PT-2026-95192

Name of the Vulnerable Software and Affected Versions O-RAN-SC SMO OAM version 2025-06-10 Description A flaw exists within the VES Collector component that allows remote exploitation. Manipulation of this component leads to the allocation of resources, which can impact system stability...

EulerOS Virtualization 2.12.0 : mod_http2 (EulerOS-SA-2026-3652)

According to the versions of the modhttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious...

EulerOS Virtualization 2.12.1 : mod_http2 (EulerOS-SA-2026-3598)

According to the versions of the modhttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious...

EulerOS 2.0 SP10 : mod_http2 (EulerOS-SA-2026-3752)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP requests...

Linux Distros Unpatched Vulnerability : CVE-2026-90123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: irqchip/ast2700-intc: Avoid allocating in the irqdomain activate callback The interrupt core...

CVE-2026-93310: Allocation of Resources Without Limits or Throttling

A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was inform...

CVE-2026-84447: Allocation of Resources Without Limits or Throttling

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processedids is copied per branch and ImageItem::decodeimage has no shared operation budget. This vulnerability is fix...

CVE-2026-69186: Uncontrolled Resource Consumption

c-ares is an asynchronous resolver library. Prior to 1.34.7, aresdnsparse trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because processanswer invokes parsing before transaction ID and...

Linux Distros Unpatched Vulnerability : CVE-2026-90358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128...

PT-2026-95366

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 ImageMagick versions prior to 6.9.13-56 Description A policy bypass exists in the PCD, CUBE, and HALD coders. When a specific command line option is used, the decoder fails to verify the configured resour...

PT-2026-95369

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A policy bypass exists in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. An attacker can bypass resource policies by processing specially craft...

CVE-2026-93308: Allocation of Resources Without Limits or Throttling

A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be...

CVE-2026-93309: Allocation of Resources Without Limits or Throttling

A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

CVE-2026-93688: Allocation of Resources Without Limits or Throttling

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstraproom values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstraproom...

PT-2026-95637

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description An unbounded memory allocation issue exists in the handle staging req function within prefill/decode disaggregation deployments. The system fails to validate the chunk idx variable received from ZMQ...

CVE-2026-93752: Improperly Controlled Modification of Dynamically-Determined Object Attributes

CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssTex...

CVE-2026-93838: Allocation of Resources Without Limits or Throttling

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handlestagingreq that fails to validate chunkidx from ZMQ STAGINGREQ frames in prefill/decode disaggregation deployments. Attackers with access to the decode engine's internal ZMQ rank port can send a frame wit...

PT-2026-95359

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the SpdySessionHandler allows an unlimited number of concurrent remote-initiated streams because the localConcurrentStreams variable defaults to Integer.MAX VALUE and the handler lack...

CVE-2026-93488: Allocation of Resources Without Limits or Throttling

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...

Linux Distros Unpatched Vulnerability : CVE-2026-90388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dmaallocfrompool, which returns the allocated page a...