CVE-2026-15814

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a...

CVE-2026-5132 Unbounded zlib decompression in Calls SDP WebSocket messages

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID:...

CVE-2026-5132

Mattermost versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22 fail to limit the size of unpacked SDP messages compressed with zlib in Calls WebSocket messages. An authenticated attacker (low privileges) can send many SDP messages that decompress to a large size, ca...

CVE-2026-15814 Uploading a crafted image causes excessive memory allocation in the Mattermost Server

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a...

CVE-2026-15814

Mattermost Server versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files. An authenticated user can cause excessive server memory consumption and potential denial of service by uploading a ...

CVE-2026-15814 Uploading a crafted image causes excessive memory allocation in the Mattermost Server

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a...

CVE-2026-90584

A flaw was found in TooTallNate Java-WebSocket. A remote attacker can exploit a weakness in the processFrameContinuousAndNonFin function within the Fragmentation Handler component. This vulnerability allows for excessive allocation of resources, which can lead to a Denial of Service DoS condition...

Exploit for CVE-2026-90782

CVE-2026-90782 — S2OPC Status-Clobbering NULL Dereference Sta...

CVE-2026-33960

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, resulting in an out-of-bounds write and causing a denial of...

Important: libsoup3

Issue Overview: A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed...

CVE-2026-33960

Samsung Exynos Mobile and Wearable Processors (1330, 1380, 1480, 1580, 1680, W920, W930, W1000) are affected by an out-of-bounds write vulnerability triggered by a malformed ioctl command to the Wi-Fi interface device , which causes improper buffer size allocation. The impact is a denial of servi...

CVE-2023-24288

An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers to cause a Denial of Service DoS via creating an excessive amount of save states...

CVE-2026-50270: Allocation of Resources Without Limits or Throttling

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DDTRACEBAGGAGEMAXITEMS, which defaults to 64, or DDTRACEBAGGAGEMAXBYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can sen...

CVE-2026-11993: Allocation of Resources Without Limits or Throttling

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the...

PT-2026-91231

Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer...

CVE-2026-86892: Allocation of Resources Without Limits or Throttling

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to cause a denial-of-service...

CVE-2026-54156: Allocation of Resources Without Limits or Throttling

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global galreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts records nonces from OpenSecureChannelRequest and CreateSessi...

Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-2160)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2160 advisory. A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper bounda...

PT-2026-91020

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, resulting in an out-of-bounds write and causing a denial of...

EUVD-2026-77161

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, resulting in an out-of-bounds write and causing a denial of...