOCTLREADCACHEA and SCARDIOCTLWRITECACHEA for the RDP client FreeRDP, related to the assignment of a null pointer, allows a malicious actor to trigger a service failure for the client application...