CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-47885

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

CVE-2026-47885 Spring Framework maxPartSize Ignored in PartEventHttpMessageReader

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

CVE-2026-47885

This vulnerability affects the PartEventHttpMessageReader in Spring WebFlux , which fails to enforce the maxPartSize limit when maxInMemorySize is set to -1, potentially allowing oversized multipart data to be processed without the intended size constraint. Affected versions are Spring Framework ...

zclaw

zclaw Il più piccolo assistente personale AI possibile per ESP32. zclaw è scritto in C e funziona su schede ESP32 con un rigoroso budget totale di firmware di = 888 KiB nella build predefinita. Supporta attività programmate, controllo GPIO, memoria persistente e composizione di strumenti...

CVE-2026-80576

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

Linux Distros Unpatched Vulnerability : CVE-2026-80576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user- supplied ibbytes through to ib-lengthdw without a limit,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: udmabuf: fixed an overflow issue during the creation of udmabuf by casting sizelimitmb as a u64 type when calculating pglimit...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser could accumulate unbounded data when the header block of a multipart part never ended with the required blank line CRLFCRLF. The parser continuously stored incoming bytes in memory...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nbd: Fixed incomplete validation of ioctl arguments. We identified an alarm caused by incomplete validation of ioctl arguments without proper verification. The UBSAN warning appears as follows: UBSAN: Undefined behavior in...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mmc: jz4740: Apply DMA engine limits to maximum segment size Follow the approach used in other DMA-enabled MMC host drivers see host/mmci.c, and limit the maximum segment size based on the capabilities of the DMA engine. This is...

CVE-2026-77755 Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX import code used sys.exit to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures...

EUVD-2026-61131

MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/sharedfunc.py logs that an archive member exceeding ZIPMAXUNCOMPRESSEDFILESIZE is being skipped but does not continue to the next member, so an authenticated user can...

CVE-2026-68349 wifi: carl9170: fix buffer overflow in rx_stream failover path

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix buffer overflow in rxstream failover path The failover continuation in carl9170rxstream copies the full tlen from the second USB transfer instead of capping at rxfailovermissing bytes. When both transfers are...

EUVD-2026-55450

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix buffer overflow in rxstream failover path The failover continuation in carl9170rxstream copies the full tlen from the second USB transfer instead of capping at rxfailovermissing bytes. When both transfers are...

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

...

CVE-2026-70646

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

EUVD-2026-53920

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...

CVE-2026-71190

A flaw was found in OpenStack Swift's proxy server. The Accept header parser uses a regular expression that is vulnerable to catastrophic backtracking. An unauthenticated attacker can send a crafted Accept header with a small number of backslash characters in an unterminated quoted string, causin...

CVE-2026-54225 Apache CXF: Denial of Service attack via large attachments

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...