Linux Distros Unpatched Vulnerability : CVE-2026-97440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: qrtr: fix node refcount leak on ctrl packet alloc failure qrtrsendresumetx calls qrtrnodelookup which takes a reference on the returned node. If the...

PT-2026-104909

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix node refcount leak on ctrl packet alloc failure qrtr send resume tx calls qrtr node lookup which takes a reference on the returned node. If the subsequent call to qrtr alloc ctrl packet fails due to memory allocati...

CVE-2026-97440

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix node refcount leak on ctrl packet alloc failure qrtrsendresumetx calls qrtrnodelookup which takes a reference on the returned node. If the subsequent call to qrtrallocctrlpacket fails due to memory allocation...

CVE-2026-94613: Allocation of Resources Without Limits or Throttling

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

CVE-2026-71540: Allocation of Resources Without Limits or Throttling

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before...

CVE-2026-88382: Allocation of Resources Without Limits or Throttling

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-96764: Allocation of Resources Without Limits or Throttling

A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component Regular Expression Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The...

CVE-2026-97418: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: es18xx: check control allocation before private data setup sndes18xxmixer creates controls with sndctlnew1 and then stores bookkeeping pointers or sets privatefree before calling sndctladd. sndctlnew1 can return NULL on...

Security update for ant (important)

openSUSE security update: security update for ant ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21891-1 Rating: important References: bsc1188469 bsc1246873 bsc1280015 Cross-References: CVE-2021-36374 CVE-2025-7962 CVE-2026-78254 CVSS scores:...

Linux Distros Unpatched Vulnerability : CVE-2026-59991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the decodeinteger function in src/hpack/hpack.py, where an attacker can send an HPACK-encoded integer with an unbounded number of continuation octets, causing run-away computation...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Parser and AsyncParser recursive JSON parsing paths in parser/shared/src/main/scala/jawn/Parser.scala and parser/shared/src/main/scala/jawn/AsyncParser.scala. An attacker...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Parser and AsyncParser recursive JSON parsing paths in parser/shared/src/main/scala/jawn/Parser.scala and parser/shared/src/main/scala/jawn/AsyncParser.scala. An attacker...

CVE-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CVE-2026-66080

The messaging broker RabbitMQ is vulnerable to an unbounded memory allocation issue in the validate_partitions function. Prior to versions 4.1.11, 4.2.6, and 4.3.0 , the system fails to enforce an upper bound on the requested partition count, allowing a large count (e.g., 500,000,000) to allocate...

CVE-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CVE-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CVE-2026-96544

An integer overflow flaw was found in GIMP's PVR image loader. When a user opens a crafted PVR image, unchecked multiplication of attacker-controlled dimensions in pvrdecoderect can result in an undersized heap allocation followed by an out-of-bounds read. This may disclose adjacent heap contents...

SUSE CVE-2026-93752

CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssTex...

CVE-2026-75935

A flaw was found in Amazon ion-java. This uncontrolled memory allocation vulnerability in the binary Ion stream cursor allows remote attackers to cause a denial of service DoS by sending a specially crafted Ion binary document. The crafted document contains a declared-length field that triggers...