GHSA-W7JP-MF2V-8342 Vikunja: Denial of service via decompression bomb in the data import

Summary Vikunja lets you export your data as a zip and import it back. The import doesn't limit how large the archive expands to, how many files it contains, or how much storage one user can consume, and it appears to hold the whole archive in memory while processing it. Because the archive is...

CVE-2026-107335 Improper Handling of Highly Compressed Data in Malcolm

Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...

EUVD-2026-94411

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions a...

Linux Distros Unpatched Vulnerability : CVE-2026-107210

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_10246)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510246 advisory. thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links CVE-2025-5986 Tenable has extracted the...

Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_10196)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510196 advisory. thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links CVE-2025-5986 Tenable has extracted the...

Rocky Linux 9 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_8203)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258203 advisory. thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link CVE-2025-3909 thunderbird: Sender Spoofing via Malformed From Header in...

Rocky Linux 10.0 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_8196)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258196 advisory. thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link CVE-2025-3909 thunderbird: Sender Spoofing via Malformed From Header in...

Rocky Linux 10.0 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2025_10195)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510195 advisory. thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links CVE-2025-5986 Tenable has extracted the...

CVE-2026-100542

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

CVE-2026-100542 OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

CVE-2026-100542

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

CVE-2026-100542 OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

SUSE CVE-2026-83602

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allo...

Linux Distros Unpatched Vulnerability : CVE-2026-83602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and...

CVE-2026-83602

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allo...

UBUNTU-CVE-2026-83602

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allo...

CVE-2026-83602 Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allo...

EUVD-2026-84562

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allo...

CVE-2026-83602

The open-source observability tool Netdata (versions 2.0.0 through 2.11.0 ) is vulnerable to an unauthenticated remote bypass of IP restrictions. The root cause is the registration of the /api/v3/settings endpoint in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA...