CVE-2026-90799

Apache CouchDB version 3.5.2 and below are vulnerable to a denial of service attack on all platforms. The root cause is unsafe binary deserialisation within the chttpd component, which can be triggered by an authenticated user providing specially crafted sequence values in _changes sequences and ...

CVE-2026-90799 Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-90799

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

EUVD-2026-105158

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-92449

gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...

CVE-2026-91189

The GUIX binary resource loader never checks that a font page's glyph range is well formed. gxpageheaderfirstglyph and gxpageheaderlastglyph are read verbatim from the file and only the upper bound of lastglyph is validated, so a page declaring firstglyph lastglyph makes last - first + 1 underflo...

CVE-2026-91189

The GUIX binary resource loader is vulnerable to a heap out-of-bounds write when processing untrusted fonts or themes. The root cause is an integer underflow occurring because the loader fails to verify that a font page's glyph range is well-formed; specifically, if first_glyph > last_glyph, t...

EUVD-2026-105040

The GUIX binary resource loader never checks that a font page's glyph range is well formed. gxpageheaderfirstglyph and gxpageheaderlastglyph are read verbatim from the file and only the upper bound of lastglyph is validated, so a page declaring firstglyph lastglyph makes last - first + 1 underflo...

CVE-2026-91189 GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme

The GUIX binary resource loader never checks that a font page's glyph range is well formed. gxpageheaderfirstglyph and gxpageheaderlastglyph are read verbatim from the file and only the upper bound of lastglyph is validated, so a page declaring firstglyph lastglyph makes last - first + 1 underflo...

CVE-2026-92446

The GUIX binary resource loader contains an out-of-bounds read vulnerability within the gx_binres_theme_load() and gx_binres_font_load() functions. The root cause is that these functions accept resources as a bare GX_UBYTE * without a length, and the GX_BINRES_DATA_INFO structure lacks a field to...

CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader

gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...

CVE-2026-92449

The GUIX binary resource (theme) loader contains a heap out-of-bounds write vulnerability in the _gx_binres_pixelmap_table_load() function. The root cause is the lack of bounds checking on the map_id value read directly from a resource file when indexing the pixelmap table . A crafted theme file ...

CVE-2026-92449 Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena

gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...

EUVD-2026-105036

gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...

Malicious code in animatecss-tailwind-binary (npm)

animatecss-tailwind-binary 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by jamesvectorpack on 2026-09-28. src/motion.js:5 requires the private scoped packa...

PT-2026-118486

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

GO-2026-6705 Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM in github.com/0xJacky/Nginx-UI

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM in github.com/0xJacky/Nginx-UI...

CVE-2026-110522

A flaw was found in oc-mirror's legacy v1 catalog cache rebuild. When the --build-catalog-cache flag is used, oc-mirror extracts an opm binary from the remote operator catalog image and executes it on the host without verifying its signature, digest, or integrity. An attacker who publishes a...

CVE-2026-111439

在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pgreadbinaryfileblocks 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 isrowdatafile...

mariadb: mariadb: Denial of Service via invalid binary JSON in mysql_json plugin

A flaw was found in the mysqljson plugin in MariaDB. The plugin incorrectly assumes that imported MySQL tables contain valid binary JavaScript Object Notation JSON data. An attacker can exploit this issue by supplying a specially crafted MySQL table containing invalid JSON data, triggering an...