EUVD-2026-49606

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSREL2 restore in kvmhyphandlemops kvmhyphandlemops resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpucpsr and writing the result directly into hardware. In...

CVE-2026-64644

CVE-2026-64644 (Next.js) affects self-hosted Next.js deployments using the default image loader. Vulnerable are Next.js versions 15.5.0–15.5.20 and 16.0.0–16.2.10. The Image Optimization API, when configured with config.images.remotePatterns, can optimize remotely hosted images and trigger CPU ex...

EUVD-2026-49388

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If...

CVE-2026-64644 Next.js: Denial of Service in the Image Optimization API using SVGs

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If...

CVE-2026-64644

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If...

CVE-2026-64641 Next.js: Denial of Service in App Router using Server Actions

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further...

CVE-2026-64641

Next.js CVE-2026-64641 describes a denial-of-service in App Router when using at least one Server Action. Affected versions are 13.0.0–15.5.20 and 16.0.0–16.2.10; crafted requests can cause excessive CPU usage that blocks processing of further requests within the same process. The issue is fixed ...

CVE-2026-64641 Next.js: Denial of Service in App Router using Server Actions

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further...

CVE-2026-64641 Next.js: Denial of Service in App Router using Server Actions

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further...

CVE-2026-64641

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further...

CVE-2026-66730

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

EUVD-2026-49359

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

CVE-2026-66730 facil.io 0.6.0 - 0.7.6 Infinite Loop DoS via Multipart MIME Body Parser

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

GO-2026-5046 CPU exhaustion in Avro decoder in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2

The Avro array and map decoders loop over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 and arm64 targets. A producer can declare a block of up to...

CVE-2026-64477

A flaw was found in the Linux kernel. When a CPU is taken offline on systems with Sub-NUMA Clustering SNC enabled, a programming error in the resource control resctrl file system can lead to an out-of-bounds memory access. This issue may cause system instability or crashes. The vulnerability aris...

CVE-2026-64373

A flaw was found in the Linux kernel's CPU frequency scaling cpufreq subsystem. During a system reboot, a race condition can occur when the system attempts to suspend CPU frequency operations while CPU hotplug operations are still active. This can lead to a null pointer dereference, which may cau...

Siemens SIMATIC S7-1500 CPU 1518 MFP Use After Free (CVE-2026-23270)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505773; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Insufficient Entropy (CVE-2026-41080)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505866; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2024-26783)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505697; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Enforcement of Behavioral Workflow (CVE-2024-50063)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505705; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...