GHSA-8H9X-89F2-M7X3 Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer

Summary The decompression-bomb bound added in 2.0.1 commit 1c1003c sums ZipArchive::statIndex$i'size' and rejects an archive whose declared uncompressed total exceeds system.gpm.archive.maxuncompressedsize default 1 GiB before extracting ZipArchiver.php:77-86; same logic in GPM\Installer::unZip a...

com.squareup.wire:wire-grpc-client (4.9.8), com.squareup.wire:wire-schema (4.9.8) +2 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.8)

com.squareup.wire:wire-runtime MAVEN version 4.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.8 - com.squareup.wire:wire-schema 4.9.8 -...

PT-2026-94670

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the OCFS2 cluster component where the o2nm node local store function fails to clear the cl has local variable when handling local=0. This creates a stale state that...

PT-2026-95068

Summary The decompression-bomb bound added in 2.0.1 commit 1c1003c sums ZipArchive::statIndex$i'size' and rejects an archive whose declared uncompressed total exceeds system.gpm.archive.max uncompressed size default 1 GiB before extracting ZipArchiver.php:77-86; same logic in GPMInstaller::unZip ...

Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

Summary An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool. The method Installer::unZip calls ZipArchive::extractTo without any limit on uncompressed size, entry count, or directory depth, enabling Zip Bom...

GHSA-2VCX-H8P2-9PG9 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

Summary An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool. The method Installer::unZip calls ZipArchive::extractTo without any limit on uncompressed size, entry count, or directory depth, enabling Zip Bom...

CVE-2026-20343

A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. This vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeated...

EUVD-2026-81126

A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. This vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeated...

CVE-2026-20343 Cisco Secure Firewall Management Center Software Information Disclosure and Disk Denial of Service Vulnerability

A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. This vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeated...

CVE-2026-20343

A vulnerability in a critical API of Cisco Secure Firewall Management Center (FMC) Software arises because the API lacks authentication . An unauthenticated, remote attacker can exploit it by repeatedly invoking the API, potentially downloading sensitive files that should be restricted and consum...

CVE-2026-20343 Cisco Secure Firewall Management Center Software Information Disclosure and Disk Denial of Service Vulnerability

A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. This vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeated...

CVE-2026-20343: Missing Authentication for Critical Function

A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. This vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeated...

PT-2026-93612

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NVMe subsystem where the nvme update ns info block function fails to correctly handle positive NVMe status codes returned by nvme query zone info, only checking fo...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in multer

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in multer Vulnerability Details CVEID:CVE-2026-5038 DESCRIPTION: Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malform...

Security Bulletin: IBM DB2 Developer extension is affected via vulnerability in spring-web(CVE-2026-22740)

Summary IBM DB2 Developer extension is affected via vulnerability in spring-webCVE-2026-22740 Vulnerability Details CVEID:CVE-2026-22740 DESCRIPTION: A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files...

SUSE CVE-2026-88932

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...

CVE-2026-90842: Cleartext Storage in a File or on Disk

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

CVE-2026-91941: Uncontrolled Resource Consumption

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-84581

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory...

CVE-2026-84588

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory...