CVE-2026-107287

The Pydantic AI Python agent framework contains a vulnerability where the local web_fetch_tool and WebFetch local fallback exhibit excessive CPU and memory consumption. This is caused by inefficient processing during the HTML-to-Markdown conversion of attacker-controlled HTML containing deeply ne...

CVE-2026-105399 ImageMagick before 7.1.2-31 Denial of Service via MVG Decoder

ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a denial of service vulnerability in the MVG decoder caused by a missing limit check. Attackers can supply a crafted MVG image that triggers a long-running decoding operation, consuming excessive CPU resources and stalling image...

CVE-2026-107678: Uncontrolled Recursion

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...

Ghost: Regular Expression Denial of Service in External Media Inliner

Impact A crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v5.37.0 up to v6.65.0. Patches v6.67.0 contains a fix for th...

GHSA-9M4W-FMJW-FVJQ Ghost: Regular Expression Denial of Service in External Media Inliner

Impact A crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v5.37.0 up to v6.65.0. Patches v6.67.0 contains a fix for th...

EUVD-2026-92635

Ghost: Regular Expression Denial of Service in External Media Inliner...

EUVD-2026-92636

Ghost: Regular Expression Denial of Service in Content Import...

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

Summary com.rabbitmq.tools.json.JSONReader.read never returns when its input ends inside a quoted string or a // line comment. Both scanners walk the input with StringCharacterIterator.next but only compare against a delimiter, so once the iterator reaches CharacterIterator.DONE ￿ they loop...

EUVD-2026-93773

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS...

Allocation of Resources Without Limits or Throttling

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through repeated allocation of large buffers in the LZ4FrameInputStream.readHeader...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through repeated allocation of large buffers in the LZ4FrameInputStream.readHeader process. An attacker can cause excessive CPU and garbage collection usage by providing specially...

CVE-2026-107223

The Excelize Go language library (versions 2.1.0 to 2.11.0 ) is vulnerable to a Memory Allocation with Excessive Size Value (CWE-789) flaw. The root cause is that the flatCols() function expands file-loaded column ranges without validating Min and Max against the MaxColumns limit. Specifically, w...

Security Bulletin:body-parser Limit Validation Vulnerability in Versions Prior to 1.20.6 and 2.3.0

Summary Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit...

EUVD-2026-94165

src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSHMSGKEXDHGEXGROUP 31 and SSHMSGKEXDHGEXREPLY 33 when a server receives them from an unauthenticated client. IsMessageAllowedServer applies no direction check to the key exchange...

Linux Distros Unpatched Vulnerability : CVE-2026-106121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0,...

python: Quadratic complexity in os.path.expandvars() with user-controlled template

A vulnerability in Python’s os.path.expandvars function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denia...

keycloak: Keycloak: Denial of Service via specially crafted SAML input

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language SAML endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service DoS where the server becomes...

keycloak: Keycloak: Denial of Service via specially crafted SAML input

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language SAML endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service DoS where the server becomes...

keycloak: Keycloak: Denial of Service via specially crafted SAML input

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language SAML endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service DoS where the server becomes...

UBUNTU-CVE-2026-98237

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...