GHSA-6WVW-VRW4-363W node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: = 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 High CVSS Vecto...

CVE-2026-9033 Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful...

EUVD-2026-63543

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful...

CVE-2026-9033

CVE-2026-9033 affects TP-Link Omada Gateways . An unauthenticated attacker with adjacent network access to the captive portal service can terminate active sessions, either forcing logout of specific users or clearing all sessions, causing temporary service disruption and requiring re-authenticati...

AZL-97524 CVE-2026-63384 affecting package mysql 8.0.46-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX becom...

AZL-96912 CVE-2026-63380 affecting package libtevent 0.14.1-1

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evwsnewsession enters its error path after evhttpstartws succeeds but buffereventenablelocking fails. evwsconnectionfree sees a non-null httpserver and unconditionally call...

AZL-96921 CVE-2026-63383 affecting package libtevent 0.14.1-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five bytes from evbufferpullup but iterates using the full logical buffer length. A fragmented evbuffer...

CVE-2026-54623

django CMS prior to 5.0.8 is vulnerable to a denial-of-service via the move_plugin endpoint in cms/admin/placeholderadmin.py. The endpoint accepts an attacker-controlled plugin_parent value without rejecting a plugin's own identifier or a descendant identifier, allowing a staff user with plugin-c...

CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

CVE-2026-63387

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsnametolabels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdnsserverrequestformatresponse. The final-label check...

CVE-2026-63380

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evwsnewsession enters its error path after evhttpstartws succeeds but buffereventenablelocking fails. evwsconnectionfree sees a non-null httpserver and unconditionally call...

CVE-2026-63495

Libevent (event notification library) versions 2.2.0-alpha-dev through 2.2.2-alpha contain an unbounded memory accumulation vulnerability in its WebSocket server (ws.c). The evws->incomplete_frames buffer accumulates fragmented frames without enforcing a total message-size limit. An unauthenti...

CVE-2026-63495 Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

CVE-2026-74331

A flaw was found in the Linux kernel's firmware loader. During system suspend or hibernation, a recursive locking deadlock can occur in the power management notification handler. This happens when memory allocation for asynchronous firmware caching fails, causing a synchronous execution path to...

GHSA-QQFF-5854-PX68 vouch-proxy has an Unbounded Multipart Cookie Allocation DoS

Unbounded Multipart Cookie Allocation DoS in vouch-proxy Summary vouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The /validate endpoint parses the total cookie part count directly from the attacker-controlled cookie...

CVE-2026-40345

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

MINI-QVR2-Q3JQ-P23J

Bulletin has no description...

CVE-2026-74312

A flaw was found in the Linux kernel's vhost/vdpa subsystem. Improper validation of the virtqueue index in the vhostvdpammap and vhostvdpafault functions allows an out-of-range index to be used. This can lead to an out-of-bounds memory access in driver-specific callbacks, potentially causing...

CVE-2026-40345

deepmerge-ts

CVE-2026-40345 deepmerge-ts: Stack exhaustion when merging recursive object graphs

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...