CLEANSTART-2026-ZJ82882 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

CVE-2026-42499 affects multiple packages. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. See references for individual vulnerability details...

CLEANSTART-2026-ZA45102 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

CVE-2026-32280 affects multiple packages. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CLEANSTART-2026-BP29936 In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the apache-nifi-registry package. In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service DoS condition...

CLEANSTART-2026-QH78239 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the apache-nifi-registry package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...

CLEANSTART-2026-VX49826 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1

Security vulnerability affects the apache-nifi-registry package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...

CLEANSTART-2026-SL44915 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)

Security vulnerability affects the sonarqube package. Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

CLEANSTART-2026-CX44155 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

CVE-2026-39827 affects multiple packages. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See references for individual vulnerability details...

CLEANSTART-2026-OL23592 When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

CVE-2026-39834 affects multiple packages. When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. See references for individu...

PT-2026-108126

Name of the Vulnerable Software and Affected Versions enshrined/svg-sanitize versions prior to 1.0.0 Description A flaw exists in the cleanAttributesOnWhitelist function within src/Sanitizer.php where the software fails to strip DOCTYPE/DTD declarations before processing. An attacker can provide ...

PT-2026-108290

Name of the Vulnerable Software and Affected Versions SumatraPDF version 3.7.0.22298 Description In the src/MobiDoc.cpp file, the untrusted unsigned mobiHdr.hdrLen field is narrowed to a signed integer during validation. This allows values exceeding INT MAX to be treated as negative, bypassing th...

CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining string...

EulerOS 2.0 SP15 : busybox (EulerOS-SA-2026-3900)

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A stack overflow in the evaluate function editors/awk.c of BusyBox commit 371fe9 allows attackers to cause a Denial of Service DoS via supplying a...

MiracleLinux 9 : kernel-5.14.0-687.44.1.el9_8 (AXSA:2026-1991:92)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1991:92 advisory. kernel: smc: Fix use-after-free in pnetfindbasendev CVE-2025-40064 kernel: Linux kernel: Denial of Service due to memory leak in tpm2loadcmd...

MiracleLinux 8 : glibc-2.28-251.el8_10.43 (AXSA:2026-1996:12)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1996:12 advisory. glibc: Process abort due to invalid memory in wordexp CVE-2026-6368 glibc: Denial of Service via stack exhaustion during tilde expansion CVE-2026-67...

PT-2026-107796

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

PT-2026-108007

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free...

CVE-2026-107695: Loop with Unreachable Exit Condition

FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parseplaylist accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that...

PT-2026-107774

An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remot...

UBUNTU-CVE-2026-106573

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and...

bind9.16 security, bug fix, and enhancement update

32:9.16.23-0.22-16 - Backport 'Do not use headerprev in expirelruheaders' from upstream. 32:9.16.23-0.22-15 - Reenable unit tests during build 32:9.16.23-0.22.14 - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent crash on wildcard responses containing both NS...