PT-2026-79799

Name of the Vulnerable Software and Affected Versions exceljs-hardened versions prior to 5.0.0 Description The software decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. This allows attackers to upload highly compresse...

RHEL 8 : libtiff (RHSA-2026:58553)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58553 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Heap-bas...

RHEL 9 : libtiff (RHSA-2026:58554)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58554 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Heap-bas...

rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

...

CVE-2026-77639

A flaw was found in Tor. A remote attacker could exploit a compression bomb bypass vulnerability by concatenating multiple gzip or zlib sub-streams. Each sub-stream, individually below the detection threshold, could collectively bypass the compression bomb check, leading to a Denial of Service Do...

CVE-2026-48755

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

EUVD-2026-63982

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48755 Incus has an argument injection in backup compression algorithm leading to AFW and ACE

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48755 Incus has an argument injection in backup compression algorithm leading to AFW and ACE

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48755 Incus has an argument injection in backup compression algorithm leading to AFW and ACE

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48755

Incus , a system container and virtual machine manager, is affected by an argument injection vulnerability in its backup functionality. Prior to version 7.1.0 , improper validation of the user-provided backup compression algorithm allows injection into the constructed command line, leading to arb...

CVE-2026-48755

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48755: Improper Input Validation

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

Linux Distros Unpatched Vulnerability : CVE-2026-77639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102097)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102097 advisory. In the Linux kernel, the following vulnerability has been resolved: slip: reject VJ receive packets on instances with no rstate array slhcinit accepts rslots == 0 a...

CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

DEBIAN-CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

CVE-2026-77639

Tor before 0.4.9.9 is affected by a compression bomb bypass (TROVE-2026-022). An attacker can concatenate many gzip or zlib sub-streams , each individually just under the per-stream detection threshold, to circumvent the compression bomb check entirely. This results in a Denial of Service conditi...

CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

EUVD-2026-63648

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...